A European Commission committee is reviewing how to define “significant” cybersecurity incidents that must be promptly reported to authorities under NIS2, according to a draft of the discussions reviewed by Euractiv. Under the draft proposal, cyber incidents that cause harm to individuals’ health or financial losses of more than 500,000 euros or 5% of a companies global turnover are considered “significant.” In addition, a minimum of 5% of total EU users must be affected.
Full story