CoChat
Sign Up
PreprintCited by 1

The DOI matches its DataCite record.

A Systematic Literature Review on the NIS2 Directive

Ruohonen, Jukka·2024·arXiv
DOI 10.48550/arxiv.2412.08084arXiv 2412.08084
Open this paper in CoChat — free account

Abstract

The second network and information security (NIS2) directive was enacted in the European Union (EU) in late 2022. It deals particularly with European critical infrastructures, enlarging their scope substantially from an older directive that only considered the energy and transport sectors as critical. The directive's focus is on cyber security of critical infrastructures, although together with other new EU laws it expands to other security domains as well. Given the importance of the directive and most of all the importance of critical infrastructures, the paper presents a systematic literature review on academic research addressing the NIS2 directive either explicitly or implicitly. According to the review, existing research has often framed and discussed the directive with the EU's other cyber security laws. In addition, existing research has often operated in numerous contextual areas, including industrial control systems, telecommunications, the energy and water sectors, and infrastructures for information sharing and situational awareness. Despite the large scope of existing research, the review reveals noteworthy research gaps and worthwhile topics to examine in further research.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2412.08084

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 53

  1. Almagro, C. C. (2023). NIS2 Impact on Electronic Communications Networks Providers. In Proceedings of the International Workshop on Fiber Optics on Access Networks (FOAN 2023), pages 16-16, Gent. IEEE.
  2. Anwar, A., Abusnaina, A., Chen, S., Li, F., and Mohaisen, D. (2022). Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses. IEEE Transactions on Dependable and Secure Computing, 19(6):4255-4269.
  3. Bobbert, Y. and Timmermans, T. (2024). Zero Trust and Compliance with Industry Frame- works and Regulations: A Structured Zero Trust Approach to Improve Cybersecurity and Reduce the Compliance Burden. In Proceedings of the Future of Information and Commu- nication Conference (FICC 2024), pages 650-667, Berlin. Springer.
  4. Bocianiak, K., Pawlikowski, T., Podlasek, A., Wary, J.-P., and Wierzbowski, J. (2024). Chal- lenges for Continuous, Provable Security Service Level Agreement Management in Comput- ing Continuum. IEEE Access, 12:152097-152107.
  5. Chiara, P. G. (2022a). The Cyber Resilience Act: the EU Commission's Proposal for a Hori- zontal Regulation on Cybersecurity for Products With Digital Elements: An Introduction. International Cybersecurity Law Review, 3:255-272.
  6. Chiara, P. G. (2022b). The IoT and the New EU Cybersecurity Regulatory Landscape. In- ternational Review of Law, Computers & Technology, 36(2):118-137.
  7. Chiara, P. G. (2024). The Internet of Things and EU Law: Cybersecurity, Privacy and Data Protection Challenges. Springer, Cham.
  8. Coppolino, L., Nardone, R., Petruolo, A., Romano, L., and Souvent, A. (2024). Exploiting Digital Twin Technology for Cybersecurity Monitoring in Smart Grids. In Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2024), pages 1-10, Vienna. ACM.
  9. de Vasconcelos Casimiro, S. (2023). Cyber Operations Threatening the European Union and Its Member States: The Rise of the European Union as a Cyber Defence Actor. In Vi- cente, D. M., de Vasconcelos Casimiro, S., and Chen, C., editors, The Legal Challenges of the Fourth Industrial Revolution: The European Union's Digital Strategy, pages 211-232.
  10. Eckhardt, P. and Kotovskaia, A. (2023). The EUs Cybersecurity Framework: The Interplay Between the Cyber Resilience Act and the NIS 2 Directive. International Cybersecurity Law Review, 4:147-164.
  11. Fisch, C. and Block, J. (2018). Six Tips for Your (Systematic) Literature Review in Business and Management Research. Management Review Quarterly, pages 103-106.
  12. Franke, U. and Brynielsson, J. (2014). Cyber Situational Awareness -A Systematic Review of the Literature. Computers & Security, 46:18-31.
  13. Giunta, G., Stira, C., Modic, J., Ĉaleta, D., Semertzidis, T., Zahariadis, T., and Skianis, C. (2025). Improved Resilience of Critical Infrastructures Against Large-Scale Transnational and Systemic Risks. In Gkotsis, I., Kavallieros, D., Stoianov, N., Vrochidis, S., Diagourtas, D., and Akhgar, B., editors, Paradigms on Technology Development for Security Practition- ers, pages 169-182. Springer.
  14. Gounari, M., Stergiopoulos, G., Pipyros, K., and Gritzalis, D. (2024). Harmonizing Open Banking in the European Union: An Analysis of PSD2 Compliance and Interrelation with Cybersecurity Frameworks and Standards. International Cybersecurity Law Review, 5:79- 120.
  15. Grotto, A. J. and Schallbruch, M. (2021). Cybersecurity and the Risk Governance Triangle: Cybersecurity Governance From a Comparative U.S.-German Perspective. International Cybersecurirty Law Review, 2:77-92.
  16. Harašta, J. (2018). Legally Critical: Defining Critical Infrastructure in an Interconnected World. International Journal of Critical Infrastructure Protection, 21:47-56.
  17. Henze, M., Ortmann, M., Vogt, T., Ugus, O., Hermann, K., Nohr, S., Lu, Z., Michaelides, S., Massonet, A., and Schmitt, R. H. (2024). Towards Secure 5G Infrastructures for Production Systems. In Proceedings of the Applied Cryptography and Network Security Workshops, pages 198-203, Abu Dhabi. Springer.
  18. Horalek, J., Otcenaskova, T., Sobeslav, V., and Tucnik, P. (2024). A Business Process and Data Modelling Approach to Enhance Cyber Security in Smart Cities. In Proceedings of the 9th EAI International Conference on Nature of Computation and Communication (ICTCC 2023), pages 70-84, Ho Chi Minh City. Springer.
  19. Hurst, W. and Shone, N. (2024). Critical Infrastructure Security: Cyber-Threats, Legacy Systems and Weakening Segmentation. In Tekinerdogan, B., Akşit, M., Catal, C., Hurst, W., and Alskaif, T., editors, Management and Engineering of Critical Infrastructures, pages 265-286. Academic Press, Amsterdam.
  20. Jara, A., Martinez, I. G., and Sanchez, J. S. (2024). Cybersecurity Resilience Act (CRA) in Practice for IoT Devices: Getting Ready for the NIS2. In Proceedings of the IEEE Smart Cities Futures Summit (SCFC 2024), pages 56-60, Marrakech. IEEE.
  21. Katulić, F., Groŝ, S., Sumina, D., and Erceg, I. (2024). Enhancing Industrial Automation and Control Systems Cybersecurity Using Endpoint Detection and Response Tools. In Proceedings of the 21st International Conference on Smart Technologies & Education (STE 2024), pages 186-197, Helsinki. Springer.
  22. Kitchenham, B., Brereton, O. P., Budgen, D., Turner, M., Bailey, J., and Linkman, S. (2009). Systematic Literature Reviews in Software Engineering -A Systematic Literature Review. Information and Software Technology, 51(1):7-15.
  23. Krauze, B. and Grabis, J. (2024). A Conceptual Model of Digital Immune System to Increase the Resilience of Technology Ecosystems. In Proceedings of the 18th International Confer- ence on Research Challenges in Information Science (RCIS 2024), pages 82-96. Springer, Guimarães.
  24. Lehto, M. (2022). Cyber-Attacks Against Critical Infrastructure. In Lehto, M. and Neittaanmäki, P., editors, Cyber Security: Critical Infrastructure Protection, pages 3-42. Springer, Cham.
  25. Little, R. G. (2002). Controlling Cascading Failure: Understanding the Vulnerabilities of Interconnected Infrastructures. Journal of Urban Technology, 9(1):109-123.
  26. Maglaras, L. A., Kim, K.-H., an Mohamed Amine Ferrag, H. J., Rallis, S., Fragkou, P., Maglaras, A., and Cruz, T. J. (2018). Cyber Security of Critical Infrastructures. ICT Express, 4(1):42-45.
  27. Malone, M. and Walton, R. (2023). Comparing Canada's Proposed Critical Cyber Systems Protection Act with Cybersecurity Legal Requirements in the EU. International Cyberse- curity Law Review, 4:165-196.
  28. Maroofi, S., Korczyński, M., Hesselman, C., Ampeau, B., and Duda, A. (2020). COMAR: Classification of Compromised Versus Maliciously Registered Domains. In Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P), pages 607-623, Genoa. IEEE.
  29. Martino, L. (2024). Cybersecurity in Italy: Governance, Policies and Ecosystem. Springer, Cham.
  30. Meagher, H. and Dhirani, L. L. (2024). Cyber-Resilience, Principles, and Practices. In Qureshi, K. N., Newe, T., Jeon, G., and Chehri, A., editors, Cybersecurity Vigilance and Security Engineering of Internet of Everything, pages 57-74. Springer, Cham.
  31. Mersni, A., Novikau, A., Koczan, M., and Shobole, A. A. (2024). Protect the EU's Digital Energy Infrastructure Against Cyberthreats Through Advanced Technologies, Human Vul- nerability Mitigation, and Ethical Practices. In Crowther, A., Foulds, C., Robison, R., and Gladkykh, G., editors, Strengthening European Energy Policy: Governance Recommenda- tions From Innovative Interdisciplinary Collaborations, pages 115-128. Palgrave Macmillan, Cham.
  32. Mikac, R. (2023). Protection of the EU's Critical Infrastructures: Results and Challenges. Applied Cybersecurity & Internet Governance, 2(1):1-25.
  33. Möller, D. P. F. (2023). Guide to Cybersecurity in Digital Transformation: Trends, Methods, Technologies, Applications and Best Practices. Springer, Cham.
  34. Muñoz-Navarro, E., Hernández-Montesinos, J. J., Marqués-Moreno, A., Papadopoulos, L., Karteris, A., and Demestichas, K. (2025). PRAETORIAN: From Protection to Resilience of Critical Infrastructures. In Gkotsis, I., Kavallieros, D., Stoianov, N., Vrochidis, S., Di- agourtas, D., and Akhgar, B., editors, Paradigms on Technology Development for Security Practitioners, pages 155-168. Springer.
  35. Nguyen, V. H. and Massacci, F. (2013). The (Un)Reliability of NVD Vulnerability Versions Data: An Empirical Experiment on Google Chrome Vulnerabilities. In Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (ASIACCS 2013), pages 493-498. ACM.
  36. Ruohonen, J. (2024). The Incoherency Risk in the EU's New Cyber Security Policies. In Pro- ceedings of the 23rd IFIP Conference on e-Business, e-Services, and e-Society (I3E 2024), pages 284-295, Heerlen. Springer.
  37. Ruohonen, J., Choudhary, G., and Alami, A. (2024). An Overview of Cyber Security Funding for Open Source Software. Archived manuscript, available online in December: https: //arxiv.org/abs/2412.05887.
  38. Ruohonen, J. and Timmers, P. (2024). Vulnerability Coordination Under the Cyber Resilience Act. Archived manuscript, available online: https://arxiv.org/abs/2412.06261. · arXiv
  39. Sanders, I. T. (2023). Risk Assessment and Identification Methodology for the Defense Industry in Times of Crisis: Decision-Making. In Balomenos, K. P., Fytopoulos, A., and Pardalos, P. M., editors, Handbook for Management of Threats: Security and Defense, Resilience and Optimal Strategies, pages 103-123. Springer, Cham.
  40. Schaberreiter, T., Quirchmayr, G., and Papanikolaou, A. (2022). A Case for Cybersecurity Awareness. In Andriessen, J., Schaberreiter, T., Papanikolaou, A., and Röning, J., editors, Cybersecurity Awareness, pages 1-19. Springer, Cham.
  41. Schaberreiter, T., Wieser, C., Koumpis, A., Luidold, C., Andriessen, J., Cappiello, C., and Röning, J. (2023). Addressing Critical Issues and Challenges for Dynamic Cybersecurity Management in Organisations and Local / Regional Networks: The CS-AWARE-NEXT Project. In Proceedings of the Fifth International Conference on Transdisciplinary AI (Tran- sAI 2023), pages 232-236, Laguna Hills. IEEE.
  42. Schmitz-Berndt, S. and Chiara, P. G. (2022). One Step Ahead: Mapping the Italian and German Cybersecurity Laws Aainst the Proposal for a NIS2 Directive. International Cy- bersecurity Law Review, 3:289-311.
  43. Shaffique, M. R. (2024). Cyber Resilience Act 2022: A Silver Bullet for Cybersecurity of IoT Devices or a Shot in the Dark? Computer Law & Security Review, 54:106009.
  44. Shi, Y., Chen, G., and Li, J. (2018). Malicious Domain Name Detection Based on Extreme Machine Learning. Neural Processing Letters, 48:1347-1357.
  45. Skias, D. D., Zahariadis, S. S. T. T. T., Voulkidis, A. A., and Velivassaki, T.-H. (2022). Demon- stration of Alignment of the Pan-European Cybersecurity Incidents Information Sharing Platform to Cybersecurity Policy, Regulatory and Legislative Advancements. In Proceed- ings of the 17th International Conference on Availability, Reliability and Security (ARES 2022), pages 1-8, Vienna. ACM.
  46. Spinuzzi, C. (2011). Losing by Expanding: Corralling the Runaway Object. Journal of Business and Technical Communication, 25(4):449-486.
  47. Vandezande, N. (2024). Cybersecurity in the EU: How the NIS2-Directive Stacks Up Against Its Predecessor. Computer Law & Security Review, 52:105890.
  48. Veigurs, M., Lasmanis, T., and Romanovs, A. (2024). IT Governance in Critical Sectors: To- wards the NIS2 Implementation. In Proceedings of the IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical Univer- sity (ITMS 2024), pages 1-7, Riga. IEEE.
  49. Walden, I. and Michels, J. D. (2024). Getting Critical: Making Sense of the EU Cybersecurity Framework for Cloud Providers. In de Andrade, F. A. C. P., Freitas, P. M. F., and de Sousa Covelo de Abreu, J. R., editors, Legal Developments on Cybersecurity and Related Fields, pages 9-38. Springer, Cham.
  50. Wanecki, P., Jaŝek, R., and Drofova, I. (2023). The Contribution of the European NIS2 Directive to the Design of the Cyber Security Model. In Proceedings of the nternational Conference on Information and Digital Technologies (IDT 2023), pages 149-154, Zilina.
  51. Wylde, V., Prakash, E., Hewage, C., and Platts, J. (2023). Post-Covid-19 Metaverse Cyberse- curity and Data privacy: Present and Future Challenges. In Hewage, C., Rahulamathavan, Y., and Ratnayake, D., editors, Data Protection in a Post-Pandemic Society: Laws, Regu- lations, Best Practices and Recent Solutions, pages 1-48. Springer, Cham.
  52. Kowalkowski, S., Kaźmierczak, D., and Paul, S., editors, Civil Protection Systems and Dis- aster Governance: A Cross-Regional Approach, pages 41-59. Palgrave Macmillan, Cham.
  53. Zibak, A. and Simpson, A. (2019). Cyber Threat Information Sharing: Perceived Benefits and Barriers. In Proceedings of the 14th International Conference on Availability, Reliability and Security (ARES 2019), pages 1-9, Canterbury. ACM.

Cited by

See all 1

Metadata

Authors
Ruohonen, J.
Venue
arXiv
Publisher
arXiv
Published
2024
DOI
10.48550/arxiv.2412.08084
arXiv
2412.08084
References
0
Type
Preprint
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: A Systematic Literature Review on the NIS2 Directive. https://app.cochat.ai/papers/10.48550/arxiv.2412.08084
The paper
Ruohonen, J. (2024). A Systematic Literature Review on the NIS2 Directive. arXiv. https://doi.org/10.48550/arxiv.2412.08084