NIS2, CER, and background checks: what the EU legislation actually require

The NIS2 Directive requires organisations in scope to implement security procedures for employees who handle sensitive or important data, including data access policies. This covers both essential and important entities across sectors such as transport, health, digital infrastructure, water, food, and public administration. Among the specific requirements are background checks, access rights management, and training. Importantly, if your organisation is designated as a critical entity under CER, it is automatically subject to NIS2 requirements as well.

The CER Directive goes further on personnel security, requiring organisations to identify categories of staff who perform critical functions, determine access rights to premises and sensitive information, and establish formal procedures for background checks — including designating which categories of personnel must undergo them. Authorities are also empowered to request assistance in conducting checks on staff in certain roles. The directive applies to critical infrastructure operators and their suppliers across a broad range of sectors.

Both directives take a risk-based approach: the scope and depth of background checks depends on the individual's role and their level of access to critical systems or information.