NIS2 Hungary

Act LXIX of 2024 on the cybersecurity of Hungary, also known as the Cybersecurity Act, came into effect on January 1, 2025, repealing Act L of 2013 and Act XXIII of 2023. This law integrates the NIS2 Directive into Hungary's national legal system, expanding its scope beyond NIS2 entities to include organizations previously covered by the Information Security Act. The purpose of the law is to ensure a high level of cybersecurity, reduce threats to electronic information systems and ensure service continuity in key sectors. It applies to organizations in the administrative sector, majority state-owned economic organizations, and entities identified as essential or important by the national cybersecurity authority. The law covers risk governance mechanisms, threat assessments, risk classification of information systems and control measures. Act LXVIX covers the core NIS2 cybersecurity requirements, but references the 7/2024. (VI. 24.) MK Decree and 418/2024. (XII. 23.) Governmental Decree extensively. The decrees contain additional technical measures necessary to achieve full compliance with the law.