The European Union (EU) is doubling down in its fight against cyber crime. On Friday (May 13), EU countries and lawmakers agreed to impose tougher cyber-security rules for large energy, transport and financial firms, as well as digital providers and medical device makers, amid concerns about cyber attacks by state actors and other malicious players.

The decision was taken as a response to the rise in online threats brought about by the Russian invasion of Ukraine.

The new policy builds on existing rules proposed by the European Commission in 2020, known as the NIS 2 Directive, which, in turn, expands on the scope of the current NIS Directive.

The new rules cover all medium and large companies in essential sectors: energy; transport; banking; financial market infrastructure; health; vaccines and medical devices; drinking water; digital infrastructure; public administration, and space.

All medium and large firms in postal and courier services; waste management;...