The Finnish Transport and Communications Agency Traficom, which manages the country’s top-level domain .Fi, has announced the implementation of a national cybersecurity law in line with the EU’s NIS-2 Directive. The Finnish Parliament has approved the government’s legislative proposal, setting the framework for stricter cybersecurity obligations across various sectors.
The new NIS-2 obligations will take effect in stages. Affected companies must first determine whether they fall within the scope of the law. If so, they are required to register with the relevant supervisory authorities. A key deadline is July 8, 2025, by which time companies must have a risk management process in place. Notably, as of April 8, 2025, companies are already required to report “significant incidents.” To facilitate this, Traficom has launched a dedicated NIS-2 reporting form.
Traficom’s responsibilities have expanded significantly. It is now the designated authority for overseeing cybersecurity in several critical sectors, including postal and courier services, space, public administration, managed service providers, managed security service providers, research, and the manufacturing of vehicles and other transport equipment. The scope of oversight has also broadened to include new business types within sectors already covered under the original NIS directive.
In support of these efforts, Traficom is backed by a Computer Security Incident Response Team (CSIRT), which is tasked with responding to reported incidents and, when necessary, assisting organizations in managing and resolving those incidents.
With this new legislation and reporting infrastructure, Finland positions itself as a proactive EU member in strengthening digital resilience and cybersecurity governance under the NIS-2 framework.
News Source:domain-recht，This article does not represent our position.
