Domain name portfolio management more important than ever

New cybersecurity directive means stricter rules on registration data from 2024

Technology background with flag of the European Union

At the end of 2022, the EU passed the second Network Information Security Directive, or NIS2. Member states have until the middle of October 2024 to translate the directive into national legislation. Crucially, a wide variety of organisations are designated 'important' or 'essential' under NIS2, meaning that they'll have to meet stricter network security requirements. Where domain name registrations are concerned, NIS2 goes even further. All organisations involved in the provision of registration services will be covered by the directive, which requires the validation of European registrants' registration data. Although only a small element of the directive, the registration data requirements have significant implications for organisations with large domain name portfolios. Having incorrect or outdated information linked to domain names could have adverse consequences.

NIS2: critical infrastructure security

The main feature of NIS2 is that member states must legislate by 2024, so that companies and bodies in critical sectors such as energy, logistics and financial services have to meet certain cybersecurity requirements. NIS2 defines a critical sector much more broadly than the old NIS Directive – a change generally welcomed by security experts. NIS2 refers to 'important' and 'essential' entities. The following table lists the sectors set to come within the directive's scope later this year. Within the relevant sectors, an entity's size also matters: in most cases, small entities will be exempt.

NIS2 - Added sectors

Food industry

Postal and courier services

Telecoms and energy network services

Manufacturing of certain critical products

Rail infrastructure operation

Government services

Space industry

Digital social networking services etc

Waste and water management

Financial services

Domain name registrations

NIS2 includes requirements regarding domain name registrations, particularly registration data. Article 28 reads:

" [..] Member States shall require TLD name registries and entities providing domain name registration services to collect and maintain accurate and complete domain name registration data [..]"

The data to be collected and accurately maintained includes at least the registrant's name, e-mail address and phone number. The required information will have to be validated by a procedure very similar to that already followed by gTLDs. The procedure will include the registrant confirming their details by responding to an e-mail from the registrar. All domain name providers in the EU will additionally have to publish their data verification procedures on their websites.

Impact on organisations

So, what do the new rules mean for companies and other organisations? If an organisation manages thousands of domain names, the organisation will need to see that the registration data is correct. Procedures for amending registration data will also have to be in place. Incorrect registration data could lead to a domain name being disabled, and any associated applications and websites with it. For a large organisation with a constant turnover of personnel, where internal structures and legal entities are liable to change, that represents a significant risk. Effective, centralised management of domain name portfolios will therefore be more important than ever.

Domain name monitoring

Against that backdrop, a good domain name monitoring tool can be very useful. It enables you to maintain an overview, avoid losing track of domain names when reorganisations take place, and readily distinguish your own domain names from others. SIDN BrandGuard has been doing that for 300-plus large Dutch organisations since 2012.

Want to know more?

The full text of the NIS2 directive is available on the website of the European Union.

SIDN BranGuard

If you're interested in domain name monitoring, why not get an online demo to check out SIDN BrandGuard? Our account manager will be pleased to give you a call to make the arrangements.