New NIS2 Directive to regulate domain name registrations in the EU

Will the directive improve abuse prevention?

EU flags in front of the European Commission building

A few weeks ago, the European Parliament approved the new Network and Information Security Directive (NIS2). As well as making waves in the cybersecurity sector, the directive has implications for domain name registrations in the European Union. So it's worth considering what the new rules will mean for registrants and brand owners looking to combat abuse.

Improved critical infrastructure security

The main thrust of NIS2 is that, by 2024, member states must legislate to improve the cybersecurity of companies and bodies that provide essential services in critical sectors, such as energy supply, logistics and financial services. NIS2 defines a critical sector much more broadly than the old NIS Directive – a change generally welcomed by security experts.

Domain names also covered

As the registry for .nl, SIDN is also covered by the new directive. NIS2 includes requirements regarding domain name registrations, particularly registration data. Article 28 reads: [..] Member States shall require TLD name registries and entities providing domain name registration services to collect and maintain accurate and complete domain name registration data [..]

The data to be collected and accurately maintained includes at least the registrant's name, e-mail address and phone number. After registration, the required information will have to be validated by a procedure very similar to that already followed by gTLDs. The procedure will include the registrant confirming their details by responding to an e-mail from the registrar. All registries for domains in the EU will additionally have to publish their data verification procedures on their websites.

Better abuse prevention?

Will stricter control of registrant data lead to improved abuse prevention? It's too soon to say. However, experience at the gTLD level suggests that the verification procedures are relatively easy to circumvent. And, even if the procedures prove effective, cybercriminals will still be able to get around the restrictions by making malicious registrations outside the EU.

Want to know more?

The full text of the directive is available on the website of the European Commission.