NIS 2 Information for .FI Registrars

Presentations and general issues

The aim of the NIS 2 Directive is to ensure a common high level of cybersecurity throughout the Union. The Directive contains obligations to verify the correctness of the information in the domain name registration service that apply to entities providing domain name registration services, i.e. domain name registrars and agents acting on behalf of domain name registrars, such as privacy or proxy registration service providers or resellers.

New obligations

All fi domain name registrars and their resellers have the following obligations related to the fi domain name registration service (WHOIS data) in accordance with Article 28 of the NIS 2 Directive:

*    to collect and maintain accurate and complete domain name registration data with due diligence in accordance with Union data protection law
*    have policies and procedures, including verification procedures, in place to ensure that the domain name registry includes accurate and complete information 
*    to make publicly available, without undue delay after the registration of a domain name, the domain name registration data which are not personal data
*    to provide access to specific domain name registration data upon lawful and duly substantiated requests by legitimate access seekers, in accordance with Union data protection law, and the entities providing domain name registration services to reply without undue delay and in any event within 72 hours
*    to ensure such policies and procedures are to be made publicly available regarding accurate and complete information and the disclosure of information, and
*    to cooperate with the fi register, so that the collection of registration data shall not result in a duplication of collecting domain name registration data.

In addition, DNS service providers are also subject to the information security obligations of the NIS 2 Directive, such as the obligation to implement cybersecurity risk-management measures and reporting obligations of significant incidents. A DNS service provider means an entity that provides that provides publicly available recursive domain name resolution services for internet end-users or authoritative domain name resolution services for third-party use, with the exception of root name servers.

Powerpoint-esitys NIS 2 -muutoksista välittäjille - In Finnish only (16.10.2023)

Cyber Security Center (NCSC-FI) provides public tools for maintaining and updating the level of cybersecurity. Ecpecially the Cybermeter helps organizations to self evaluate their NIS 2 preparedness. 

Services provided by NCSC-FI can be found here (External link). (16.10.2023)

Generic NIS 2-related information provided by NCSC-FI can be found here (External link) - In Finnish only (4.4.2024)

Q/A 

(16.10.2023)

Question: I am a sole entrepreneur. Do the obligations in NIS 2 Directive apply to me?

Answer: The obligations stemming from article 28 in the NIS 2 directive apply to all registrars, both large and small. The obligations also apply to registrars who are private persons. In addition, DNS service providers are subject to the information security obligations of the NIS 2 Directive.

Question: The registrar will be required to provide access free of charge to specific domain name registration data in accordance with data protection law. Does this mean that if someone asks, I have to give access to my registrar account?

Answer: For now, it remains unclear what "providing access" means in practice for registrars. However, it does not mean that a customer or any other person should be given access to your registrar account.

Cybersecurity of Registrar operations

Subtitle created (16.10.)