# Synergies and Potential of Industry 4.0 and Automated Vehicles in Smart City Infrastructure
## 3 Results
### Cybersecurity Legislation for Automated Vehicles--Directive NIS 2  
The official title of Network and Information System Directive 2 (NIS Directive 2, the number after the name indicates the serial number of the Directive) is given in the references. In the context of interpretation, this title may be interpreted as the Directive on the protection of network and information systems; it is intended to be a response to the application practice and conclusions of the European Commission, which points out that the objective of the NIS Directive has not been met. The NIS Directive was insufficiently linked to the sectoral requirements. With the NIS 2 Directive comes a fundamental change in the regulation of automated vehicles, in particular, because NIS 2 will now also apply to the manufacture of motor vehicles and vehicle manufacturers themselves, compared to the NIS Directive. The entities subject to the NIS 2 Directive can be divided into two categories: key actors and important actors. As far as vehicles are concerned, the NIS 2 Directive will apply not only to manufacturers of motor vehicles themselves but also to manufacturers of electrical and electronic equipment for motor vehicles [34]. Under Chapter 4, which addresses cyber risk management measures and reporting obligations, the NIS 2 Directive obliges Member States to ensure that \"the governing bodies of key and significant entities shall approve the cyber risk management measures taken by those entities to comply with Article 21, oversee its implementation and may be held liable if entities breach that Article\". Those measures are based on an all-risk approach designed to protect networks and information systems and the physical environment of those systems from incidents and include at least:  
1. Principles of risk analysis and information system security;
2. Incident handling;
3. Business continuity, such as backup and disaster recovery management and crisis management;
4. Supply chain security, including security aspects relating to the relationship between the entities and their direct suppliers or service providers;
5. Security in the acquisition, development, and maintenance of network and information systems, including vulnerability management and vulnerability disclosure;
6. Policies and procedures for assessing the effectiveness of cyber risk management measures [35]. Compared to the previous NIS Directive, the definition of 'incident' has been changed to mean \"an event threatening the availability, authenticity, integrity or confidentiality of data stored, transmitted or processed or of services provided or accessed through networks and information systems\". In addition to the definition of an incident, the Regulation also recognizes the so-called Significant Incident. In order to determine which incident is considered significant, it must be fulfilled that: \"(a) it has caused or has the capacity to cause a significant operational disruption of services or financial loss to the affected entity, (b) it has affected or has the capacity to affect other natural or legal persons by causing them significant pecuniary or non-pecuniary damage, (c) it has caused or has the capacity to cause significant pecuniary or non-pecuniary damage, (d) it has caused or has the capacity to cause significant pecuniary damage to other natural or legal persons\" [36]. Manufacturers of automated vehicles and fully automated vehicles will also have an obligation to report incidents under NIS Directive 2. Manufacturers of automated vehicles will be considered as relevant entities in that they can be classified as a type of entity in the manufacturing sector and the sub-sector manufacturing of motor vehicles, semi-trailers, and trailers within the meaning of Annex II of the NIS 2 Directive, while they can also be classified as medium-sized and large enterprises, which implies that manufacturers of automated vehicles will have to implement security measures.