NIS2 Directive

NIS2 covers medium and large organizations operating in 18 sectors, split into essential entities such as energy, transport, banking, health, and digital infrastructure, and important entities such as postal services, waste management, manufacturing, and digital providers. Size thresholds generally bring in entities with at least 50 staff or €10 million turnover, though some are in scope regardless of size. Whether you are essential or important affects supervision and penalty levels.

Article 21 requires an all-hazards set of technical and organizational measures proportionate to risk. These include risk analysis and security policies, incident handling, business continuity and backup, supply-chain security, secure development and vulnerability handling, cryptography and encryption, access control, and cyber-hygiene and training. The goal is to manage risks to network and information systems across the whole organization and its suppliers.

Entities must submit an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident. A fuller incident notification with an initial assessment is due within 72 hours. A final report must follow no later than one month after the notification, describing root cause, mitigation, and impact.

NIS2 makes the management body directly responsible for approving and overseeing the cybersecurity risk-management measures. Members must follow training and are expected to ensure the organization meets its obligations. National transposition can attach personal liability to senior management for failures, making board-level engagement essential rather than optional.

NIS2 repeals and replaces NIS1, widening the sectors and entities in scope, strengthening the security and reporting requirements, and harmonizing supervision and penalties across the EU. DORA is a sector-specific regulation for financial entities and, as the more specific rule, generally takes precedence for those firms on matters it covers. Financial organizations should map where DORA applies and where NIS2 still governs.

Penalties are tiered by entity type. Essential entities can face fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities face up to €7 million or 1.4% of turnover. Authorities can also impose binding instructions, and in some cases restrict management responsibilities for essential entities.

ISO 27001 is not mandatory under NIS2, but its information-security management system maps closely to the Article 21 measures. An existing certification provides much of the risk assessment, access control, continuity, and supplier-security evidence NIS2 expects. Organizations often use ISO 27001 as a backbone and then add the NIS2-specific reporting and governance obligations on top.

The directive set a national transposition deadline of 17 October 2024, by which member states were to bring implementing laws into force. Because NIS2 is a directive, your concrete obligations come from national law, and timing and detail have varied between member states. Confirm the current status in each country where you operate to identify the exact rules that apply to you.