NIS2 replaced the original NIS Directive in October 2024 and widens its reach: more sectors, more organisations and more specific duties. It sets a common baseline for managing cyber risk, reporting serious incidents and making leadership accountable for both.
As a directive, it applies through national law, so exact obligations, authorities and registration steps depend on each Member State's transposing legislation. The core is shared across the EU, and demanding enough that starting early pays off. Done well, NIS2 becomes a clear map of where your defences need strengthening.
Who it applies to
Medium and large organisations in critical sectors
Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking and waste water, digital infrastructure, business-to-business ICT service management, public administration and space.
Other critical sectors
Annex II adds postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research organisations.
Some entities regardless of size
DNS providers, top-level domain registries, trust service providers and public electronic communications providers are in scope even when small.
Essential or important
Your category depends on sector criticality and size. It sets how you are supervised (proactively if essential, after the fact if important) and the level of potential fines.
Suppliers to in-scope organisations
Supply-chain security is a core requirement, so many companies outside the scope will be asked for evidence by their NIS2 clients.
Key obligations
Management accountability (Art. 20)
Management bodies must approve the risk-management measures, oversee their implementation and follow cybersecurity training. They can be held liable for infringements.
Risk-management measures (Art. 21)
An all-hazards approach with at least ten measures, including risk analysis, incident handling, business continuity and backups, supply-chain security, vulnerability handling, cryptography, access control and multi-factor authentication.
Incident reporting (Art. 23)
For significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after that notification.
Supply-chain security
You must consider the vulnerabilities and security practices of your direct suppliers and service providers, not just your own systems.
How we help
Diagnosis and gap analysis
We confirm whether and how NIS2 applies, your likely category, and measure your current controls against Article 21 and the reporting duties.
Prioritised plan
A risk-based roadmap with owners, effort and quick wins, written so your board can approve it with confidence.
Implementation
Policies, incident response and notification procedures, supplier assessment, MFA, access control and board training. Our 24/7 SOC and incident response team can cover detection and containment.
Maintenance and audit readiness
Periodic effectiveness reviews, internal audits, evidence kept up to date and clear reporting to management, ready for supervision.
Signs you need to act
- You operate in an Annex I or II sector and, as a general rule, have 50 or more employees or exceed €10 million in both annual turnover and balance sheet.
- A key customer has sent you a NIS2 security questionnaire or new contractual clauses.
- Your board has not formally approved a cybersecurity risk plan or received specific training.
- If a serious incident happened tonight, you could not confidently issue an early warning within 24 hours.
- You do not have a clear list of which suppliers are critical to your services.
Frequently asked questions
Does NIS2 apply to my company?
It depends on sector, size and role. As a rule, medium-sized and large organisations in Annex I and II sectors are in scope, plus some entities regardless of size. National law has the final word, so the first step is a scope analysis.
What are the NIS2 incident reporting deadlines?
Early warning within 24 hours, incident notification within 72 hours and a final report within one month of the notification; authorities may request intermediate reports. An incident is significant if it causes, or could cause, severe operational disruption, financial loss or considerable damage to others.
Can managers be held personally liable?
Yes. Under Article 20, management bodies can be held liable for infringements. For essential entities, authorities may, as a last resort, temporarily bar a top manager from exercising managerial functions.
What fines does NIS2 set?
Member States must provide for maximum fines of at least €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.
Is ISO 27001 enough for NIS2?
It is an excellent foundation, and NIS2 itself refers to the ISO/IEC 27000 series, but certification does not automatically cover duties such as reporting deadlines or management accountability. We map what you have and close the gap.