NIS2 Directive

Cyberattacks on hospitals, energy companies, transport operators and digital service providers can disrupt daily life far beyond the organization that is attacked. The European Union first addressed this with the Network and Information Security Directive of 2016, known as NIS. That law covered a limited set of operators and was applied very differently across member states. NIS2 replaces it with a broader and stricter set of rules. It brings many more sectors and organizations into scope, sets minimum security measures, introduces tight deadlines for reporting significant incidents and makes senior management accountable for cybersecurity. It also aims to make rules more consistent across member states than the original directive.

NIS2 was adopted as Directive (EU) 2022/2555 and entered into force in January 2023. As a directive, it must be written into each member state's national law, and the deadline for doing so was October 2024. Many countries missed that deadline, so requirements and enforcement dates vary by country. For risk, security, legal and compliance teams in organizations operating in the EU, NIS2 is one of the most significant cybersecurity laws to plan for, including for companies headquartered elsewhere that provide covered services in Europe.

Definition of NIS2 Directive

The NIS2 Directive is EU legislation establishing measures for a high common level of cybersecurity across the Union. It requires essential and important entities in covered sectors to take appropriate risk management measures, report significant incidents and be subject to national supervision and penalties.

It overlaps with the Digital Operational Resilience Act, which takes precedence for financial entities, and many organizations meet its requirements using frameworks such as ISO 27001.

Who NIS2 Applies To

NIS2 covers 18 sectors. Sectors of high criticality include energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space.

Other critical sectors include postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers such as online marketplaces and search engines, and research.

In general, medium and large organizations in these sectors are in scope, meaning those with at least 50 employees or annual turnover above 10 million euros, although some entities are covered regardless of size. Examples include certain providers of public electronic communications networks, trust services and domain name registration services.

Entities are classed as essential or important, which affects how they are supervised and the maximum fines that apply. Essential entities face proactive supervision, while important entities are mainly supervised after evidence of a problem.

Key Requirements

Risk management measures must cover areas such as risk analysis, incident handling, business continuity, supply chain security, secure development, vulnerability handling, cryptography, access control and the use of multi-factor authentication.

Significant incidents must be reported to the national authority or response team with an early warning within 24 hours, a notification within 72 hours and a final report within one month.

Management bodies must approve cybersecurity measures, oversee their implementation and undergo training, and can be held liable for failures. This requirement makes cybersecurity a regular board topic in many organizations for the first time.

Supervisory authorities can carry out inspections and audits and impose fines of up to 10 million euros or 2% of worldwide annual turnover for essential entities, and up to 7 million euros or 1.4% for important entities.

Importance of NIS2 in Risk and Compliance

NIS2 raises the baseline. It sets minimum cybersecurity expectations for thousands of organizations that were previously unregulated. Many mid-sized companies are subject to formal cybersecurity rules for the first time.

It makes cybersecurity a leadership responsibility. Management accountability means boards and executives must engage directly with security risk.

It also extends into supply chains. Covered organizations must manage risks from their suppliers, so many companies outside the law's direct scope will face NIS2-driven requirements from their customers. Suppliers can expect more security questionnaires and contract clauses from customers in scope.

NIS2 and Financial Management

Organizations newly in scope may need to invest in security tools, staff, incident response and third-party risk management to meet the minimum measures.

Potential fines tied to worldwide turnover make non-compliance a material financial risk for larger groups.

Mapping NIS2 requirements to existing controls avoids duplicate investment for organizations already following ISO 27001 or similar frameworks.

Budget plans should account for differences between national laws in each country where the organization operates.

Common Challenges

Determining whether an organization is in scope, and whether it is essential or important, can be complex for groups operating in several sectors and countries. Each legal entity may need to be assessed separately.

National laws differ in detail and timing, which complicates compliance for multinational organizations.

The 24-hour early warning deadline requires mature incident detection and decision-making processes. Organizations need clear criteria for what makes an incident significant.