NIS2 makes security something you have to prove.

NIS2 is the second Network and Information Security Directive, Directive (EU) 2022/2555. It sets a common cybersecurity baseline across the European Union and replaces the original 2016 NIS Directive with wider scope, stricter requirements, and real accountability for senior management.

The intent is straightforward: raise the level of cyber resilience for the organisations that society depends on. Where the old rules covered a narrow set of operators, NIS2 pulls in whole sectors and holds each organisation to a documented standard of risk management, incident reporting, and supply chain security.

NIS2 generally covers medium and large organisations in designated sectors, with exceptions for some smaller critical providers. A supplier may also face requirements from an in-scope customer. Exact duties depend on the national law that applies to the organisation.

The directive sorts organisations into essential entities (sectors such as energy, transport, banking, health, water, digital infrastructure, and public administration) and important entities (including postal services, waste management, chemicals, food, manufacturing, and digital providers). Both must meet the same security duties; the difference is mainly in how strictly they are supervised.

NIS2 is built around the risk management measures in Article 21, strict incident reporting duties, and the management accountability set out in Article 20. In practice it comes down to five things you have to do and be able to prove.

• Risk management measuresAdopt technical and organisational measures across your networks and information systems: access control, MFA, encryption, patching, backups, and business continuity.
• Incident reportingReport significant incidents on a strict clock: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within one month.
• Supply chain securityAssess and manage the cyber risk your suppliers and service providers carry, because an attacker who arrives through a vendor is still your incident to report.
• Management accountabilitySenior management must approve and oversee the risk measures and can be held personally liable. Cybersecurity becomes a board responsibility, not just an IT task.
• Continuous complianceKeep evidence current. Supervisors can ask at any time, so posture, policies, and incident records have to be ready on demand, not assembled after the request.

NIS2 entered into force in January 2023. Member states were required to transpose it into national law by 17 October 2024. National implementation and enforcement status vary, so check the law and authority for your country.

The penalties are meaningful. Essential entities can face fines up to €10 million or 2% of global annual turnover, whichever is higher; important entities up to €7 million or 1.4%. Beyond fines, supervisors can hold management personally accountable, which is why NIS2 has moved from an IT topic to a board one. For organisations in the financial sector, NIS2 sits alongside DORA and its own operational resilience requirements.