NIS2 Directive Explained: Who It Covers, What It Requires, and How to Comply

What is NIS2, in one paragraph

NIS2 is the European Union's cybersecurity directive, formally Directive (EU) 2022/2555. It replaces the first Network and Information Security directive from 2016 and widens the rules to many more organisations. It sets a baseline of security measures that covered organisations must put in place, requires them to report serious incidents on a tight clock, and makes senior management responsible for getting it right. Member states had until 17 October 2024 to turn NIS2 into national law, so your specific obligations come from the law in your country rather than from the directive alone.

Why NIS2 matters now

NIS2 raises the stakes for cybersecurity in three ways.

• It covers far more organisations. The old rules applied to a small set of operators. NIS2 reaches across many more sectors and brings most medium and large companies in those sectors into scope.
• It holds leadership accountable. Management bodies must approve the security measures and oversee them, and they can be held liable if the organisation fails to meet its duties.
• It carries real penalties. Fines run into millions of euros and a share of global turnover, which puts cybersecurity on the board agenda.

For anyone who builds, runs or audits security programmes, that means rising demand for people who understand NIS2 and can put a compliant programme in place.

Who must comply with NIS2?

NIS2 splits covered organisations into two groups, essential entities and important entities. Both must meet the same core security and reporting duties. The main difference is how strictly they are supervised and how large the maximum fines can be.

As a general rule, an organisation is in scope when both of these are true:

1. It operates in a sector that NIS2 covers.
2. It is medium sized or larger, meaning roughly 50 or more employees, or annual turnover or balance sheet of about 10 million euros or more.

Some organisations are in scope whatever their size, for example certain providers of critical digital infrastructure and public services, because of the role they play.

Essential sectors generally include energy, transport, banking and financial market infrastructure, health, drinking and waste water, digital infrastructure, information and communication technology service management, public administration and space.

Important sectors generally include postal and courier services, waste management, chemicals, food, manufacturing of key products, digital providers such as online marketplaces and search engines, and research.

Because NIS2 is written into national law country by country, the exact sector lists, size thresholds and exceptions can differ where you operate. Check your national transposition law to confirm whether you are an essential or an important entity.

What does NIS2 require? The Article 21 measures

Article 21 of NIS2 sets out at least ten risk management measures that covered organisations must apply. Taken together they describe a complete, risk based security programme. They are:

1. Policies on risk analysis and information system security.
2. Incident handling, so you can detect, manage and recover from incidents.
3. Business continuity, including backups, disaster recovery and crisis management.
4. Supply chain security, including the security of your direct suppliers and service providers.
5. Security in acquiring, developing and maintaining systems, including handling vulnerabilities.
6. Policies and procedures to measure whether your security measures actually work.
7. Basic cyber hygiene practices and security training for staff.
8. Policies on the use of cryptography and encryption.
9. Human resources security, access control and asset management.
10. Multi factor authentication, secured communications and secured emergency communication where appropriate.

These are outcomes, not a prescriptive checklist. You are expected to apply them in proportion to your size, your risk and the state of the art. That is where a structured management system helps, which is the link to ISO 27001 covered below.

NIS2 incident reporting: the 24, 72 and 30 day clock

NIS2 sets a strict timeline for reporting significant incidents to your national authority or CSIRT. An incident is significant when it causes, or could cause, serious operational disruption or financial loss, or affects other people through considerable damage.

The clock has three stages:

• Within 24 hours of becoming aware of a significant incident: send an early warning. The clock starts when you become aware, not when you finish investigating.
• Within 72 hours of becoming aware: send a fuller incident notification with an initial assessment, including severity, impact and any signs of compromise.
• Within one month of the notification: send a final report with a detailed description, the type of threat, the measures taken and any cross border impact.

Meeting these deadlines is hard without incident handling and detection already in place, which is why NIS2 ties reporting so closely to the Article 21 measures.

Management accountability and penalties

NIS2 makes cybersecurity a leadership duty, not just an IT task.

• Management must approve and oversee the organisation's cyber risk measures, and members of management bodies can be held liable for failures.
• Management must take training so they can understand and assess cyber risk.

The penalties are set at the national level, but NIS2 sets maximum levels that national law must allow:

• Essential entities: up to 10 million euros or 2 percent of total worldwide annual turnover, whichever is higher.
• Important entities: up to 7 million euros or 1.4 percent of total worldwide annual turnover, whichever is higher.

Authorities can also issue binding orders, require audits and, for essential entities, suspend certifications or management functions in serious cases. The exact enforcement powers depend on your national law.

NIS2 and ISO 27001: how the two fit together

If you already run an information security management system to ISO/IEC 27001, you have a strong head start on NIS2. Both are risk based, and both cover risk management, incident response, supplier security and governance. An ISO 27001 programme gives you the structure, the documentation and the controls that many NIS2 measures ask for.

An ISO 27001 certificate on its own does not equal NIS2 compliance. NIS2 adds duties that ISO 27001 does not spell out, in particular:

• The strict 24, 72 hour and one month incident reporting deadlines.
• Specific supplier and supply chain assessment duties.
• Named controls such as multi factor authentication.
• Direct management accountability and liability.

A practical path for most organisations is to build or extend an ISO 27001 management system as the base, then add the NIS2 specific items on top. That is why many teams pair ISO 27001 skills with dedicated NIS2 implementation training.

How to prepare for NIS2: a step by step checklist

Use these steps to move from "are we in scope" to "we can prove it".

1. Confirm your status. Check your national transposition law and decide whether you are an essential entity, an important entity, or out of scope.
2. Register with your national authority where your country requires it.
3. Run a gap analysis against the Article 21 measures. If you have ISO 27001, map your existing controls first and find the gaps.
4. Fix the gaps, focusing on the common weak points: incident detection and reporting, supplier security, multi factor authentication and business continuity.
5. Set up incident reporting so you can meet the 24 and 72 hour deadlines, with clear roles and a tested process.
6. Brief and train leadership, since management must approve the measures and can be held liable.
7. Train the people who will deliver it. Give your security and compliance leads formal NIS2 implementation skills so the programme holds up to supervision.
8. Review and improve on a schedule, and keep evidence that your measures work.

The Cybrainer NIS 2 Directive Lead Implementer course walks through this build in full, from scope and gap analysis to the Article 21 measures, incident reporting and ongoing supervision. If you also want the ISO 27001 foundation underneath it, see the ISO 27001 Lead Implementer course.

Frequently asked questions

What is the NIS2 Directive in simple terms?

NIS2 is an EU law that makes organisations in important sectors manage cyber risk to a set standard, report serious incidents quickly, and have senior management take responsibility for security. It covers far more organisations than the rules it replaced.

When did NIS2 take effect?

EU member states had until 17 October 2024 to write NIS2 into national law. The obligations that apply to you come from your country's own transposition law, and the timing of enforcement varies by country.

Who has to comply with NIS2?

Generally, medium and large organisations (about 50 or more employees, or 10 million euros or more in turnover) that operate in a covered essential or important sector. Some critical providers are in scope at any size. Check your national law to confirm.

What are the NIS2 reporting deadlines?

An early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month of the notification.

What are the penalties for NIS2 non compliance?

Up to 10 million euros or 2 percent of global annual turnover for essential entities, and up to 7 million euros or 1.4 percent for important entities, whichever is higher. National authorities set the exact fines and can also issue binding orders.

Does ISO 27001 make us NIS2 compliant?

No, but it gives you a strong foundation. ISO 27001 covers much of what NIS2 asks for, so you add the NIS2 specific items such as incident reporting deadlines, supplier assessment, multi factor authentication and management accountability on top.

How do we get ready for NIS2?

Confirm your scope, run a gap analysis against the Article 21 measures, fix the gaps, set up fast incident reporting, train leadership and train the people who will run the programme.

Next steps

NIS2 turns cybersecurity into a legal duty for thousands of organisations across the EU, with real deadlines, real penalties and personal responsibility for leadership. The organisations that cope best are the ones that treat it as a structured programme and train the people who run it.

• Build and run a NIS2 programme: start the NIS 2 Directive Lead Implementer course.
• Put the security foundation in place first: start the ISO 27001 Lead Implementer course, or train auditors with the ISO 27001 Lead Auditor course.
• Training a team: see team and enterprise training or contact us.

Browse every certification on the Cybrainer courses page.