NIS2

at a glance

what it is

An EU directive. Your national law is what binds you.

who it covers

Medium and larger entities of listed types in 18 sectors. Some types at any size.

the size line

50 staff, or both turnover and balance sheet above €10 million.

fine ceilings

Essential entities: at least €10 million or 2% of turnover. Important entities: at least €7 million or 1.4%.

who answers

Management approves the measures, oversees them and can be held liable.

status

National laws arrive country by country. Check yours before you plan.

basis NIS2 Art. 2(1), 2(2), 20(1), 34(4), 34(5), 41(1); Recommendation 2003/361 Art. 2(2)

does it apply to you?

the whole job, in order

Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.

• know where you stand

  Find out whether NIS2 covers you, in which category, and who answers for it.

  3 steps
• set the rules of the house

  Agree who decides what, who is trained and how much risk the company accepts.

  3 steps
• see what you have

  List the systems, the data and the people who can reach them, then write down the risks.

  2 steps
• put the measures in place

  Make the choices real: sign-in, backups, patching, suppliers, encryption and everyday habits.

  6 steps
• be ready for the bad day

  Decide who handles an incident, how you tell the authority in time and how you practise.

  3 steps
• show it keeps working

  Check that the measures work, keep the proof together and report to management.

  3 steps

the dates

What applies when. The reference sits under each date.

1. 17 October 2024deadline for member states to write NIS2 into national lawNIS2 Art. 41(1)applies now
2. 17 April 2025member states due to have their first list of essential and important entitiesNIS2 Art. 3(3)applies now

the fine ceilings

The ceilings each text sets. The reference sits under each.

• essential entitya maximum of at least €10 million or 2% of worldwide annual turnover, whichever is higherNIS2 Art. 34(4)

  A floor for the ceiling: national law can set it higher.

• important entitya maximum of at least €7 million or 1.4% of worldwide annual turnover, whichever is higherNIS2 Art. 34(5)

  Same.

what it asks, and ways to meet it

The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.

1. NIS2 Art. 20(2)

   Members of management bodies must follow training. Similar training for employees is encouraged, on a regular basis.

   • awareness training
2. NIS2 Art. 21(1)

   Measures appropriate and proportionate to risk, exposure, size, likelihood and severity.

   • risk register
3. NIS2 Art. 21(2)(a)

   Policies on risk analysis and information system security.

   • risk register
4. NIS2 Art. 21(2)(b)

   Incident handling as one of the cybersecurity risk-management measures.

   • incident management
   • logging and monitoring
5. NIS2 Art. 21(2)(c)

   Business continuity, such as backup management and disaster recovery, and crisis management.

   • backup and recovery
   • single sign-on and directory
6. NIS2 Art. 21(2)(d)

   Supply chain security, including relationships with direct suppliers and service providers.

   • supplier management
   • software bill of materials and component checks
   • AI inventory
7. NIS2 Art. 21(2)(e)

   Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.

   • endpoint management
   • vulnerability management
   • secure development
   • vulnerability disclosure
   • software bill of materials and component checks
8. NIS2 Art. 21(2)(g)

   Basic cyber hygiene practices and cybersecurity training.

   • awareness training
9. NIS2 Art. 21(2)(h)

   Policies and procedures regarding the use of cryptography and, where appropriate, encryption.

   • encryption and key management
10. NIS2 Art. 21(2)(i)

    Human resources security, access control policies and asset management.

    • asset inventory
    • logging and monitoring
    • endpoint management
    • privileged access
    • access reviews
    • single sign-on and directory
11. NIS2 Art. 21(2)(j)

    Multi-factor or continuous authentication, where appropriate.

    • multi-factor authentication
    • single sign-on and directory
12. NIS2 Art. 21(3)

    Take into account each direct supplier's vulnerabilities and the quality of its products and practices.

    • supplier management
13. NIS2 Art. 23(4)

    Early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month of the notification.

    • incident management

how it fits with the others

• DORA

  Where DORA covers you, DORA takes the lead and NIS2 steps aside.

• Cyber Resilience Act

  The Cyber Resilience Act complements NIS2: NIS2 covers how you run your own security, the CRA covers the products you make or sell.

• ISO 27001

  ISO 27001 is voluntary and gives the laws a structure to hang on.

the work under this rule

• incident reportingFor the board and the owner of IT: one event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
• supplier riskYour suppliers' failures count as yours. NIS2, DORA and GDPR ask for the same three things: know who your suppliers are, check them in proportion, and put security in the contract.
• the board's partFor directors and the chair: security decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
• access controlFor the owner of IT: who can get in, who approved it and when someone last checked. NIS2, DORA and GDPR all ask for this, so one review done properly answers all three.
• risk assessmentEvery rule asks for measures that fit the risk. A short written assessment lets you show that yours do, and gives you an honest reason to do less where the risk is low.
• backups and recoveryFor the owner of IT and the chief executive: a backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that the control runs.
• trainingNIS2, DORA and GDPR ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
• patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.