NIS2 Directive

EU directive on cybersecurity requirements for essential and important entities.

Building on the original 2016 NIS Directive, the NIS2 Directive significantly expands the scope and depth of cybersecurity obligations across the European Union. Adopted in January 2023, Member States were required to transpose it into national law by 17 October 2024. NIS2 addresses the rapidly evolving cyber threat landscape by broadening the range of sectors and entities covered, strengthening security requirements, and tightening incident reporting rules.

NIS2 replaces the original distinction between operators of essential services and digital service providers with two new categories: essential entities and important entities. Essential entities include organisations in sectors such as energy, transport, banking, health, water supply, digital infrastructure, and public administration. Important entities cover sectors like postal services, waste management, food production, manufacturing, and digital providers. The directive applies to medium and large enterprises in these sectors, though Member States may extend coverage to smaller entities in critical areas.

Core obligations require covered entities to implement appropriate and proportionate technical, operational, and organisational cybersecurity measures. These include risk analysis policies, incident handling procedures, business continuity planning, supply chain security measures, and vulnerability management. Entities must report significant cybersecurity incidents to their national Computer Security Incident Response Team within 24 hours for an early warning, followed by a detailed notification within 72 hours. Management bodies must approve cybersecurity risk measures and undergo training, creating personal accountability at the leadership level.

Enforcement under NIS2 is considerably strengthened compared to its predecessor. Essential entities face fines of up to 10 million euros or 2% of global annual turnover, while important entities face up to 7 million euros or 1.4% of turnover. National authorities have broad supervisory powers, including on-site inspections, security audits, and the ability to issue binding instructions.

NIS2 operates alongside the Digital Operational Resilience Act (DORA), which applies specific cybersecurity rules to the financial sector, and the Cyber Resilience Act (CRA), which targets product-level cybersecurity for hardware and software. Together, these instruments form a layered EU cybersecurity framework. For businesses, NIS2 compliance requires not only technical investment but also governance reforms, supply chain assessments, and incident response capabilities that demonstrate organisational readiness against cyber threats.

Select your company type for tailored compliance guidance.