NIS2
NIS2 — Directive (EU) 2022/2555
What NIS2 actually obliges an essential or important entity to do: management body approval, ten minimum risk-management measures, and a reporting clock of 24 hours, 72 hours and one month.
- Who it applies to
- Entities in the sectors listed in Annexes I and II that exceed the medium-sized enterprise ceilings (50 or more staff, or more than EUR 10 million in annual turnover or balance sheet total). Regardless of size, qualified trust service providers, top-level domain name registries and DNS service providers are in scope. Member States may additionally designate specific entities on criticality grounds.
- Deadline
- Member States had to adopt and publish transposing measures by 17 October 2024 and apply them from 18 October 2024. National lists of essential and important entities were due by 17 April 2025. What binds you is the national transposition law, not the directive itself.
- Official reference
- Directive (EU) 2022/2555 of 14 December 2022
What actually changed with NIS2
Directive (EU) 2022/2555 replaced the 2016 NIS Directive with effect from 18 October 2024. The two changes you feel day to day are not about sectoral scope, although scope did widen, but about mechanics.
The first is that entities no longer wait to be designated. The size-cap rule in Article 2 and the classification in Article 3 mean an organisation identifies itself as essential or important by sector and size, and registers. The second is that Article 20 puts approval of the measures with the management body and expressly allows liability to be attached to it. The practical consequence is that a good share of the evidence that used to be technical becomes documentary and governance-shaped: minutes, appointments, training records.
Essential or important: the difference is supervision
Both categories carry the same substantive obligations. What changes is how compliance is checked and what failure costs. Essential entities face ex-ante supervision — inspections, security audits, information requests with nothing having gone wrong — and fines of at least EUR 10 million or 2 % of total worldwide annual turnover, whichever is higher (Article 34(4)). Important entities are supervised ex-post, once there are indications of non-compliance, and the ceiling is at least EUR 7 million or 1.4 % (Article 34(5)).
That asymmetry should change your priorities. If you are an essential entity, the evidence has to exist before anyone asks. If you are important, the real exposure surfaces after an incident, which is precisely the worst moment to reconstruct a file.
The reporting clock is the weakest joint
Of all the obligations, reporting is the one organisations breach without noticing, and almost never by failing to report: by reporting late relative to when they became aware. Article 23(4) does not count from the moment a crisis is formally declared or the committee convenes, but from the moment the entity becomes aware of the significant incident. An incident is significant if it has caused or is capable of causing severe operational disruption of services or financial loss, or if it has affected or is capable of affecting others by causing considerable material or non-material damage (Article 23(3)).
Write down in advance which event and which role start the clock, and leave an automatic trace of that instant. In practice, the difference between complying and not complying tends to be a ticket with a timestamp versus an email someone remembers sending.
Where to find the text that actually binds you
The directive does not apply directly: it binds through each Member State’s transposition law, which may tighten thresholds, add sectors and set its own registration and reporting procedures. Several Member States missed the 17 October 2024 deadline, so the real timetable is country-specific. Before committing to a remediation plan, check the national law applicable to your main establishment in the Union and the reporting channel it designates.
Obligations
-
The management body approves the measures and oversees their implementation
Article 20(1) requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures taken to comply with Article 21, oversee their implementation, and be capable of being held liable for infringements. A policy existing is not enough: it must be on record that the people in charge approved it and that they review how it is going.
Evidence required
Minutes of the management body meeting, dated and with an attendance list, recording the agenda item, the document submitted for approval (with its version) and the decision taken. Add the follow-up report tabled at the next session: oversight is demonstrated by a cadence, not by a single set of minutes.
-
Members of the management body must undergo training
Article 20(2) requires members of the management body to follow training that enables them to identify risks and assess cybersecurity risk-management practices. Training for the wider workforce is encouraged; training for the board is mandatory.
Evidence required
A named attendance record with date, duration and syllabus, signed or traced in the learning platform, plus a copy of the material delivered. A generic certificate with no names and no dates will not hold.
-
Implement the ten minimum measures in Article 21(2)
Article 21(2) sets a floor of ten families of measures: risk analysis and information system security policies; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling and disclosure; policies to assess the effectiveness of the measures themselves; basic cyber hygiene and training; cryptography and encryption policies; human resources security, access control and asset management; and multi-factor or continuous authentication together with secured voice, video and text communications.
Evidence required
A mapping table setting each point, (a) through (j), against the specific document and technical control that implements it, the named owner and the date of last review. Auditors enter through this table: if an entry points at a document that does not exist or has not been reviewed in years, the finding writes itself.
-
Early warning within 24 hours, notification within 72 hours, final report within one month
For a significant incident, Article 23(4) imposes three milestones with the CSIRT or competent authority: an early warning without undue delay and in any event within 24 hours of becoming aware, flagging whether unlawful acts or cross-border impact are suspected; an incident notification within 72 hours with an initial assessment of severity, impact and any indicators of compromise; and a final report no later than one month after the notification. If the incident is still ongoing at that point, a progress report is filed instead and the final report follows within one month of the handling being concluded. Trust service providers notify within 24 hours rather than 72.
Evidence required
A time-stamped acknowledgement from the CSIRT for each of the three milestones, plus the internal record fixing the exact hour of "becoming aware" and the written criterion used to set it. Without that documented starting point, the 24-hour count cannot be defended.
-
Assess each direct supplier, not the sector
Article 21(2)(d) requires supply chain security and Article 21(3) spells out what to look at: the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, and their secure development procedures. It also requires the results of the coordinated security risk assessments of critical supply chains under Article 22 to be taken into account.
Evidence required
A register of direct suppliers recording, for each one, the assessment date, who performed it, what was reviewed and the decision reached. Attach the independent check that substantiates whatever the supplier claimed in the questionnaire.
-
Measure whether the controls work, not just that they exist
Article 21(2)(f) requires policies and procedures to assess the effectiveness of the risk-management measures. It is the most commonly missed obligation because it cannot be closed with another document: it needs metrics and a periodic review comparing what was expected with what happened.
Evidence required
An effectiveness report with defined indicators, a time series and conclusions — not an inventory of implemented controls. For example: actual detection and containment times for the period's incidents against the target, and the percentage of backup restoration tests passed.
-
Register with the competent authority and report changes
Article 3(4) requires entities to give the competent authority their name, address, up-to-date contact details including email addresses, IP ranges and telephone numbers, their sector and subsector, and the list of Member States where they provide in-scope services. Any change must be notified within two weeks. DNS providers, TLD registries, cloud computing and data centre services, CDNs, managed service and managed security service providers, online marketplaces, search engines and social networking platforms also had to submit that information by 17 January 2025 under Article 27(2).
Evidence required
The registration confirmation with reference number and date, and a change log showing both the date of the change and the date it was notified, so the two-week window can be evidenced.
-
Take corrective measures without undue delay once a gap is found
Article 21(4) requires an entity that finds it does not comply with the measures in paragraph 2 to take, without undue delay, all necessary, appropriate and proportionate corrective measures. Self-detection is not by itself mitigating: what counts is the reaction.
Evidence required
An action plan showing the detection date, the approval date, the named owner, the committed milestone and closure evidence for each action. The gap between detection and approval is the number that gets scrutinised.