NIS2 is Directive (EU) 2022/2555, the European Union law on measures for a high common level of cybersecurity across the Union. In cybersecurity law it is the central horizontal instrument for organizations that keep society and the economy running: it obliges essential and important entities in eighteen sectors to manage cyber risk, report significant incidents and accept supervision by national authorities.
NIS2 replaced the first NIS Directive of 2016, which had left too much room for national differences and covered too few sectors. It entered into force on 16 January 2023, member states had to transpose it by 17 October 2024, and the national rules apply from 18 October 2024. Because it is a directive, the precise duties come from national implementing laws, so details vary by country. This description is for orientation and is not legal advice.
Who falls under NIS2
NIS2 applies through a size-cap rule combined with a sector list. As a default, an organization is in scope when it operates in a listed sector and is at least medium-sized, meaning 50 or more employees or annual turnover and balance sheet above EUR 10 million. Certain providers are covered regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and providers of public electronic communications.
The directive sorts covered organizations into two classes. The class does not change the security measures required; it changes the intensity of supervision and the level of fines.
| Feature | Essential entities | Important entities |
|---|---|---|
| Typical profile | Large entities in Annex I sectors, plus some designated entities | Medium entities in Annex I and entities in Annex II |
| Supervision model | Proactive, ex ante and ex post | Reactive, ex post after evidence or an incident |
| Maximum fine | EUR 10 million or 2 percent of worldwide turnover | EUR 7 million or 1.4 percent of worldwide turnover |
| Extra sanctions | Possible temporary ban for managers | No temporary management ban |
| Annex | Sectors | Criticality level |
|---|---|---|
| Annex I | Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space | High criticality |
| Annex II | Postal and courier, waste management, chemicals, food, manufacturing, digital providers, research | Other critical sectors |
Minimum risk management measures
Article 21 requires appropriate and proportionate technical, operational and organizational measures based on an all-hazards approach. Proportionality depends on the entity’s exposure, size, the likelihood of incidents and their societal and economic impact. The directive names a minimum list of ten areas.
- Risk analysis and information system security policies.
- Incident handling procedures.
- Business continuity, backup management, disaster recovery and crisis management.
- Supply chain security, including relations with direct suppliers.
- Security in acquisition, development and maintenance, including vulnerability handling and disclosure.
- Policies to assess the effectiveness of the measures.
- Basic cyber hygiene and cybersecurity training.
- Policies on cryptography and encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication and secured communications where appropriate.
For digital infrastructure and ICT service providers, such as cloud providers, data centers and managed security service providers, Implementing Regulation (EU) 2024/2690 sets more detailed technical requirements. Management bodies must approve the measures, oversee implementation and undergo training, and they can be held personally accountable for infringements under national law.
Incident reporting deadlines
NIS2 requires entities to report any significant incident, meaning one that has caused or can cause severe operational disruption, financial loss or considerable damage to others. Reports go to the national CSIRT or competent authority in a multi-stage sequence.
| Stage | Deadline | Expected content |
|---|---|---|
| Early warning | Within 24 hours of awareness | Whether malicious action is suspected and whether cross-border impact is possible |
| Incident notification | Within 72 hours of awareness | Initial assessment of severity, impact and indicators of compromise |
| Intermediate report | On request of the authority | Relevant status updates |
| Final report | Within one month after the notification | Root cause, mitigation applied, cross-border impact |
Where appropriate, entities must also inform recipients of their services about significant cyber threats and possible remedies. The 24-hour clock runs from becoming aware, not from the end of the investigation, which is why a prepared reporting procedure matters more than a perfect first report.
How NIS2 relates to neighboring laws
NIS2 is a baseline for organizations, while other EU acts target products, specific sectors or physical resilience. Where a sector-specific law imposes at least equivalent requirements, that law takes precedence as lex specialis.
| Instrument | What it regulates | Relationship to NIS2 |
|---|---|---|
| DORA | Digital operational resilience of financial entities | Prevails for the financial sector |
| CRA | Cybersecurity of products with digital elements | Product rules complement entity rules |
| CER Directive | Physical resilience of critical entities | Parallel regime, coordinated authorities |
| EU Cybersecurity Act | ENISA mandate and certification schemes | Certification can show compliance |
At EU level, ENISA, the NIS Cooperation Group, the CSIRTs network and the EU-CyCLONe network for large-scale crises support coordination between member states.
Implementation status and common mistakes
Many member states missed the October 2024 transposition deadline, and the Commission opened infringement procedures against a large majority of them. National laws are therefore arriving at different times and with different details, such as registration portals, audit cycles and sector additions. The Commission has also proposed simplifications to incident reporting, so organizations should monitor their national law rather than rely only on the directive text.
- Assuming the directive applies directly. Obligations arise from national transposition acts.
- Ignoring group structure. Size is usually assessed with partner and linked enterprises included.
- Treating it as an IT project. NIS2 places responsibility on the management body.
- Overlooking suppliers. Supply chain risk is a named minimum measure.
The short version
NIS2 is an EU law for organizations that provide important services. Think of hospitals, energy companies, water utilities and cloud providers. They must protect their computer systems properly. They must also report serious attacks quickly.
It works a little like fire safety rules for a building. There must be plans, regular checks and a clear way to raise the alarm. Leaders are responsible, not only the IT team, and authorities can inspect and fine those who ignore the rules.
Where it makes a difference
A regional water utility with about 400 employees falls under Annex I as an essential entity. Its board approves a cybersecurity program covering backups, access control, supplier assessments and staff training, and the managers complete the required management training.
On a Friday evening, ransomware encrypts the billing servers. The security team sends an early warning within 24 hours, a fuller notification within 72 hours and a final report three weeks later naming a compromised supplier account as the root cause. Water treatment controls stayed isolated and unaffected. The prepared procedure turned a crisis into a contained incident, and the authority’s follow-up audit focused on improving supplier access rather than on penalties.