NIS2 — The EU Cybersecurity Directive

#Why It Matters

#Timeline and Current Status

Because NIS2 is a directive, it applies through each member state's national law, which can add requirements and sets its own authority, registration process and details. Always check the national transposition (for example Belgium's NIS2 law, Germany's NIS2 implementation act, Italy's Legislative Decree 138/2024).

The January 2026 proposal (not yet law as of this writing) would, among other things: let a Commission implementing act harmonise the Article 21 technical requirements so member states can't add their own; allow compliance to be shown through an EU cybersecurity certification scheme; add structured ransomware reporting (including whether a ransom was demanded and paid); require national post-quantum migration plans (critical uses by 2030); add a "small mid-cap" category; and adjust scope (adding EU digital identity and business wallet providers and submarine cable operators, removing micro and small DNS providers).

#Who Is in Scope

#The size-cap rule

By default NIS2 applies to medium and large organisations (roughly 50+ employees, or more than €10 million annual turnover and balance sheet) that operate in a listed sector and provide services in the EU. Some entities are in scope regardless of size: providers of public electronic communications networks or services, qualified trust service providers, top-level domain registries, DNS service providers, public administration bodies, and any entity a member state designates as the sole provider of a critical service.

#Sectors

#Essential versus important entities

The security obligations are the same for both; the difference is how closely they are supervised and how large the fines can be.

Financial entities covered by DORA (the Digital Operational Resilience Act, applying since 17 January 2025) follow DORA's more specific rules for ICT risk and incident reporting instead of the overlapping NIS2 provisions.

🎯

On the job. Scoping errors cut both ways: a mid-sized managed service provider often doesn't realise it's in scope (ICT service management is Annex I), while large groups forget they must register in every member state where they provide services. Write down the analysis — sector, size, entity type, countries — because the supervisor may ask how you concluded it.

#What NIS2 Requires

#Article 20 — governance

• The management body must approve the cybersecurity risk-management measures and oversee their implementation.
• Management can be held liable for infringements; for essential entities, national law can allow a temporary ban on a person exercising managerial functions.
• Members of management bodies must follow training, and entities are encouraged to train all employees regularly.

#Article 21 — cybersecurity risk-management measures

An all-hazards approach (protecting systems and their physical environment from any incident, not only attacks), proportionate to the entity's size and risk, including at least:

1. Policies on risk analysis and information-system security.
2. Incident handling.
3. Business continuity: backup management, disaster recovery and crisis management.
4. Supply-chain security, including the security of relationships with direct suppliers and service providers.
5. Security in network and information system acquisition, development and maintenance, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of these measures.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies on cryptography and, where appropriate, encryption.
9. Human resources security, access control policies and asset management.
10. Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications where appropriate.

For digital-infrastructure and ICT providers, Implementing Regulation (EU) 2024/2690 spells these out in detail. For everyone else, frameworks such as ISO/IEC 27001 and NIST CSF are the usual way to implement them; see compliance frameworks.

#Article 23 — incident reporting

A significant incident is one that has caused or can cause severe operational disruption or financial loss to the entity, or considerable damage to other people or organisations.

Entities must also inform recipients of their services, without undue delay, about significant incidents likely to affect them and about measures those recipients can take. Personal-data breaches still need a separate GDPR notification to the data-protection authority (72 hours).

#Other obligations

In practiceWhat a 24-hour early warning contains. It's deliberately short — you don't need the root cause yet:

NIS2 early warning — [Entity name, registration ID]          Submitted: 2026-10-04 09:40 CET
Incident detected: 2026-10-03 11:15 CET (awareness of significance: 2026-10-03 16:00 CET)
Services affected: online customer portal, payment processing (partially unavailable)
Suspected unlawful or malicious act: YES — ransomware note found on file servers
Possible cross-border impact: YES — customers in DE and AT use the affected portal
Contact: CISO, +49 …, incident@entity.eu        Next update: incident notification by 2026-10-06 16:00 CET

🎯

On the job. Pre-define "significant" with concrete thresholds (for example: a critical service down for more than 4 hours, or confirmed data exfiltration, or more than N customers affected), so the person on call can start the 24-hour clock without a meeting.

#Security Angle — Making NIS2 Real

A practical programme for a newly in-scope company:

Common pitfalls: treating NIS2 as an IT project without board involvement, discovering during an incident that nobody knows which authority to notify, and forgetting that managed service providers are themselves in scope.