Compliance Guide - NIS2 Directive¶

Overview¶

NIS2 is the European Union's main cybersecurity law for organisations that society depends on: energy, transport, banking, health, water, digital infrastructure, cloud and managed service providers, public administration, manufacturing, food, chemicals, postal services and more. Its full name is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaced the first NIS Directive (2016/1148), which covered far fewer sectors and was applied very unevenly across member states.

Key dates:

Because NIS2 is a directive, it does not apply directly. Each member state writes it into its own law, so the exact obligations, registration process, authority and fines depend on the country. Many member states missed the October 2024 deadline and the Commission opened infringement procedures; most had transposed by 2026 but not all [unconfirmed from an official source at the time of writing - check the Commission's NIS2 page for current transposition status]. Always read the national law of each country you operate in.

The key ideas that separate NIS2 from its predecessor: far wider scope decided mostly by sector and size rather than government designation, management accountability (boards must approve and oversee cyber risk measures and can be held liable), strict incident reporting deadlines, and supply chain security as an explicit duty.

NIS2 at a glance¶

flowchart LR
  scope[Am I in scope?<br/>sector in Annex I or II<br/>plus size threshold]
  class[Essential or<br/>important entity?]
  reg[Register with the<br/>national authority]
  gov[Management body approves<br/>and oversees measures,<br/>takes training]
  meas[Implement Article 21<br/>risk-management measures]
  rep[Report significant incidents:<br/>24h early warning,<br/>72h notification, 1 month final]
  sup[Supervision: proactive for essential,<br/>reactive for important]

  scope --> class --> reg --> gov --> meas --> rep
  meas --> sup
  rep --> sup

The NIS2 journey: work out whether and how you are in scope, register, put management in charge, implement the Article 21 measures, report incidents on deadline, and expect supervision matched to your category.

Who is in scope¶

Sectors¶

Size¶

As a rule, NIS2 applies to medium and large organisations in these sectors. Under the EU definition, a medium enterprise has 50 or more employees, or more than EUR 10 million annual turnover and balance sheet total. Small and micro organisations are out of scope unless a specific rule pulls them in: for example, DNS service providers, TLD name registries and qualified trust service providers are covered regardless of size, and member states can designate smaller entities that are the sole provider of a critical service.

Essential vs important¶

"At least" matters: the directive sets the minimum ceiling member states must allow; national law can go higher.

Relationship with DORA¶

For financial entities covered by DORA, DORA is lex specialis: its ICT risk management, incident reporting and testing rules apply instead of the equivalent NIS2 rules. Banks and financial market infrastructures still appear in NIS2's Annex I, but in practice they comply with DORA for these topics.

The obligations¶

Article 20: governance¶

• The management body (the board or equivalent) must approve the cybersecurity risk-management measures and oversee their implementation.
• Management can be held liable for infringements, under national law.
• Members of the management body must follow training, and entities are encouraged to offer similar training to employees regularly.

This is the clause that moved cybersecurity onto board agendas across Europe. "IT handles that" is no longer a defensible answer.

Article 21: cybersecurity risk-management measures¶

Measures must be appropriate and proportionate, take an all-hazards approach (not just cyber attacks: also fire, power loss, physical threats) and cover at least these ten areas:

For digital infrastructure and digital service providers (DNS, TLD, cloud, data centres, CDNs, managed and managed security service providers, online marketplaces, search engines, social networks, trust services), Implementing Regulation (EU) 2024/2690 spells out the technical and methodological requirements in detail and defines when an incident counts as significant. Because it is a regulation, it applies directly and identically in every member state.

Article 23: incident reporting¶

A significant incident is one that has caused or can cause severe operational disruption or financial loss to the entity, or considerable damage to other people or organisations. For each one, report to the national CSIRT or competent authority:

Entities must also inform recipients of their services of significant incidents likely to affect them, and of measures they can take in response to significant cyber threats.

These deadlines run in parallel with others: a personal-data breach also triggers GDPR's 72-hour notification to the data protection authority. Plan one process that feeds every report.

Registration¶

Entities generally must register with their national authority, providing name, address, sector, contact details and the member states where they provide services. Certain digital providers register in the member state of their main establishment, and ENISA keeps a registry of them. Check the national process: in several countries registration is how the authority learns you exist.

Cloud Provider NIS2 Support¶

The large cloud providers are themselves in scope (cloud computing and data centre services are Annex I digital infrastructure), and each publishes material on how its services help customers meet Article 21. Using them does not make you compliant; as always, how you configure and use them is yours.

AWS¶

Azure¶

Google Cloud¶

NIS2 vs other frameworks¶

An ISO 27001 ISMS covers most of Article 21 and is the most common way organisations organise their NIS2 programme, but a certificate is not proof of NIS2 compliance: reporting deadlines, registration and management liability are legal obligations ISO does not test. The NIST CSF 2.0 is a useful outside-the-EU mapping target.

Preparation Checklist¶

Scoping¶

• Determine, for each EU country you operate in, whether you are in an Annex I or II sector and over the size threshold
• Decide essential vs important, and check whether any size-independent rule or national designation applies
• Register with each relevant national authority
• Identify whether Implementing Regulation (EU) 2024/2690 applies (digital infrastructure and digital providers)

Governance¶

• Management body formally approves the risk-management measures (minutes as evidence)
• Management body training completed and recorded
• Named accountable owners for each Article 21 area

Measures¶

• Risk assessment covering all hazards, reviewed at least annually
• Incident response plan with the 24h / 72h / 1-month reporting steps and the authority's contact route
• Tested backups and disaster recovery
• Supplier inventory with risk tiers, contract security clauses and assessments of critical suppliers
• Vulnerability management and a coordinated vulnerability disclosure policy
• Cyber hygiene baseline and staff awareness training
• Cryptography policy
• Access control, joiner-mover-leaver process and asset inventory
• MFA for remote access, administrators and critical systems; secured emergency communications

Evidence Collection¶

Common gaps¶

• Management approval treated as a one-off signature, not ongoing oversight.
• No rehearsed way to produce a 24-hour early warning on a weekend.
• Supplier risk limited to a questionnaire at onboarding, never reassessed.
• Scoping done for the head office country only, missing subsidiaries elsewhere in the EU.
• MFA in place for staff but not for service providers with remote access.

Certification Exam Relevance¶

NIS2 knowledge is relevant for: - ISACA CISM and CISA - governance, legal and regulatory requirements, management accountability - ISC2 CISSP and CCSP - legal and regulatory compliance, including EU regulation - CCSK v5 - cloud compliance and jurisdiction - Microsoft SC-100 - regulatory compliance in a security strategy

Expect concepts (who is covered, management accountability, reporting deadlines) rather than article numbers.

Documentation Links¶

📖 Directive (EU) 2022/2555 (NIS2) on EUR-Lex - the official text

📖 European Commission: NIS2 Directive - policy page, implementing acts and transposition updates

📖 Commission Implementing Regulation (EU) 2024/2690 - technical and methodological requirements for digital infrastructure and digital providers

📖 ENISA: NIS2 Technical Implementation Guidance - ENISA guidance on implementing the measures in Implementing Regulation (EU) 2024/2690