NIS2 is the EU's second Network and Information Security Directive, and it dramatically widened the net compared to the original NIS Directive it replaced — pulling far more sectors and organisation sizes into scope for mandatory cybersecurity risk management and incident reporting.
It's a directive, not a regulation — that distinction matters
Unlike GDPR or DORA, which are regulations that apply directly and identically across the EU, NIS2 is a directive: each member state transposes it into its own national law, within limits set by the EU-level text. This means the exact obligations, penalty amounts, and enforcement mechanics can differ somewhat from country to country — worth checking the specific national transposition relevant to where you operate rather than assuming the EU-level text applies verbatim.
Essential entities vs important entities
NIS2 sorts in-scope organisations into two categories, with essential entities facing more stringent supervision:
- Essential entities — sectors like energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, and space.
- Important entities — a further set of sectors including postal and courier services, waste management, manufacture of certain critical products, digital providers, and food production/distribution, among others.
Generally, medium and large organisations in these sectors fall into scope, based on size thresholds set out in the directive — though certain organisations can be brought into scope regardless of size if they're considered critical enough (for example, being the sole provider of a critical service in a member state).
Minimum cybersecurity risk-management measures
NIS2 sets out a baseline set of risk-management measures that in-scope entities must implement, covering areas including:
- Risk analysis and information system security policies.
- Incident handling.
- Business continuity, including backup management and disaster recovery.
- Supply chain security, including the security of relationships with direct suppliers and service providers.
- Security in the acquisition, development, and maintenance of network and information systems.
- Policies and procedures for assessing the effectiveness of cybersecurity risk-management measures.
- Basic cyber hygiene practices and cybersecurity training.
- Policies on the use of cryptography and encryption where appropriate.
- Human resources security, access control policies, and asset management.
- The use of multi-factor authentication and secured communications where appropriate.
Incident reporting on a tight, phased timeline
NIS2 introduces a notably fast, multi-stage reporting timeline for significant incidents — generally an early warning within 24 hours of becoming aware of the incident, a fuller incident notification within 72 hours, and a final report within a defined period afterward (typically around a month). This phased approach — an early, incomplete warning followed by more detail — reflects a deliberate design choice: authorities would rather get imperfect information fast than complete information late.
Management bodies can be held personally accountable
A notable feature of NIS2 is that it explicitly requires management bodies (boards, executive leadership) to approve and oversee the organisation's cybersecurity risk-management measures — and allows for accountability to reach that level, not just the technical or compliance teams underneath it. This is a deliberate push to make cybersecurity a genuine governance topic rather than something delegated entirely downward.
Tiered penalties, similar in spirit to GDPR
NIS2 sets out maximum administrative fines that scale with entity type, with essential entities facing a higher ceiling than important entities — structured, similarly to GDPR, as the higher of a fixed amount or a percentage of global annual turnover. Because national transposition can affect exact figures and enforcement approach, the specific numbers relevant to your situation are worth confirming against the applicable member state's law.
This guide is general information, not legal advice — whether NIS2 applies to your organisation, and under what specific national transposition, depends on your sector, size, and jurisdiction. Consult a qualified professional for advice specific to your organisation.
Building on security work you've already done
NIS2's risk-management measures overlap substantially with what a mature ISO 27001 or NIST CSF-aligned program already covers. ComplianceDesk's NIS2 framework gives you the directive's baseline measures pre-built as trackable controls, with an evidence vault, so existing security work doesn't need to be duplicated to demonstrate NIS2 alignment.