SecurityEurope & UK

NIS 2

Connect cyber-risk responsibilities across your organisation

Organise security measures, supply-chain reviews and incident-readiness evidence for your NIS2 programme.

Full title
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive)
Issued by
European Parliament and Council of the European Union
Timeline
In force 16 January 2023. Member States had to transpose it by 17 October 2024. It repealed the original NIS Directive from 18 October 2024.
Applies to
Essential and important entities in the sectors listed in Annexes I and II, as defined in each Member State’s national law
Nature
An EU directive. Obligations apply to organisations through national transposing laws, supervised by national competent authorities.
Structure
9 chapters and 46 articles, with Annex I (sectors of high criticality) and Annex II (other critical sectors)

Overview

What NIS 2 requires

NIS 2 is the EU’s cross-sector cybersecurity law. It replaced the 2016 NIS Directive with a wider scope, stricter requirements and stronger enforcement. It covers medium-sized and large organisations in eighteen sectors, from energy, transport, banking, health and digital infrastructure to postal services, manufacturing and food, and some entities regardless of size.

Because NIS 2 is a directive, it does not apply to organisations directly. Each Member State has to transpose it into national law, identify the entities in scope, and appoint competent authorities and CSIRTs. The national law is what an organisation is actually obliged to follow, and Member States may go further than the directive. Transposition was due by 17 October 2024. Many Member States were late, and on 9 July 2026 the Commission referred four of them to the Court of Justice for failing to transpose it. Organisations operating in several countries need to check the status and detail of each national law.

The core obligations for entities sit in Articles 20 to 23. Management bodies must approve the cybersecurity risk management measures, oversee their implementation, follow training, and can be held liable for infringements. Entities must take appropriate and proportionate technical, operational and organisational measures, covering at least the ten areas in Article 21(2). Significant incidents must be reported to the CSIRT or competent authority in stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.

Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements, and the criteria for a significant incident, for digital infrastructure and digital service providers such as cloud, data centre, managed service and managed security service providers. In January 2026 the Commission proposed targeted amendments to NIS 2; these remain a proposal until adopted. Financial entities subject to DORA follow DORA for the equivalent risk management and reporting requirements. In the UK, see the NCSC CAF v3.2.

Who it applies to

NIS 2 applies to public and private entities of a type listed in Annex I or II that are medium-sized or larger and provide services or carry out activities in the EU (Article 2). Entities are classed as essential or important (Article 3):

  • Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space
  • Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research
  • Essential entities: broadly, large entities in Annex I sectors, plus specific entities such as qualified trust service providers, top-level domain registries and DNS service providers regardless of size
  • Important entities: other entities in scope, including medium-sized Annex I entities and Annex II entities
  • Entities designated by a Member State regardless of size, for example the sole provider of an essential service
  • Managed service and managed security service providers, cloud and data centre providers, including those outside the EU that serve EU customers

Certain digital providers, such as cloud, data centre, managed service and managed security service providers, that offer services in the EU without being established there must designate a representative in a Member State where they provide services. Member States had to establish a list of essential and important entities by 17 April 2025 and review it at least every two years.

Structure

How the directive is organised

46 articles in 9 chapters. Chapters II, III and V to VII are mainly addressed to Member States and EU bodies. Chapter IV sets the obligations that entities implement through national law.

Chapter I

General provisions (Articles 1 to 6)

Scope and classification (Articles 2 and 3)
The size-cap rule, entities in scope regardless of size, and the distinction between essential and important entities.
Sector-specific acts (Article 4)
Where a sector-specific EU act sets at least equivalent requirements, such as DORA for financial entities, that act applies in place of the corresponding NIS 2 provisions.
Minimum harmonisation and definitions (Articles 5 and 6)
Member States may adopt provisions that provide a higher level of cybersecurity. Definitions include incident, significant cyber threat and managed security service provider.
Chapters II and III

National frameworks and EU cooperation (Articles 7 to 19)

National frameworks (Articles 7 to 13)
National cybersecurity strategies, competent authorities and single points of contact, cyber crisis management, CSIRTs, coordinated vulnerability disclosure and national cooperation.
EU cooperation (Articles 14 to 19)
The NIS Cooperation Group, the CSIRTs network, the European cyber crisis liaison organisation network (EU-CyCLONe), international cooperation, reports on the state of cybersecurity and peer reviews.
Chapter IV

Governance and risk management measures (Articles 20 and 21)

Governance (Article 20)
Management bodies approve the cybersecurity risk management measures, oversee their implementation and can be held liable for infringements. Members must follow training, and regular training is encouraged for employees.
(a) Risk analysis and information system security policies
Policies on risk analysis and the security of information systems.
(b) Incident handling
Prevention, detection, analysis, containment, response and recovery.
(c) Business continuity and crisis management
Backup management, disaster recovery and crisis management.
(d) Supply chain security
Security in relationships with direct suppliers and service providers, taking into account each supplier’s vulnerabilities and practices.
(e) Security in acquisition, development and maintenance
Security of network and information systems through their lifecycle, including vulnerability handling and disclosure.
(f) Assessing effectiveness
Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
(g) Cyber hygiene and training
Basic cyber hygiene practices and cybersecurity training.
(h) Cryptography
Policies and procedures on the use of cryptography and, where appropriate, encryption.
(i) Human resources, access control and assets
Human resources security, access control policies and asset management.
(j) Authentication and secure communications
Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems, where appropriate.
Chapter IV

Reporting, supply chain and certification (Articles 22 to 25)

Supply chain risk assessments (Article 22)
Coordinated EU-level security risk assessments of critical ICT services, systems or product supply chains.
Reporting obligations (Article 23)
Notify significant incidents to the CSIRT or competent authority in stages, inform recipients of services affected by a significant incident, and where appropriate inform them of measures they can take against a significant cyber threat.
Certification and standards (Articles 24 and 25)
Member States may require the use of certified ICT products, services and processes under European cybersecurity certification schemes, and encourage the use of European and international standards.
Chapters V and VI

Jurisdiction, registration and information sharing (Articles 26 to 30)

Jurisdiction and territoriality (Article 26)
Entities fall under the jurisdiction of the Member State where they are established. DNS, TLD, cloud, data centre, CDN, managed service, managed security service and certain digital providers fall under the Member State of their main establishment.
Registries (Articles 27 and 28)
An ENISA registry of certain digital entities, and a database of domain name registration data.
Information sharing (Articles 29 and 30)
Voluntary cybersecurity information-sharing arrangements, and voluntary notification of incidents, cyber threats and near misses.
Chapter VII

Supervision and enforcement (Articles 31 to 37)

Essential entities (Article 32)
Proactive supervision, including on-site inspections, regular and targeted audits, ad hoc audits and security scans.
Important entities (Article 33)
Supervision after the fact, where there is evidence or indication of non-compliance.
Administrative fines (Article 34)
For essential entities, a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, a maximum of at least EUR 7 million or 1.4%. National laws set the actual amounts.
Other enforcement (Articles 35 to 37)
Interaction with data protection authorities where a breach involves personal data, national penalties, and mutual assistance between Member States.
Chapters VIII and IX

Implementing acts and final provisions (Articles 38 to 46)

Delegated and implementing acts (Articles 38 and 39)
The basis for implementing acts such as Implementing Regulation (EU) 2024/2690.
Final provisions (Articles 40 to 46)
Review, transposition by 17 October 2024, amendments to other EU acts, repeal of Directive (EU) 2016/1148 and entry into force.

Implementation roadmap

How to implement it, step by step

A practical sequence for an organisation preparing for NIS 2 through the national law that applies to it.

  1. 1

    Determine scope and national law

    Check whether your activities fall within Annex I or II, your size, whether you are essential or important, and which Member States’ laws apply. Register with the competent authority where the national law requires it.

    OutputsScope assessmentEntity classificationRegistration
  2. 2

    Engage the management body

    Have the management body approve the approach, assign accountability, and complete the training the national law requires.

    OutputsBoard approvalManagement training records
  3. 3

    Assess risk and gaps

    Carry out an all-hazards risk assessment and compare current measures with the ten areas in Article 21(2), and with Implementing Regulation (EU) 2024/2690 if you are a digital infrastructure or digital service provider.

    OutputsRisk assessmentGap analysis
  4. 4

    Implement the measures

    Close the gaps through policies, technical controls and procedures, prioritising incident handling, continuity, access control and authentication.

    OutputsPolicy setRemediation plan
  5. 5

    Secure the supply chain

    Identify direct suppliers and service providers, assess their security practices and build security requirements into contracts.

    OutputsSupplier inventorySupplier assessments
  6. 6

    Prepare incident reporting

    Define what counts as a significant incident, set up the route to the national CSIRT or authority, and rehearse meeting the 24-hour, 72-hour and one-month deadlines.

    OutputsIncident reporting procedureExercise records
  7. 7

    Measure effectiveness and improve

    Test and audit the measures, report to the management body and keep the risk assessment current.

    OutputsInternal audit reportsManagement reporting

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is supervised by national competent authorities under national law. Essential entities are supervised proactively, including through audits and inspections. Important entities are supervised after the fact when there is an indication of non-compliance. There is no NIS 2 certificate, although Member States can require certified products or services.

What reviewers look for

  • Correct classification as essential or important, and registration with the authority
  • Management body approval, oversight and training records
  • A documented, all-hazards risk assessment that drives the chosen measures
  • Coverage of each of the ten Article 21(2) areas, at a level proportionate to the risk
  • Incident handling procedures and a record of incidents and their significance
  • Reports made within the 24-hour, 72-hour and one-month deadlines
  • Business continuity, backup and disaster recovery that has been tested
  • Supplier security assessments and contract terms
  • Multi-factor authentication and access control in practice
  • Evidence that the effectiveness of the measures is assessed

Key timelines

Transposition deadline17 October 2024
Member State lists of entities17 April 2025, then 2-yearly
Early warning of a significant incidentWithin 24 hours
Incident notificationWithin 72 hours
Intermediate reportOn request
Final report1 month after notification
Risk assessment and measures reviewAs national law requires

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Scope and governance

  • Scope and classification assessment
  • Registration with the authority
  • Management body approvals
  • Management training records

Risk management

  • Risk assessment
  • Article 21 gap analysis
  • Risk treatment plan
  • Effectiveness reviews

Policies and controls

  • Information security policy
  • Access control and MFA records
  • Cryptography policy
  • Asset inventory

Incidents

  • Incident handling procedure
  • Incident register with significance decisions
  • Early warnings, notifications and final reports

Continuity

  • Business continuity and disaster recovery plans
  • Backup and restore tests
  • Crisis management exercises

Supply chain

  • Supplier inventory
  • Supplier security assessments
  • Contract security clauses

People

  • Cyber hygiene and awareness training
  • Joiner, mover and leaver records

Areas that often need attention

  • Scope assessed against the directive rather than the national law that actually applies
  • Management body approval without evidence of oversight or completed training
  • No clear definition of a significant incident, so reporting decisions are inconsistent
  • Incident timelines not recorded, so the 24-hour and 72-hour deadlines cannot be shown
  • Supplier security handled at onboarding only, with no ongoing review
  • Continuity and recovery plans that have never been tested
  • Multi-factor authentication applied unevenly across systems and users
  • No method for assessing whether the measures are effective

How Netra helps

Where each part of the work lives in Netra

Netra loads NIS 2 as requirements, tasks and policies, so each Article 21 measure has an owner, a schedule and evidence on one record.

Each Article 21 measure owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks keep tests, reviews and training current.

Status across the ten measures

Compliance Centre

Status is derived from completed tasks and evidence. Work done for ISO 27001 or DORA counts here too where the same control applies.

Cybersecurity policies

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

All-hazards risk assessment

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked treating tasks are completed.

Supply chain security

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Asset management under Article 21(2)(i)

Asset Management

Assets are linked to the tasks and controls that protect them.

Audits and inspections

Audit Centre

Run internal and regulatory audits end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Management body oversight

Dashboard & Reports

A live Posture Score and a one-click board report for NIS 2 built from current data.

Netra organises NIS 2 work and evidence. It does not by itself establish compliance or determine scope under national law, it is not a reporting channel to a CSIRT or competent authority, and it is not a SIEM or incident detection tool. National requirements should be confirmed for each Member State.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NCSC CAF v3.2

Make resilience outcomes easier to assess and evidence

Financial services

DORA

Keep digital resilience work ready for review

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

See NIS 2 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.