NIS2 requirements, explained

What is NIS2?

NIS2 is the European Union's directive on a high common level of cybersecurity, Directive (EU) 2022/2555. It replaced the first NIS Directive of 2016, entered into force on 16 January 2023, and had to be written into national law by every member state by 17 October 2024. Because it is a directive, the obligations reach you through your country's own law, which can add detail but not lower the bar.

Compared with the first NIS Directive, it covers far more sectors and organisations, sets one list of minimum security measures, fixes reporting deadlines, makes management bodies accountable, and gives authorities real fines to enforce it.

Who has to comply

NIS2 applies to public and private organisations that provide their services or carry out their activities in the EU, in the sectors listed in its two annexes (Article 2), and that are at least a medium-sized enterprise. In practice that means 50 or more employees, or an annual turnover and a balance sheet total both above €10 million.

• Annex I, sectors of high criticality: energy, transport (air, rail, water and road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration, and space.
• Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles), digital providers (online marketplaces, search engines and social networks), and research.

Some organisations are in scope whatever their size, including providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers, and organisations a member state identifies as the sole provider of a service essential to society (Article 2(2)).

Being in scope covers the whole organisation: the security measures apply to all the network and information systems it uses to run its services (Article 21(1)), not only to one department.

Essential and important entities

Organisations in scope are either essential or important (Article 3). Broadly, large organisations in an Annex I sector are essential, and the rest are important; some, such as qualified trust service providers and top-level domain registries, are essential at any size. Both carry the same security and reporting duties. The difference is supervision and fines: essential entities can be inspected and audited at any time, while important entities are supervised after the fact, when there is evidence of a problem (Articles 32 and 33).

Member states had to draw up their list of essential and important entities by 17 April 2025, and organisations have to register with their national authority and keep that registration up to date (Articles 3(3), 3(4) and 27).

The ten cybersecurity risk-management measures

Article 21 requires "appropriate and proportionate technical, operational and organisational measures" to manage the risks to your systems, based on an all-hazards approach. Article 21(2) lists what those measures must at least include:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security, including the security of your relationships with direct suppliers and service providers.
5. Security in acquiring, developing and maintaining network and information systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess whether the measures are effective.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies and procedures on the use of cryptography and, where appropriate, encryption.
9. Human resources security, access control policies and asset management.
10. Multi-factor or continuous authentication, and secured voice, video, text and emergency communications, where appropriate.

"Proportionate" matters: the measures are scaled to your size, your exposure to risk, and the likelihood and impact of incidents. For a group of digital service providers (cloud, data centre, managed service and managed security service providers, DNS, top-level domain registries, content delivery networks, online marketplaces, search engines, social networks and trust service providers), Implementing Regulation (EU) 2024/2690 spells the measures out in detail. For everyone else, Article 21(2) and national law set the requirements.

Incident reporting deadlines

A significant incident is one that has caused or can cause severe disruption of your services or financial loss, or that has affected or can affect others by causing considerable damage (Article 23(3)). For each one, you report to your national CSIRT or competent authority in stages (Article 23(4)):

• Within 24 hours of becoming aware: an early warning, saying whether the incident may be caused by unlawful or malicious acts and whether it could affect other countries.
• Within 72 hours of becoming aware: an incident notification with an initial assessment of its severity and impact and, where available, the indicators of compromise.
• On request: an intermediate report on the status of the incident.
• Within one month of the incident notification: a final report with a detailed description, the likely root cause, the mitigation applied and any cross-border impact. If the incident is still ongoing then, a progress report, and the final report within a month of handling it.

Where appropriate, you also have to tell the recipients of your services about a significant incident that is likely to affect them (Article 23(1)).

What management is responsible for

Article 20 puts cybersecurity on the board's agenda. The management body has to approve the risk-management measures, oversee how they are implemented, and can be held liable when the organisation does not comply. Its members have to follow training, and organisations are encouraged to offer similar training to their staff regularly.

Fines and enforcement

Authorities can inspect, audit, issue binding instructions and impose fines (Articles 32 to 34). For breaching the security or reporting duties, the maximum fine is at least:

• Essential entities: €10 million or 2% of total worldwide annual turnover, whichever is higher.
• Important entities: €7 million or 1.4% of total worldwide annual turnover, whichever is higher.

For essential entities, authorities can also, as a last resort, temporarily suspend a certification or bar a person in a management role from exercising those functions.

NIS2, DORA, ISO 27001 and GDPR

• DORA, Regulation (EU) 2022/2554, applies to financial entities from 17 January 2025. Where a sector-specific EU law like DORA sets equivalent cybersecurity and reporting requirements, those take the place of the matching NIS2 provisions (Article 4).
• ISO/IEC 27001 is a voluntary standard for an information security management system. NIS2 does not require certification, and following a standard is not automatically the same as meeting the directive, but an existing management system covers much of the ground and is good evidence of how you manage risk.
• GDPR still applies alongside NIS2. A personal data breach has its own notification to the data protection authority within 72 hours, separate from the NIS2 reports, even when one incident triggers both.

Where to start

1. Check whether your organisation is in scope, and whether as an essential or important entity, under your country's law.
2. Register with your national authority if you have not already.
3. Assess where you stand against the ten measures above, and record why any of them does not apply to you.
4. Have management approve the plan, and book their training.
5. Put the 24-hour, 72-hour and one-month reporting process in writing, with names, before you need it.
6. Keep the evidence as you go: policies, logs, test results, training records and supplier reviews.

Our NIS2 compliance page shows how SeaDirect Protect delivers each obligation and gathers the evidence as a by-product, and the regulatory clock lists the dates that apply.

The official text

• Directive (EU) 2022/2555 (NIS2) on EUR-Lex, available in every EU language and as a PDF.
• Implementing Regulation (EU) 2024/2690, the detailed measures for digital service providers.

This page explains the directive; it is not legal advice. Your obligations are set by your country's transposing law, which can add requirements.