NIS2: Network and Information Security Directive 2

The NIS2 Directive (Directive EU 2022/2555) is the cornerstone of EU cybersecurity law, and it widens the scope and raises the bar of cybersecurity requirements across the European Union. It replaces the original NIS Directive of 2016 and responds to a much larger cyber threat landscape and to the growing dependence of European society and the economy on network and information systems. The directive covers 18 sectors and sorts entities into two tiers: essential entities and important entities. Essential entities are mainly large entities in the 11 Annex I sectors (including energy, transport, banking, health, water, digital infrastructure, ICT service management and public administration); important entities are the other entities in scope, including medium-sized entities in those sectors and entities in the 7 Annex II sectors (including postal services, waste management, chemicals, food, manufacturing, digital providers and research). NIS2 requires every entity in scope to apply cybersecurity risk management measures covering at least 10 areas, from incident handling and business continuity to supply chain security and encryption. One of its main innovations is management accountability: members of management bodies can be held liable for cybersecurity infringements. The directive also sets strict incident reporting duties: an early warning within 24 hours, a notification within 72 hours and a final report within one month, to the CSIRT or competent authority. NIS2 harmonises enforcement across the EU with significant penalties and strengthens cooperation between Member States, including through the EU-CyCLONe network for coordinated crisis management.

1. Annex I sectors (high criticality): energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space
2. Annex II sectors (other critical sectors): postal services, waste management, chemicals, food production and distribution, manufacturing, digital providers and research organisations
3. Medium and large enterprises (50+ employees or EUR 10M+ turnover) in covered sectors
4. Smaller entities providing critical services (DNS, TLD registries, trust services, sole national service providers)

1. 01

   Cybersecurity risk management

   Entities must adopt cybersecurity risk management measures proportionate to the risks, covering at least 10 areas: risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, network security, vulnerability handling and disclosure, assessment of cybersecurity measures, cryptography and encryption, human resources security, and multi-factor authentication.

2. 02

   Incident reporting

   Significant incidents must be reported in three stages: an early warning within 24 hours, a notification within 72 hours with an initial assessment, and a final report within one month covering root cause, mitigation measures and cross-border impact.

3. 03

   Supply chain security

   Entities must address cybersecurity risk in their supply chains, taking into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of their suppliers' products and cybersecurity practices.

4. 04

   Management accountability

   Management bodies must approve cybersecurity risk management measures and oversee their implementation. They can be held liable for infringements. Members must follow regular cybersecurity training.

5. 05

   Registration and information sharing

   Entities must register with the competent authority, providing information about their operations, IP ranges and contact details. The directive encourages voluntary cybersecurity information sharing between entities.

NIS2 introduces a harmonised penalty framework across the EU. For essential entities, maximum fines must be at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, maximum fines must be at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher. Beyond fines, competent authorities can issue compliance orders, binding instructions and security audit orders, and temporarily suspend certifications or authorisations. For essential entities, authorities can even request a temporary ban on management functions. Personal liability for members of management bodies is a fundamental shift in cybersecurity accountability.

1. Dec 2020

   European Commission publishes the NIS2 Directive proposal

2. Jan 2023

   NIS2 enters into force, starting a 21-month transposition period

3. Oct 2024

   Transposition deadline: Member States must bring NIS2 into national law

4. Apr 2025

   Member States must establish their lists of essential and important entities