October 17, 2024 was the deadline by which European Union member states were supposed to transpose the NIS2 directive into national law. Most member states didn’t make it. Over fifteen months have passed since that deadline, and legislative work is still ongoing in many countries.
The situation is unusual - organizations know new regulations are coming, but don’t know their final shape. This article explains the current state of NIS2 implementation in Europe, consequences of delays, and practical actions organizations can take now.
What is NIS2 and why does it matter?
NIS2 (Network and Information Security Directive 2) is Directive (EU) 2022/2555 of the European Parliament and of the Council, which replaces the first NIS Directive from 2016. It’s the most important cybersecurity regulation in the European Union.
Why is NIS2 more important than its predecessor?
The first NIS Directive had fundamental weaknesses:
- Narrow scope - covered only operators of essential services and digital service providers
- Lack of harmonization - member states implemented it differently, creating a patchwork of regulations
- Weak enforcement - low penalties and unclear requirements
- Inadequacy to threats - the world changed, cybercrime exploded
NIS2 addresses these problems:
- Broader scope - covers 18 sectors and significantly more entities
- Harmonization - precise minimum requirements for all states
- Severe penalties - up to EUR 10 million or 2% of turnover for essential entities
- Board responsibility - personal liability of management members
📚 Read the complete guide: IAM / Zero Trust: Identity and access management - from the basics to Zero Trust
What is the current implementation status in Europe?
As of January 2026, the situation across Europe varies significantly.
Legislative progress
Several countries fully implemented NIS2 by or shortly after the deadline (Belgium, Croatia, Hungary). Most major economies - Germany, France, Italy, Spain, Poland - completed or are completing their transposition in late 2025 or early 2026.
Main elements of implementation
National implementations introduce:
New entity classification:
- Essential entities (formerly: operators of essential services)
- Important entities (new category)
Expanded sectoral scope:
- Essential sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space
- Important sectors: postal and courier services, waste management, chemical manufacturing and distribution, food manufacturing and distribution, manufacturing (medical devices, computers, electronics, machinery, vehicles), digital service providers, research
Requirements for risk management measures:
- Risk analysis and information system security policies
- Incident handling
- Business continuity and crisis management
- Supply chain security
- Security in system acquisition, development, and maintenance
- Policies and procedures to assess effectiveness of risk management measures
- Basic cyber hygiene practices and training
- Cryptography and encryption policies
- Human resources security, access control, asset management
- Multi-factor or continuous authentication
Penalty system:
- For essential entities: up to EUR 10 million or 2% of turnover
- For important entities: up to EUR 7 million or 1.4% of turnover
- Personal liability of management
Delays in European context
The European Commission initiated infringement proceedings against member states that missed the deadline. This reflects the importance placed on timely implementation.
What are the consequences of delayed implementation?
Delayed NIS2 implementation has consequences for both states and organizations.
For member states
- Infringement proceedings - European Commission can impose penalties
- Regulatory gap - some entities are not covered by effective oversight
- Market fragmentation - companies operating across the EU must apply different standards
For organizations
Legal uncertainty: Organizations don’t know exactly what requirements they will have to meet. Details of national implementation may differ from the directive minimum.
Compliance risk: When laws enter into force, organizations will have limited time to adapt. Those who haven’t started preparations may not make it.
Investment decisions: It’s difficult to plan cybersecurity budgets without knowing exact requirements.
What can organizations do now?
Despite legal uncertainty, organizations shouldn’t wait idly. The NIS2 directive is known, and minimum requirements are clear.
Determine if your organization will be covered by NIS2
The first step is determining whether your organization will qualify as an essential or important entity.
Qualification criteria:
Essential entity - organization operating in an essential sector that:
- Is a large enterprise (over 250 employees OR turnover over EUR 50 million OR balance sheet over EUR 43 million), or
- Is an operator of essential services under existing regulations, or
- Has been designated by the member state
Important entity - organization operating in an essential or important sector that:
- Is a medium enterprise (50-250 employees OR turnover EUR 10-50 million), or
- Is a small enterprise but has been designated by the member state
Conduct gap analysis
Compare your organization’s current cybersecurity state with NIS2 requirements. Focus on the 10 areas from Article 21 of the directive:
-
Risk analysis and information system security policies
- Do you have a formal security policy?
- Do you conduct regular risk analyses?
- Are policies updated?
-
Incident handling
- Do you have procedures for incident detection, analysis, and response?
- Do you have a response team (SOC/CSIRT)?
- Do you conduct post-mortem analyses?
-
Business continuity and crisis management
- Do you have business continuity plans?
- Do you have backup management procedures?
- Do you test recovery from backups?
-
Supply chain security
- Do you verify supplier security?
- Do you have security requirements in contracts?
- Do you monitor supplier-related risks?
-
Security in system acquisition, development, and maintenance
- Do you have secure development processes (SDLC)?
- Do you conduct security tests?
- Do you manage vulnerabilities?
-
Policies and procedures to assess effectiveness of risk management measures
- Do you measure security control effectiveness?
- Do you conduct audits and reviews?
- Do you use penetration tests?
-
Basic cyber hygiene practices and training
- Do you train employees on cybersecurity?
- Do you conduct phishing simulations?
- Do you have password and update policies?
-
Policies and procedures regarding cryptography and encryption
- Do you encrypt data at rest and in transit?
- Do you manage cryptographic keys?
- Do you have an encryption usage policy?
-
Human resources security, access control, asset management
- Do you have processes for granting and revoking permissions?
- Do you apply the principle of least privilege?
- Do you have IT asset inventory?
-
Multi-factor authentication (MFA)
- Is MFA implemented for remote access?
- Does MFA protect critical systems?
- Is MFA used for privileged accounts?
Start remediation actions
Based on gap analysis, plan and begin remediation actions. Prioritize by:
- Risk - highest risk areas first
- Complexity - quick wins build momentum
- Dependencies - some actions are prerequisites for others
Prepare incident reporting processes
NIS2 introduces strict incident reporting requirements:
- Early warning - within 24 hours of detecting a significant incident
- Incident notification - within 72 hours of detection
- Final report - within one month of notification
Ensure you have:
- Defined criteria for “significant incident”
- Escalation and reporting procedures
- Notification templates
- Persons responsible for CSIRT contact
Engage the board
NIS2 introduces personal board liability for cybersecurity risk management. The board must:
- Approve risk management measures
- Oversee their implementation
- Undergo cybersecurity training
- Bear responsibility for violations
Start board education now. Regular cyber risk briefings, training, including cybersecurity on board meeting agendas.
How does NIS2 affect the IT sector and service providers?
NIS2 has particular significance for the IT sector, which has largely avoided cybersecurity regulation until now.
Managed service providers (MSP/MSSP)
NIS2 explicitly covers managed service providers and managed security service providers. If your company provides such services, you will be an important entity.
This means:
- Obligation to implement risk management measures
- Obligation to report incidents
- Subject to oversight
- Potential penalties
Cloud service providers
Cloud service providers are covered by NIS2 as digital infrastructure. This applies to both large hyperscalers and smaller providers.
Data centers
Data center operators (colocation, housing) are also covered as digital infrastructure.
DNS service providers and domain registrars
A new category of entities - previously unregulated - now subject to NIS2.
Supply chain impact
Even if your organization is not directly covered by NIS2, you may feel its effects through the supply chain. Essential and important entities must manage supplier risk, which means:
- Security requirements in tenders
- Audits and certifications
- Security contractual clauses
- Supplier security monitoring
What technologies support NIS2 compliance?
Effective NIS2 implementation requires appropriate tools. Here are key categories.
SIEM and SOAR systems
Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) are fundamental for:
- Incident detection
- Security event correlation
- Response automation
- Documentation for compliance
Vulnerability management platforms
Regular scanning and vulnerability remediation is fundamental to cyber hygiene required by NIS2.
Security testing tools
NIS2 requires assessment of risk management measure effectiveness. Automated penetration testing platforms, such as RidgeBot, enable continuous security validation.
Identity management systems (IAM)
For access control, MFA, privileged account management requirements.
GRC platforms
Integrated platforms for risk, compliance, and audit management help document and track NIS2 compliance.
Backup and disaster recovery solutions
For business continuity and post-incident recovery requirements.
Summary - practical action plan
Despite implementation delays, organizations should actively prepare for NIS2. Here’s an action plan.
Immediately
- Determine if your organization will be covered by NIS2
- Conduct initial gap analysis
- Inform board about upcoming requirements
Within one month
- Develop detailed adjustment plan
- Determine budget and resources
- Begin priority remediation actions
Within a quarter
- Implement basic risk management measures
- Prepare incident reporting procedures
- Conduct training for board and employees
After law enters into force
- Verify compliance with final regulations
- Register with competent authority (if required)
- Begin regular reporting and self-assessments
Key NIS2 readiness metrics
| Area | Indicator | Target |
|---|---|---|
| Policies | Percentage of required policies developed | 100% |
| Risk analysis | Date of last update | < 12 months |
| Incidents | Mean time to detect (MTTD) | < 24 hours |
| MFA | Percentage of critical systems with MFA | 100% |
| Training | Percentage of employees trained | > 95% |
| Suppliers | Percentage of critical suppliers audited | 100% |
| Backup | Time of last recovery test | < 6 months |
| Tests | Date of last penetration test | < 12 months |
NIS2 is not just a regulatory requirement - it’s an opportunity to genuinely raise organizational cybersecurity levels. Companies that take these requirements seriously will be better protected against growing cyber threats.
Need support preparing for NIS2? Contact us - we’ll help conduct gap analysis, plan actions, and implement required security measures.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- Key Requirements of NIS2 Directive - Actions, Process, Obligations, Preparations, Implementation Deadline, and Incident Reporting
- KSC NIS2 as a program: How should the Project Manager manage compliance implementation?
- KSC NIS2 from the technical side: An Implementation Guide for IT Professionals and Team Leaders
- Amendment to the NSC Act (NIS2): What new obligations await Polish companies and how to prepare for them?
- Personal board liability for cybersecurity under NIS2
Explore Our Services
Need cybersecurity support? Check out:
- NIS2 Compliance - NIS2 directive compliance
- NIS2 Readiness Check - NIS2 readiness assessment
- Security Audits - comprehensive security assessment
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- RidgeBot — Ridge Security
Related topics
See also:
