The NIS2 Directive introduces new cybersecurity requirements for many sectors, including energy, transport, health, and finance. Entities covered by the regulation must implement risk management systems, ensure supply chain security, and report incidents within 24 hours. Training and audit requirements are also significant, as well as strict sanctions for non-compliance, reaching up to 10 million euros.
📚 New to NIS2? What the NIS2 Directive is — definition, objectives, obligations and deadlines.
What Is the NIS2 Directive?
The NIS2 Directive (Network and Information Security 2) is EU legislation aimed at raising the level of cybersecurity in all member states. It represents an update and expansion of the scope of the original NIS Directive from 2016. NIS2 introduces stricter requirements for cyber risk management, incident reporting, and cooperation between EU countries. The directive covers a wide range of sectors considered essential to the economy and society, such as energy, transport, banking, healthcare, digital infrastructure, and public administration. Entities operating in these sectors will need to implement appropriate security measures and report serious incidents to relevant national authorities.
📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose
What Are the Key Areas of NIS2 Directive Requirements?
The NIS2 Directive establishes a number of requirements for entities within its scope, which can be grouped into several key areas. First and foremost, organizations must implement effective cybersecurity risk management, including regular risk assessments, implementing adequate security measures, and monitoring and responding to incidents. NIS2 places great emphasis on supply chain security, obligating entities to manage risks related to suppliers and subcontractors. Another important area is incident reporting requirements - entities must inform relevant authorities about serious incidents within 24 hours of their detection. The directive also introduces the obligation to appoint a person responsible for cybersecurity and to conduct regular training and awareness activities among employees. Finally, NIS2 establishes a framework for supervision and enforcement, including financial penalties for non-compliance.
What Are the Requirements for Cybersecurity Risk Management?
Cybersecurity risk management is a key element of NIS2 Directive requirements. Entities covered by the directive must implement a comprehensive and systematic process for identifying, assessing, and addressing cyber risk. The starting point is regularly conducting risk assessments, taking into account the specifics of the given organization and the current threat landscape. Based on risk assessment results, entities must implement adequate and proportionate technical and organizational measures to manage identified risks. This includes security policies, access control, data encryption, incident detection and response, and vulnerability management. NIS2 also requires regular review and update of risk assessments and adaptation of security measures to changing conditions. Entities must be able to demonstrate that their risk management process is effective and compliant with directive requirements.
What Technical and Organizational Measures Must Entities Covered by the Directive Implement?
The NIS2 Directive requires entities to implement a range of technical and organizational measures to ensure network and information system security. In terms of technical measures, organizations must apply access control, data encryption, network segmentation, intrusion detection and prevention systems (IDS/IPS), advanced endpoint protection (EDR), and multi-factor authentication mechanisms (MFA). Regular software updates and patching of known vulnerabilities are also important. In the organizational dimension, entities must develop and implement security policies, incident response procedures, business continuity plans, and disaster recovery. NIS2 emphasizes employee training and cybersecurity awareness raising. The directive also requires appointing a person responsible for cybersecurity and providing them with appropriate resources and authority. Implemented measures must be regularly tested and audited for effectiveness.
What Are the Incident Reporting Requirements?
NIS2 introduces strict requirements for reporting cybersecurity incidents. Entities covered by the directive must inform relevant national authorities (usually CSIRT - Computer Security Incident Response Team) about every serious incident within 24 hours of its detection. A serious incident is one that has a significant impact on service provision or causes significant financial or operational losses. The report must contain information about the nature of the incident, its scale, remedial actions taken, and potential consequences. NIS2 also introduces the obligation to notify affected users about incidents if this is necessary to prevent or limit damage. The directive establishes a uniform incident reporting format, which is intended to facilitate information exchange between member states. Entities must also maintain internal incident registers and regularly review them to draw conclusions and improve their security.
How Does the NIS2 Directive Regulate Supply Chain Issues?
Supply chain security is one of the key areas regulated by the NIS2 Directive. Entities covered by the directive must manage risks related to suppliers and subcontractors whose products or services impact network and information system security. Organizations must develop and implement a supply chain security policy, defining requirements and supplier selection criteria, risk assessment principles, and monitoring and audit mechanisms. NIS2 requires that contracts with suppliers contain security clauses, including requirements for applied technical and organizational measures, incident reporting, and the right to audit. Entities must maintain and regularly update a register of suppliers and subcontractors and assess them for cyber risk. In case of identifying high risk, organizations must take appropriate actions, such as additional safeguards, audits, or even contract termination. The purpose of these requirements is to ensure that supplier security weaknesses don’t become an attack vector for entities covered by the directive.
What Are the Training and Awareness Requirements?
The NIS2 Directive places great emphasis on training and awareness raising in cybersecurity. Entities covered by the directive must ensure that their employees, particularly those involved in cyber risk management, have appropriate competencies and knowledge. Organizations must develop and implement a training program, including both initial training for new employees and regular refresher training for all staff. Training topics should include security policies and procedures, incident recognition and reporting, safe use of IT systems, data protection, and social engineering. NIS2 also encourages conducting cybersecurity awareness campaigns among employees, e.g., through messages, posters, or simulated phishing attacks. The directive requires entities to regularly assess the effectiveness of their training activities and adapt them to changing needs and threats. The purpose of these requirements is to create a cybersecurity culture in the organization where every employee understands their role and responsibility in protecting IT systems.
How Does the NIS2 Directive Approach Supervision and Enforcement?
NIS2 establishes a framework for supervision and enforcement of cybersecurity regulations. Each member state must designate one or more competent authorities responsible for monitoring and enforcing compliance with the directive by entities within its scope. These authorities must have the necessary powers and resources to conduct audits, request information, and impose sanctions. NIS2 introduces a regular audit schedule - essential entities must be audited at least once every 2 years, and important entities - at least once every 4 years. In case of finding violations, supervisory authorities can issue recommendations, warnings, or orders to remedy deficiencies within a specified period. In case of serious or repeated violations, NIS2 provides for severe financial penalties - up to 10 million euros or 2% of global annual turnover. The directive also establishes cooperation and information exchange mechanisms between supervisory authorities of different member states to ensure consistent and effective enforcement across the EU.
What Are the Consequences of Non-Compliance with NIS2 Directive Requirements?
Non-compliance with NIS2 Directive requirements can have serious consequences for entities within its scope. First and foremost, organizations risk severe financial penalties, which can reach 10 million euros or 2% of global annual turnover, whichever is higher. These penalties can be imposed for various violations, such as failure to implement appropriate security measures, failure to report a serious incident, or obstructing an audit. Beyond financial penalties, entities may also be subject to other sanctions, such as public warnings, orders to remedy deficiencies, or even temporary suspension of certificates or permits necessary for business operations. Non-compliance with NIS2 can also lead to serious image damage and loss of customer or business partner trust. In case of a serious incident caused by cybersecurity negligence, entities may also be subject to civil or criminal liability. Finally, failure to meet directive requirements may hinder or prevent doing business in the EU market, especially in sectors considered essential or important.
How Does the NIS2 Directive Affect International Cybersecurity Cooperation?
The NIS2 Directive places great emphasis on international cybersecurity cooperation, recognizing that effective protection against cyber threats requires coordinated actions at the global level. First and foremost, NIS2 establishes cooperation and information exchange mechanisms between EU member states. It creates a Cooperation Group, consisting of representatives of member states, the European Commission, and the EU Agency for Cybersecurity (ENISA), whose task is to support strategic cooperation and information exchange. NIS2 also strengthens the role of the CSIRT network, obligating member states to provide them with appropriate resources and competencies and to participate in coordinated actions at EU level. The directive also encourages creating regional operational centers to facilitate cross-border cooperation in incident response. Beyond the EU, NIS2 promotes cooperation with third countries and international organizations, particularly in information exchange, capacity building, and developing common cybersecurity standards. The directive is also consistent with other international initiatives, such as the Budapest Convention on Cybercrime or ISO/IEC work on security standards.
What Are the NIS2 Directive Implementation Deadlines?
The NIS2 Directive entered into force on January 16, 2023, 20 days after its publication in the Official Journal of the EU. From that moment, member states have 21 months (until October 17, 2024) to transpose the directive into national law. After this deadline, national regulations implementing NIS2 will become binding for entities covered by the directive. However, due to the scale and complexity of requirements, the directive provides additional transitional periods for some obligations. For example, entities will have an additional 6 months (until April 17, 2025) to notify relevant national authorities that they meet the criteria for recognition as an essential or important entity. In turn, the obligation to conduct the first risk assessment and implement appropriate technical and organizational measures must be fulfilled within 12 months of the date of application of national regulations (no later than October 17, 2025). Entities will need to adapt existing contracts with suppliers to NIS2 requirements within a maximum of 24 months from the date of application of national regulations (no later than October 17, 2026). These additional transitional periods are intended to give organizations time to adapt to new requirements, but due to their complexity, it’s worth starting preparations as early as possible.
How to Prepare to Meet NIS2 Directive Requirements?
Preparing to meet NIS2 Directive requirements is a complex process requiring engagement of the entire organization. The first step should be thorough familiarization with the directive’s provisions and national regulations implementing it, to understand what obligations apply to a given entity. Then it’s necessary to conduct a comprehensive cyber risk assessment, taking into account the specifics of the organization and the current threat landscape. Based on risk assessment results, an implementation plan for appropriate technical and organizational measures should be developed, such as security policies, access control, data encryption, and incident detection and response systems. It’s also important to establish clear roles and responsibilities for cybersecurity, including appointing a person responsible for contacts with supervisory authorities. Organizations should also review and adapt their contracts with suppliers and subcontractors to ensure compliance with NIS2 requirements throughout the supply chain. Key is also developing and implementing a training and awareness program among employees. Finally, entities should establish processes for regular monitoring, review, and updating of their security measures to ensure their effectiveness in the face of changing threats. Preparing for NIS2 is not a one-time project, but the beginning of an ongoing cybersecurity management process.
In summary, the NIS2 Directive introduces a number of requirements for entities considered essential or important to the EU economy and society. Key areas are cyber risk management, implementing technical and organizational measures, incident reporting, supply chain security, and training and awareness raising.
Entities covered by the directive must conduct regular risk assessments and implement adequate safeguards, such as access control, data encryption, and intrusion detection systems. They must also report serious incidents within 24 hours and manage risks related to suppliers. NIS2 establishes a framework for supervision and enforcement, including severe financial penalties for non-compliance. The directive also emphasizes international cooperation and information exchange between member states.
Member states have until October 17, 2024 to transpose the directive into national law, and entities covered by NIS2 will have additional transitional periods to fulfill some obligations. However, due to the scale and complexity of requirements, it’s worth starting preparations as early as possible.
Preparing for NIS2 is a comprehensive process including risk assessment, implementing security measures, adapting contracts with suppliers, training employees, and establishing processes for continuous monitoring and improvement. This requires engagement of the entire organization and treating cybersecurity as a strategic priority.
The NIS2 Directive is a milestone in building cyber resilience in the EU. Its requirements may be a challenge for many organizations, but the benefits - in the form of better protection against threats, increased customer trust, and operational stability - will certainly be worth it. Effective NIS2 implementation is not only a legal obligation but also an opportunity to strengthen market position and competitive advantage in the era of widespread digitalization.
The requirement that gets checked first
Article 21 lists ten areas, and organisations usually plan them in the order of technical difficulty. Supervisors tend to start elsewhere — with what is easiest to verify from the outside: whether the entity registered, whether an incident reporting procedure exists with named people, and whether the management body has documented training. None of these is expensive; all of them are unambiguous, which is exactly why they are checked first.
Sequencing the programme so those items close early is part of NIS2 compliance.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Wireless Network Security — Wireless network security refers to the measures and practices used to protect…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
Learn More
Explore related articles in our knowledge base:
- What Are the Main Objectives of the NIS2 Directive? - Guide
- What Are the Penalties for Non-Compliance with the NIS2 Directive? Guide to Consequences of Violating New Cybersecurity Regulations
- Which Sectors Are Covered by the NIS2 Directive? Comprehensive Overview of the Expanded Cybersecurity Scope in the EU
- Cybersecurity Threats and Strategies for Local Governments - Comprehensive Guide
- Who Does the National Cybersecurity System Cover? Entities, Operators, Providers and Authorities
Explore Our Services
Need cybersecurity support? Check out:
- NIS2 Compliance - NIS2 directive compliance
- NIS2 Readiness Check - NIS2 readiness assessment
- Security Audits - comprehensive security assessment
Related topics
See also:
