Question 1

What is the NIS2 directive?

Accepted Answer

NIS2 (Directive EU 2022/2555) is the EU directive on cybersecurity that replaces the original NIS directive. It introduces stricter security requirements through Article 21, which mandates 10 categories of cybersecurity risk-management measures for essential and important entities across 18 sectors.

Question 2

What does NIS2 Article 21 require?

Accepted Answer

Article 21(2) requires 10 minimum measures: (a) risk analysis and security policies, (b) incident handling, (c) business continuity and crisis management, (d) supply chain security, (e) system acquisition and vulnerability handling, (f) effectiveness assessment, (g) cyber hygiene and training, (h) cryptography policies, (i) HR security, access control and asset management, (j) MFA, secured communications and emergency systems.

Question 3

What are the NIS2 incident reporting deadlines?

Accepted Answer

NIS2 requires a 3-stage incident reporting process: early warning within 24 hours of detection, incident notification within 72 hours with initial severity assessment and indicators of compromise, and a final report within 1 month including root cause analysis and remediation measures applied.

Question 4

What are the penalties for NIS2 non-compliance?

Accepted Answer

Essential entities face fines up to EUR 10 million or 2% of global annual turnover (whichever is higher). Important entities face up to EUR 7 million or 1.4% of turnover. Additionally, management bodies can bear personal liability for failure to comply with cybersecurity risk-management obligations under Article 20.

NIS2 Readiness Assessment

Your NIS2 Readiness Score

Strengths

Areas for Improvement

Need help implementing NIS2 requirements?