NIS2 Compliance Consulting
The NIS2 Directive (EU) 2022/2555 is the EU's main cybersecurity law for essential and important entities. It raises the bar on risk management, incident reporting, supply chain security and management accountability. Our NIS2 compliance consulting helps organizations in Europe, and the US, UK and Israeli companies that supply them, find out whether NIS2 applies, close the gaps and prove it to supervisors and customers.
NIS2 applies to medium-sized and large organizations in 18 critical sectors in the EU, and to some smaller ones regardless of size. In-scope entities must adopt the risk management measures in Article 21, report significant incidents within 24 hours (early warning), 72 hours (notification) and one month (final report), and make their management body accountable for cybersecurity. Companies outside the EU are often affected through their EU customers' supply chain requirements.
What is NIS2?
NIS2 replaced the original NIS Directive of 2016. EU member states had to transpose it into national law by 17 October 2024, so the exact obligations, registration steps and supervisors depend on each country's national law. NIS2 widens the scope to many more sectors, removes the old distinction between operators of essential services and digital service providers, and introduces two categories: essential entities and important entities. Both must meet the same security requirements. The difference is in supervision and the level of fines.
Essential Entities
Proactive ex-ante supervisory regime with rigorous oversight audits and higher maximum fines.
Important Entities
Ex-post supervisory regime triggered following cyber incidents, non-compliance signals or complaints.
18 Critical Sectors
Expands coverage across energy, transport, banking, health, manufacturing, digital providers and more.
Uniform Security Rules
Identical baseline risk management requirements across both essential and important categories.
Who does NIS2 apply to?
Sectors of high criticality (Annex I)
energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space.
Other critical sectors (Annex II)
postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, computers, electronics, machinery and vehicles), digital providers (online marketplaces, search engines and social networks) and research.
Size
as a rule, medium-sized and large enterprises, meaning roughly 50 or more employees, or annual turnover and balance sheet total above 10 million euros. Some entities, such as DNS service providers, top-level domain registries and qualified trust service providers, are in scope regardless of size.
Suppliers
if your customers are in scope, Article 21 requires them to manage supply chain security. Expect NIS2 clauses in contracts, security questionnaires and audit rights.
The 10 minimum security measures (Article 21)
| Measure | What it means in practice |
|---|---|
| 1.Risk analysis and information system security policies | A documented, approved risk assessment and security policy set |
| 2.Incident handling | Detection, triage, response and recovery procedures |
| 3.Business continuity | Backup management, disaster recovery and crisis management |
| 4.Supply chain security | Security requirements for suppliers and service providers |
| 5.Security in acquisition, development and maintenance | Secure development, vulnerability handling and disclosure |
| 6.Effectiveness assessment | Policies and procedures to test whether controls work |
| 7.Cyber hygiene and training | Basic hygiene practices and security awareness training |
| 8.Cryptography | Policies on cryptography and, where relevant, encryption |
| 9.Human resources security, access control and asset management | Joiner, mover and leaver processes and an asset inventory |
| 10.Multi-factor authentication and secure communications | MFA or continuous authentication, and secured voice, video, text and emergency communications |
Incident reporting under NIS2 (Article 23)
| Deadline | What to send |
|---|---|
Within 24 hours of becoming aware | Early warning: whether the incident is suspected to be malicious or could have cross-border impact |
Within 72 hours | Incident notification: initial assessment, severity, impact and indicators of compromise where available |
On request | Intermediate report on status updates |
Within one month | Final report: detailed description, root cause, mitigation measures and cross-border impact |
Management accountability and fines
Article 20 requires the management body to approve the cybersecurity risk management measures, oversee their implementation and follow training. Members of the management body can be held liable for infringements under national law.
Maximum administrative fines:
- Essential entities: a maximum of at least 10 million euros or 2% of total worldwide annual turnover, whichever is higher.
- Important entities: a maximum of at least 7 million euros or 1.4% of total worldwide annual turnover, whichever is higher.
Article 20 Liability
Direct Governance Responsibility
Regional Requirements
European Union
Each member state has its own national NIS2 law, competent authority and CSIRT. Registration duties, reporting portals and some definitions differ by country, so a multi-country group needs one control framework with country-specific reporting procedures.
Outside the EU (US, UK, Israel)
NIS2 can apply to non-EU companies that provide certain in-scope services in the EU, and many more are affected as suppliers. We map NIS2 to frameworks you may already have, such as ISO 27001, SOC 2 and NIST CSF, so you reuse existing controls and evidence.
United Kingdom
NIS2 does not apply in the UK, which still operates the NIS Regulations 2018 and is updating them through new cyber security and resilience legislation. UK companies with EU operations or EU customers should plan for both regimes.
Israel
Israeli technology and service providers that sell to EU customers in NIS2 sectors are increasingly asked to prove supply chain security, incident notification and secure development. We combine NIS2 requirements with Amendment 13 and customer frameworks in one program.
How a NIS2 Project Runs
Scoping
confirm whether you are an essential or important entity, in which member states, and which services are in scope.
Gap assessment
compare current controls with Article 21, Article 23 and national requirements.
Remediation plan
prioritized actions, owners and timelines that management can approve.
Implementation
policies, incident reporting procedures, supplier requirements and evidence.
Management training and reporting
brief the management body and set up ongoing oversight.
Readiness review
test the controls and the reporting process before a supervisor or customer audit.
NIS2, DORA and ISO 27001
Financial entities covered by DORA follow DORA as the specific law for ICT risk, which takes precedence over the matching NIS2 requirements. ISO 27001 covers much of Article 21, but it does not cover NIS2 incident reporting deadlines, registration or management body duties on its own. We build one program that maps the overlaps so each control is implemented once.
Related Services & Frameworks:
NIS2 Compliance Consulting
Get Ready for NIS2
Book a free 30-minute call to find out whether NIS2 applies to you and what to fix first.
