NIS 2 Guides

NIS 2 (Network and Information Security Directive 2) is an EU directive establishing cybersecurity requirements for essential and important entities across critical sectors. It expands the original NIS Directive's scope and strengthens security obligations.

NIS 2 applies to medium and large organizations (50+ employees or EUR 10M+ revenue) in 18 sectors including energy, transport, banking, health, digital infrastructure, and ICT service management. Member states may also include smaller critical entities.

Essential entities are in highly critical sectors (energy, transport, banking, health, water, digital infrastructure, space) and face stricter supervision. Important entities are in other critical sectors and have more reactive oversight based on evidence of non-compliance.

Essential entities face fines up to EUR 10 million or 2% of global annual turnover. Important entities face fines up to EUR 7 million or 1.4% of turnover. Management can face personal liability, though specific provisions vary by member state implementation.

NIS 2 entered into force on January 16, 2023, and EU member states had until October 17, 2024 to transpose it into national law. Organizations in scope should already be implementing required measures.

ISO 27001 certification helps demonstrate NIS 2 compliance but doesn't guarantee it automatically. NIS 2 has specific requirements for incident reporting and supply chain security that may go beyond standard ISO 27001 scope.

NIS 2 requires early warning within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month. For incidents affecting service provision, immediate notification may be required.

NIS 2 applies to non-EU companies if they provide services within the EU in covered sectors. Non-EU entities meeting the criteria must designate an EU representative in one of the member states where they offer services.