NIS2 Directive — operationalised.
Directive (EU) 2022/2555 — the EU baseline for cyber resilience.
Scope, registration, incident reporting and management accountability for ~160k essential and important entities across 18 sectors.
NIS2 replaces the original NIS Directive and dramatically widens the EU's cybersecurity perimeter. It applies to medium and large entities across 18 sectors — energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space, postal & courier, waste management, chemicals, food, manufacturing of critical products, digital providers and research. Member States were required to transpose NIS2 into national law by 17 October 2024, with active supervision rolling out through 2025 and 2026.
Open NIS2 hub on ENISA- Legal basis
- Directive (EU) 2022/2555
- In force
- 16 Jan 2023
- Transposition deadline
- 17 Oct 2024
- Entities in scope
- ~160,000 across EU-27
- Sectors
- 18 (Annex I & II)
- Max fine — Essential
- €10M or 2% global turnover
- Max fine — Important
- €7M or 1.4% global turnover
What this framework covers
Who is in scope
NIS2 distinguishes between Essential entities (Annex I — energy, transport, banking, health, water, digital infrastructure, public administration, space) and Important entities (Annex II — postal, waste, chemicals, food, manufacturing, digital providers, research). Size thresholds are medium (50+ staff, €10M+ turnover) and large (250+ staff, €50M+ turnover), with mandatory inclusion for some sub-sectors regardless of size.
- ›Essential entities: ex-ante and ex-post supervision
- ›Important entities: ex-post supervision after incident or indication
- ›Same baseline security obligations apply to both tiers
Article 21 — security measures
All entities must implement a baseline of technical, operational and organisational measures, proportionate to risk, covering ten domains.
- ›Risk analysis and information system security policies
- ›Incident handling (prevention, detection, response)
- ›Business continuity, backups and crisis management
- ›Supply chain security including direct supplier relationships
- ›Security in acquisition, development and maintenance of network and information systems
- ›Policies and procedures to assess effectiveness of cybersecurity risk-management measures
- ›Basic cyber hygiene practices and cybersecurity training
- ›Cryptography and, where appropriate, encryption
- ›Human resources security, access control and asset management
- ›Multi-factor authentication, secured voice/video/text and secured emergency communications
Article 23 — incident reporting
Significant incidents must be notified to the national CSIRT or competent authority on a strict three-step cadence.
- ›Early warning within 24 hours of awareness — including suspected malicious cause and any cross-border impact
- ›Incident notification within 72 hours — initial assessment, severity, impact and indicators of compromise
- ›Final report within 1 month — root cause, mitigations applied and cross-border effects
- ›Intermediate report on request and a progress report if the incident is ongoing at the one-month mark
Article 20 — management accountability
Management bodies must approve cybersecurity risk-management measures, oversee their implementation, and can be held personally liable for infringements. Members of management bodies are required to follow training and are encouraged to offer similar training to employees on a regular basis.
NIS2 readiness tracker — Article 21 & 23
Rate your organisation against each Article 21 security measure and each Article 23 reporting obligation. Scoring updates live and stays on your device. This is an indicative self-assessment, not a legal determination of conformity.
Material gaps against Article 21 and 23. Management liability exposure under Article 20.
Weighted model: Article 21 carries 65% and Article 23 carries 35% of the overall score.
- 23(4)(a)
24-hour early warning - 23(4)(b)
72-hour incident notification - 21(2)(a)
Risk analysis & information system security policies - 21(2)(b)
Incident handling - 21(2)(d)
Supply chain security
Risk analysis & information system security policies
Documented, board-approved policies with a repeatable risk assessment methodology.
Incident handling
Detection, triage, escalation and post-incident review procedures that are exercised.
Business continuity, backup & crisis management
Tested backups, recovery objectives and a crisis management structure.
Supply chain security
Supplier risk tiering, security clauses in contracts and continuous third-party monitoring.
Security in acquisition, development & maintenance
Secure SDLC, vulnerability handling and disclosure across the asset lifecycle.
Effectiveness assessment
Policies and procedures to measure whether the security measures actually work.
Cyber hygiene practices & training
Patching, hardening, least privilege plus recurring role-based awareness training.
Cryptography & encryption policy
Defined algorithms, key management and a roadmap for post-quantum migration.
Human resources security, access control & asset management
Joiner-mover-leaver control, privileged access governance and an accurate asset inventory.
MFA & secured communications
Phishing-resistant MFA and secured voice, video and text communications for crisis use.
24-hour early warning
Ability to notify the CSIRT/competent authority within 24 hours of becoming aware.
72-hour incident notification
Initial assessment, severity, impact and indicators of compromise within 72 hours.
Intermediate / on-request status updates
A named owner able to supply status reports whenever the authority requests them.
One-month final report
Root cause, severity, mitigation and cross-border impact delivered within one month.
Notifying affected recipients
Process to inform service recipients of significant incidents and possible countermeasures.
Incident register & significance criteria
A maintained register plus documented thresholds for what counts as significant.
Get the full NIS2 gap report for your organisation
Our advisors review your ratings against Article 21 and Article 23 and return a prioritised remediation plan with evidence requirements and reporting playbooks.
Regulatory milestones
- 16 Jan 2023NIS2 enters into force
- 17 Oct 2024Member State transposition deadline
- 17 Jan 2025Lists of essential & important entities established
- 2025–2026Active supervision, audits and first sanctions
- 17 Oct 2027First Commission review of NIS2 effectiveness
How TheCyberCo operationalises NIS2
- Scoping assessment — confirm Essential vs Important classification and sector mapping
- Gap analysis against the ten Article 21 measures with prioritised remediation roadmap
- Incident reporting playbooks aligned to the 24h / 72h / 1-month cadence
- Board-level training pack for management accountability under Article 20
- Supply chain due-diligence framework for direct ICT suppliers
- Continuous compliance reporting fed by our SOC telemetry