NIS2 Directive — operationalised.

Who is in scope

NIS2 distinguishes between Essential entities (Annex I — energy, transport, banking, health, water, digital infrastructure, public administration, space) and Important entities (Annex II — postal, waste, chemicals, food, manufacturing, digital providers, research). Size thresholds are medium (50+ staff, €10M+ turnover) and large (250+ staff, €50M+ turnover), with mandatory inclusion for some sub-sectors regardless of size.

• ›Essential entities: ex-ante and ex-post supervision
• ›Important entities: ex-post supervision after incident or indication
• ›Same baseline security obligations apply to both tiers

Article 21 — security measures

All entities must implement a baseline of technical, operational and organisational measures, proportionate to risk, covering ten domains.

• ›Risk analysis and information system security policies
• ›Incident handling (prevention, detection, response)
• ›Business continuity, backups and crisis management
• ›Supply chain security including direct supplier relationships
• ›Security in acquisition, development and maintenance of network and information systems
• ›Policies and procedures to assess effectiveness of cybersecurity risk-management measures
• ›Basic cyber hygiene practices and cybersecurity training
• ›Cryptography and, where appropriate, encryption
• ›Human resources security, access control and asset management
• ›Multi-factor authentication, secured voice/video/text and secured emergency communications

Article 23 — incident reporting

Significant incidents must be notified to the national CSIRT or competent authority on a strict three-step cadence.

• ›Early warning within 24 hours of awareness — including suspected malicious cause and any cross-border impact
• ›Incident notification within 72 hours — initial assessment, severity, impact and indicators of compromise
• ›Final report within 1 month — root cause, mitigations applied and cross-border effects
• ›Intermediate report on request and a progress report if the incident is ongoing at the one-month mark

Article 20 — management accountability

Management bodies must approve cybersecurity risk-management measures, oversee their implementation, and can be held personally liable for infringements. Members of management bodies are required to follow training and are encouraged to offer similar training to employees on a regular basis.