NIS 2 compliance: what the directive requires and how to prepare

Who is in scope?

NIS 2 applies to organisations that operate in the EU in one of 18 sectors. It divides them into essential entities (larger organisations in critical sectors) and important entities (smaller or less critical ones). The category changes how you are supervised and fined. The core obligations are the same for both.

If you provide services in the EU in a listed sector and meet the size thresholds, generally 50 or more employees or turnover above €10 million, you are likely in scope. Some entities are in scope whatever their size, including DNS providers, TLD registries and providers of public electronic communications networks.

Each member state must establish a list of the essential and important entities in its jurisdiction. Check your national transposition for the exact scope criteria and how to register.

The risk management measures NIS 2 requires

Article 21 lists the cybersecurity risk management measures that essential and important entities must put in place. They are a minimum. Member states can add to them but cannot remove any.

The measures must be proportionate to the risk, taking into account the entity's size, the likelihood and severity of incidents, and the cost of implementation. Regulators will expect a documented risk assessment that explains why you chose each measure.

• Risk analysis and information system security policies. Written policies that cover your information systems, reviewed regularly.
• Incident handling. Procedures for detecting, managing and responding to incidents, including who does what and when.
• Business continuity and crisis management. Backup management, disaster recovery and crisis management plans. See the business continuity module.
• Supply chain security. Security requirements for your direct suppliers and service providers, including contractual obligations.
• Security in network and information systems acquisition, development and maintenance. Including vulnerability handling and disclosure.
• Assessment of effectiveness. Policies and procedures to check whether your risk management measures work.
• Basic cyber hygiene and training. Cyber hygiene practices and cybersecurity training for staff.
• Cryptography and encryption. Policies on the use of cryptography and, where appropriate, encryption.
• Human resources security, access control and asset management. Who has access to what, and how you manage identities and assets.
• Multi-factor authentication and secured communications. MFA or continuous authentication, and secured voice, video and text communications where appropriate.

Incident reporting in three stages

NIS 2 sets a staged reporting process for significant incidents, and the clock starts when you become aware of one. An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss, or has affected or is capable of affecting other persons by causing considerable material or non-material damage.

Reports go to whichever body your member state designates, either the national CSIRT or the competent authority. If the incident affects more than one member state, the receiving authority informs the others.

The deadlines run from when you become aware of the incident, not from when it started. You can log incidents in Certifyi’s incident management module; confirming which deadlines apply stays with you.

Supply chain obligations that reach your vendors

Article 21(2)(d) makes supply chain security one of the mandatory measures. It covers the relationship between each entity and its direct suppliers or service providers.

In practice you need to assess the security practices of your critical suppliers, put security requirements in their contracts, and check that they keep meeting them. The directive also allows coordinated risk assessments of critical supply chains at EU level.

• Supplier risk assessment. Assess the security of direct suppliers and service providers, in proportion to how critical their service is to you.
• Contractual security requirements. Put cybersecurity obligations in supplier contracts, covering incident notification, access controls and audit rights.
• Ongoing monitoring. Check that suppliers continue to meet the requirements you set. An assessment at onboarding on its own will not satisfy a regulator.
• ICT supply chain considerations. Take account of the overall quality of suppliers’ products and security practices, including how they develop them.

In the vendor risk management module you record supplier intake and risk assessments, and suppliers answer through the vendor portal rather than by email.

What the management body must do

Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk management measures and oversee how they are implemented. They can be held liable for infringements.

The duty cannot be handed off and forgotten. Members of the management body must take part in training, and member states encourage entities to offer similar training to their employees regularly. Staff cyber hygiene and training is also one of the measures every entity must take under Article 21.

Approval

The management body must formally approve the risk management measures the organisation adopts. That means a recorded decision, not assumed agreement.

Oversight

The management body must oversee implementation. In practice: regular reporting to the board, review of risk assessments, and awareness of material incidents.

Training

Members of management bodies must receive cybersecurity training sufficient to identify risks and assess cybersecurity practices. Staff training must also be provided.

Liability

Member states must ensure that management bodies can be held liable for infringements of Article 21. The exact liability mechanisms vary by national transposition.

Supervision, enforcement and penalties

Enforcement is much stronger than under the original directive. Essential entities are supervised more closely than important entities, but both can receive substantial fines.

Competent authorities can also issue binding instructions, order compliance audits and issue warnings. For essential entities they can temporarily suspend part or all of an authorisation. These measures can disrupt a business more than the fine does.

How NIS 2 relates to ISO 27001, DORA and GDPR

NIS 2 is a legal obligation, not a management system standard. It does recognise that standards such as ISO 27001 can help show you meet its risk management requirements. An ISMS gives you the structure, and NIS 2 sets the legal minimum it has to meet.

For financial entities, DORA takes precedence as a sector-specific act. Where DORA applies, its requirements replace the equivalent NIS 2 obligations, so you do not comply with both for the same requirement.

GDPR and NIS 2 overlap on incident notification. A personal data breach may trigger both a GDPR 72-hour notification to the supervisory authority and a NIS 2 24-hour early warning to the CSIRT. These are separate obligations to separate authorities, and each asks for different content.