.svg "ZealiD Logo New (1)"){kind=small}
NIS2 Directive NIS2
The NIS2 Directive is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It requires essential and important entities in listed sectors to manage cybersecurity risk and to report significant incidents. As a directive, it takes effect through national law, which member states were required to apply from 18 October 2024.
What is the NIS2 Directive?
The NIS2 Directive, Directive (EU) 2022/2555 of 14 December 2022, is the EU's general cybersecurity law for organisations in sectors that society depends on. It repealed the first NIS Directive, Directive (EU) 2016/1148, with effect from 18 October 2024 (Article 44).
It does two main things (Article 1). It obliges member states to adopt cybersecurity strategies and to name competent authorities and incident response teams, called CSIRTs. It sets risk-management measures and reporting obligations for entities in the sectors listed in its annexes.
Article 41 gave the member states until 17 October 2024 to adopt and publish national measures, to be applied from 18 October 2024. An organisation's duties therefore come from national law. That law can be stricter, because Article 5 sets a minimum only.
Further reading
Who has to comply with the NIS2 Directive?
Organisations of a type listed in Annex I or Annex II that are at least medium-sized (Article 2(1)). Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. Annex II covers other critical sectors: postal and courier services, waste management, chemicals, food, certain manufacturing, digital providers and research.
The size figures come from the definition of a medium-sized enterprise in Commission Recommendation 2003/361/EC. Some entities are covered whatever their size. Article 2(2) names, among others, providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers.
Every entity in scope is either essential or important (Article 3). Both owe the same security and reporting duties. The table shows where they differ.
| Essential entities | Important entities | |
|---|---|---|
| Who | Annex I entities above the medium-sized ceilings, and qualified trust service providers of any size, among others | Every other Annex I or Annex II entity in scope |
| Supervision | Ongoing: on-site inspections, random checks, regular and targeted security audits (Article 32) | Only once an authority has evidence or an indication of non-compliance: on-site inspections and targeted security audits (Article 33) |
| Maximum fine in national law for breaching the security or reporting duties (Article 34(4) and (5)) | At least EUR 10,000,000 or 2% of the worldwide annual turnover of the undertaking it belongs to, in the preceding financial year, whichever is higher | At least EUR 7,000,000 or 1.4% of the worldwide annual turnover of the undertaking it belongs to, in the preceding financial year, whichever is higher |
Further reading
Does the NIS2 Directive apply to law firms and accounting practices?
Not as such. Neither annex lists legal services, accounting, audit or tax advice, so a firm is not in scope because of its profession. The national law of the country concerned is still the text to check.
Firms are usually reached indirectly, through their clients. Article 21(2)(d) makes supply chain security one of the required measures, including the security-related aspects of an entity's relationships with its direct suppliers or service providers.
A client such as an energy supplier or a hospital may therefore send its advisers a security questionnaire, add security terms to the engagement or ask for evidence of specific controls. The firm answers to its client, and the client answers to the supervisor.
Further reading
What does the NIS2 Directive require from an entity in scope?
It requires appropriate and proportionate technical, operational and organisational measures to manage the risks to the entity's network and information systems (Article 21(1)).
Under Article 21(2), the measures must include at least:
- policies on risk analysis and information system security
- incident handling
- business continuity and crisis management
- supply chain security
- security in acquiring, developing and maintaining systems, including vulnerability handling
- procedures to assess whether the measures are effective
- basic cyber hygiene and training
- policies on cryptography and, where appropriate, encryption
- human resources security, access control policies and asset management
- multi-factor authentication and secured communications, where appropriate
Under Article 20, the management body must approve the measures and oversee their implementation, and can be held liable for infringements. Its members are required to follow cybersecurity training.
Further reading
How quickly must an incident be reported under the NIS2 Directive?
In stages, starting within 24 hours. Article 23 applies to a significant incident: one that causes or can cause severe operational disruption or financial loss for the entity, or considerable damage to others.
The entity sends an early warning to its CSIRT or competent authority within 24 hours of becoming aware of the incident. An incident notification with an initial assessment follows within 72 hours. A final report is due no later than one month after that notification. The authority may ask for an intermediate report in between.
A breach of personal data may have to be reported separately under the GDPR, which the directive leaves untouched (Article 2(12)).
Further reading
Related questions
Does the NIS2 Directive apply to trust service providers?
Yes, whatever their size (Article 2(2)). Qualified trust service providers are essential entities (Article 3(1)). Trust service providers also have a shorter deadline: the incident notification is due within 24 hours, not 72, for incidents that affect their trust services (Article 23(4)). The directive deleted Article 19 of the eIDAS Regulation from 18 October 2024 (Article 42).
What is the difference between NIS2 and DORA?
NIS2 is a directive that covers many sectors. DORA is a regulation for the financial sector alone. Recital 28 of NIS2 treats DORA as the sector-specific act for financial entities, so its rules on ICT risk management, incident reporting, testing and third-party risk apply to them instead of the NIS2 ones under Article 4.
References
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Articles 1, 2, 3, 4, 5, 20, 21, 23, 32, 33, 34, 41, 42 and 44, recital 28, Annexes I and II. European Union, 2022. eur-lex.europa.eu/eli/dir/2022/2555/oj
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Article 1(2). European Union, 2022. eur-lex.europa.eu/eli/reg/2022/2554/oj
Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises. European Commission, 2003.
Regulation (EU) 2016/679 (General Data Protection Regulation). European Union, 2016. eur-lex.europa.eu/eli/reg/2016/679/oj
This article describes Directive (EU) 2022/2555 (NIS2) as adopted at EU level. Each member state implements it in national law, which may differ in detail and go further. It explains the term in general and is not legal advice.
All glossary terms