NIS2 Directive — Network and Information Security 2
The NIS2 Directive (Directive (EU) 2022/2555) is the European Union’s updated and significantly expanded framework for cybersecurity across critical infrastructure. It replaces the original NIS Directive (2016/1148) with a broader scope, stricter requirements, and harsher penalties — making it the most consequential cybersecurity directive in EU history.
Key Facts
| Detail | Information |
|---|---|
| Full name | Directive (EU) 2022/2555 on measures for a high common level of cybersecurity |
| Replaces | NIS Directive (2016/1148) |
| Transposition deadline | 17 October 2024 |
| Entity registration | Set by national law; directive dates: 17 January 2025 for DNS, cloud, data-centre and similar providers (Art. 27), national entity lists by 17 April 2025 (Art. 3) |
| Scope | 18 sectors (11 in Annex I, 7 in Annex II); an estimated ~160,000 entities in the EU |
| Maximum fine (minimum level) | At least €10 million or 2% of worldwide annual turnover, whichever is higher (essential entities); at least €7 million or 1.4% (important entities) |
| Management liability | Management bodies must approve and oversee cybersecurity measures and can be held liable for infringements (Art. 20) |
What Changed from NIS to NIS2?
| Aspect | NIS (2016) | NIS2 (2022) |
|---|---|---|
| Sectors covered | 7 sectors | 18 sectors |
| Entity classification | Operators of Essential Services (OES) + digital service providers (DSPs) | Essential + Important entities |
| Supply chain security | Not addressed | Mandatory risk assessment |
| Incident reporting | Without undue delay (no fixed deadline) | 24h early warning + 72h incident notification + final report within 1 month |
| Penalties | Variable by member state | Minimum ceilings: at least €10M / 2% (essential), €7M / 1.4% (important) |
| Management accountability | None specified | Management bodies can be held liable (Art. 20) |
| Enforcement | Compliance checks for OES; ex post for DSPs | Ex ante + ex post supervision (essential); ex post (important) |
Who Must Comply?
NIS2 applies to medium-sized and larger entities in the sectors of Annex I and Annex II. Large Annex I entities are essential; medium-sized Annex I entities and Annex II entities are important (Article 3). Some entities, such as DNS and trust service providers, are covered regardless of size:
Annex I — Sectors of High Criticality
- Energy (electricity, oil, gas, hydrogen, district heating)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Health (healthcare providers, pharmaceuticals, critical medical devices)
- Drinking water and wastewater
- Digital infrastructure (DNS, TLD registries, cloud, data centers, CDNs)
- ICT service management (managed service and managed security service providers)
- Public administration
- Space
Annex II — Other Critical Sectors
- Postal and courier services
- Waste management
- Chemical manufacturing and distribution
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery, motor vehicles)
- Digital providers (online marketplaces, search engines, social networks)
- Research organizations
Core Requirements
1. Risk Management Measures (Article 21)
Organizations must implement at minimum:
- Risk analysis and information system security policies
- Incident handling — detection, response, and recovery
- Business continuity and crisis management — including backup and disaster recovery
- Supply chain security — risk assessment of direct suppliers and service providers
- Security in network and systems acquisition — including vulnerability handling and disclosure
- Cybersecurity training — including for management
- Cryptography and encryption policies
- Human resources security — access control, asset management
- Multi-factor authentication (MFA) and secured communications
2. Incident Reporting (Article 23)
Organizations must report significant incidents to national authorities:
| Step | Deadline | Content |
|---|---|---|
| Early warning | 24 hours | Suspected cause, cross-border impact |
| Incident notification | 72 hours | Assessment of severity, impact, indicators of compromise |
| Final report | 1 month | Root cause, mitigation, cross-border impact analysis |
3. Supply Chain Security
NIS2 explicitly requires entities to assess and manage cybersecurity risks in their supply chain — including hardware suppliers, software vendors, and managed service providers. This means hardware manufacturers supplying to NIS2-regulated entities must demonstrate security practices.
NIS2 vs. CRA — Different but Complementary
| Aspect | NIS2 | CRA |
|---|---|---|
| Target | Organizations | Products |
| Focus | Organizational cybersecurity posture | Product security throughout lifecycle |
| Who complies | Essential and important entities | Manufacturers, importers, distributors |
| Key obligation | Risk management + incident reporting | Security by design + vulnerability management |
NIS2 secures organizations. CRA secures the products they build. Together, they create a comprehensive EU cybersecurity framework.
Related Terms
- EU Cyber Resilience Act (CRA) — Complementary regulation securing products.
- Secure Boot — Technical measure supporting NIS2 compliance.
- IoT — Connected devices within NIS2-regulated supply chains.
Hardware manufacturers supplying to NIS2-regulated entities must demonstrate robust security practices. Our EU compliance consulting helps companies navigate NIS2 supply chain obligations alongside CRA product requirements — with embedded security implementations that provide auditable evidence of cybersecurity measures.
Official References
- Directive (EU) 2022/2555 (NIS2) — Full text — EUR-Lex, Official Journal of the European Union
- NIS2 — European Commission policy page — European Commission, Digital Strategy