NIS2 Directive — EU Cybersecurity Rules for Essential and Important Entities

The NIS2 Directive (Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union) is the European Union’s most comprehensive and far-reaching cybersecurity law to date. Adopted in December 2022 and transposed into national law by 17 October 2024, NIS2 replaced the 2016 NIS Directive with dramatically expanded scope, significantly stricter obligations, and — for the first time in EU history — personal liability for C-level executives who fail to ensure their organization’s cybersecurity posture.

NIS2 operates on the organisation side of the EU cybersecurity framework: it mandates how companies must manage their own cybersecurity. Its counterpart, the EU Cyber Resilience Act (CRA), operates on the product side — mandating how products must be built. Together, they form the backbone of the EU’s 2030 cybersecurity strategy.

Key Facts

What Changed from NIS to NIS2?

NIS2 is not a minor update — it fundamentally restructured the EU’s approach to organizational cybersecurity:

Who Must Comply? The Entity Classification

NIS2 uses a size-based approach combined with sector classification, moving away from the designation model of the original NIS Directive. This means the vast majority of medium and large organisations in covered sectors must comply — without waiting to be individually designated by national authorities.

Essential Entities — Stricter Supervision Regime

Essential entities face ex ante (proactive) supervision — authorities can audit and inspect without waiting for an incident:

Eleven sectors:

1. Energy (electricity generation, distribution, transmission; oil; gas; hydrogen; district heating/cooling)
2. Transport (air, rail, water, road — including operators, infrastructure managers)
3. Banking (credit institutions)
4. Financial market infrastructures (trading venues, central counterparties)
5. Health (hospitals, healthcare providers, reference labs, pharmaceutical manufacturers, medical device manufacturers covered by critical device categories)
6. Drinking water (suppliers and distributors)
7. Wastewater (collection, disposal, treatment)
8. Digital infrastructure (IXPs, DNS providers, TLD registries, cloud computing, data centres, CDN providers, trust service providers, electronic communication networks)
9. ICT service management (B2B managed service providers, managed security service providers)
10. Public administration (central government bodies)
11. Space (operators of ground-based infrastructure supporting space-based services)

Important Entities — Reactive Supervision Regime

Important entities face ex post supervision — authorities investigate following incidents or complaints:

Seven sectors:

1. Postal and courier services
2. Waste management
3. Chemical manufacturing, production, and distribution
4. Food production, processing, and distribution
5. Manufacturing of medical devices, electronic/electrical equipment, machinery, motor vehicles, other transport equipment
6. Digital providers (online marketplaces, online search engines, social networking platforms)
7. Research organizations (public and private)

Critical for hardware manufacturers: Electronics manufacturers and medical device manufacturers fall into the Important Entities category. A medium or large electronics or IoT hardware manufacturer supplying to sectors covered by NIS2 must assess whether they are directly in scope — and if they supply to Essential Entities, they face significant supply chain security requirements imposed by their customers.

Core Requirements: What NIS2 Demands

1. Risk Management Measures (Article 21)

NIS2 mandates a minimum baseline of cybersecurity risk management measures that all covered entities must implement. These are not optional — they are legal minimums:

Technical and organisational measures:

The measures must be proportionate to the entity’s size, risk exposure, and the cost of implementation relative to the risk — but proportionality does not excuse non-compliance with the listed minimum measures.

2. Incident Reporting (Article 23)

NIS2 tightens incident reporting with a two-stage cascading obligation:

A significant incident is one that:

• Has caused or could cause severe operational disruption or financial loss to the entity, or
• Has affected or could affect other natural or legal persons by causing considerable material or non-material damage.

Special provisions for ICT service providers and trust service providers may shorten reporting windows further.

3. Supply Chain Security (Article 21(2)(d))

NIS2 makes supply chain security a first-class legal obligation for covered entities:

• Entities must assess the cybersecurity practices of direct suppliers and service providers.
• Contracts with suppliers must include cybersecurity clauses specifying required security standards.
• Entities must conduct periodic supplier security risk assessments.
• ENISA and national authorities may issue guidance or requirements on specific supplier categories.

For hardware manufacturers: If your customers include Essential or Important entities under NIS2, they are now legally required to assess your cybersecurity posture as part of their supply chain security obligations. This creates strong market demand for hardware manufacturers to demonstrate auditable security practices — SBOM documentation, vulnerability management programs, and secure development lifecycle evidence. Companies that can provide this evidence as a standard deliverable will have a significant competitive advantage.

4. Management Accountability (Article 20)

NIS2 introduces the most significant governance requirement in EU cybersecurity law history: personal liability for management bodies:

• Management bodies (boards of directors, executive officers) must approve the cybersecurity risk management measures.
• Management bodies must oversee implementation.
• Management body members must undergo cybersecurity training to gain sufficient knowledge to assess cybersecurity risks.
• In the event of a significant incident caused by negligence in cybersecurity oversight, national authorities can:
  • Impose personal fines on responsible management members
  • Issue a temporary prohibition on the individual from holding management roles

This is a fundamental shift: cybersecurity is no longer purely an IT department responsibility. It is now a board-level legal obligation with personal consequences for failure.

NIS2 and Hardware Manufacturers: The Supply Chain Effect

Even if a hardware manufacturer is not directly in scope of NIS2 (e.g., a small company below the size thresholds), NIS2 creates significant market-driven requirements through the supply chain:

Customer-Driven Security Requirements

NIS2-regulated customers are legally required to assess supplier cybersecurity. This means hardware manufacturers will increasingly face:

• Security questionnaires and audits from major customers
• Contractual cybersecurity requirements in supply agreements
• Requirements to provide SBOMs, vulnerability disclosure policies, and security certifications
• Potential loss of contracts if they cannot demonstrate adequate security posture

Harmonised Demand Signal

As NIS2 is harmonised across all 27 EU member states, these requirements apply uniformly — a hardware manufacturer supplying across the EU faces consistent requirements regardless of which country their customer is in.

Medical Device and Electronics Manufacturers

Large manufacturers of medical devices and electronics are directly classified as Important Entities under NIS2. For these companies, compliance is not optional — they are directly regulated.

NIS2 vs. CRA — Different but Complementary

The two most important EU cybersecurity regulations address different dimensions of the same problem:

NIS2 secures organisations. CRA secures the products those organisations build and sell. A company that manufactures connected hardware is simultaneously subject to NIS2 (how it runs its own security) and the CRA (how it designs its products).

Enforcement and Penalties

NIS2 establishes a harmonised enforcement framework across all member states for the first time:

Essential Entities

• Maximum fine: €10,000,000 or 2% of global annual turnover — whichever is higher
• Proactive supervision: authorities can audit without an incident trigger

Important Entities

• Maximum fine: €7,000,000 or 1.4% of global annual turnover — whichever is higher
• Reactive supervision: authorities investigate following incidents

Management Measures

• Personal fines on responsible management members
• Public statement identifying the responsible person and the violation
• Temporary prohibition from holding management functions

Timeline and Current Status

Related Terms

• CRA — The product-focused counterpart to NIS2; hardware manufacturers must comply with both.
• NIS2 — Short-form glossary overview of NIS2.
• ENISA — EU Agency for Cybersecurity, coordinating NIS2 enforcement across member states.
• SBOM — Software Bill of Materials; increasingly required as evidence of supply chain security under NIS2.
• Post-Market Surveillance — Overlaps with NIS2 Article 21 continuous monitoring obligations.
• IoT — Connected IoT devices in supply chains of NIS2-regulated entities face growing security scrutiny.

Hardware manufacturers supplying to NIS2-regulated entities face growing pressure to demonstrate auditable cybersecurity practices. Inovasense helps manufacturers establish the security program evidence that NIS2-regulated customers require: vulnerability management processes, SBOM generation, secure development lifecycle documentation, and embedded security implementations that provide technically verifiable evidence of security measures. Our EU compliance consulting covers the full picture — NIS2 supply chain obligations alongside CRA product requirements.

Official References

• Directive (EU) 2022/2555 (NIS2) — Full text — EUR-Lex, Official Journal of the European Union