NIS2 Compliance: Changes, Requirements, and Preparation

The Network and Information Systems (NIS) Directive has reshaped the European cybersecurity landscape. With significant potential sanctions and stricter requirements now in effect, navigating NIS2 compliance is more important than ever.

Let’s break it down and explain everything you need to know about NIS2 and its impact on your organization.

NIS2 is the second iteration of the Network and Information Systems Directive. This landmark cybersecurity legislation aimed to establish a higher level of cyber resilience within organizations throughout the European Union (EU), particularly the operators of critical infrastructure and essential services.

NIS2 entered into force on 16 January 2023. As an EU directive, it required each Member State to transpose its requirements into national law. Member States had until October 17, 2024, to do so, and the original NIS Directive was repealed as of October 18, 2024. Covered organizations should consult the applicable national legislation and guidance in each Member State where they operate.

Across the EU, NIS2 aims to boost overall cybersecurity by:

1. Requiring each EU member state to be prepared for an eventual cyber threat with a Computer Security Incident Response Team (CSIRT) and a competent national network and information systems authority.
2. Increasing collaboration among member states by creating a Cooperation Group to exchange information.
3. Fostering a cybersecurity culture across critical infrastructure sectors that rely heavily on information and communication technology (ICT).

In short, NIS2 is designed to ensure relevant entities throughout the EU are prepared to mitigate threats with the appropriate security measures, threat intelligence, and best practices.

The original NIS Directive applied to “operators of essential services” (OES) and “digital service providers” (DSP). NIS2 significantly expanded that scope.

Generally, NIS2 covers medium-sized and larger organizations operating in 18 critical sectors, although certain organizations may fall within scope regardless of size. The Directive divides covered sectors into 11 sectors of high criticality and seven other critical sectors.

Sectors of high criticality include:

• Energy.
• Transport.
• Banking.
• Financial market infrastructures.
• Health.
• Drinking water.
• Wastewater.
• Digital infrastructure.
• ICT service management.
• Public administration.
• Space.

Other critical sectors include:

• Postal and courier services.
• Waste management.
• Manufacture, production, and distribution of chemicals.
• Food production, processing, and distribution.
• Manufacturing.
• Digital providers.
• Research.

Covered organizations are categorized as either essential or important entities. In general, larger organizations in the high-criticality sectors are considered essential entities, while other covered organizations in the sectors listed by the Directive are considered important. Certain entities — including qualified trust service providers, top-level domain name registries, and DNS service providers — are considered essential regardless of size. Member States can also designate additional organizations based on their importance to critical societal or economic activities.

Organizations based outside the EU may also be subject to NIS2 in certain circumstances. Article 26 establishes jurisdiction rules for specific covered entities, including certain digital infrastructure and ICT service providers.

NIS2 represents a marked improvement on the original NIS Directive. Historically, NIS1 was Europe’s first cybersecurity legislation and also aimed to enhance cyber resilience across the region.

Although it successfully triggered a change in mindset and improved data protection, it nevertheless faced challenges. Soon after implementation, there were varying levels of adoption throughout the European Union. Some companies were considered essential in certain countries, but not in others. These inconsistencies resulted in a confusing and fragmented compliance environment.

The threat landscape has also changed dramatically since the original NIS Directive. Organizations now depend on increasingly interconnected cloud services, applications, devices, third parties, and digital identities – expanding the number of access points attackers can target and the potential impact of a successful breach.

Attackers are using more sophisticated techniques to exploit identity and access. Credential theft, account takeover, ransomware, and supply chain attacks remain persistent threats, while AI is making impersonation and social engineering easier to scale. Deepfakes, synthetic identities, and AI-generated phishing can help bad actors pose as legitimate customers, employees, or trusted users to gain access to sensitive systems and data.

These risks make cyber resilience about more than preventing an initial intrusion. Organizations also need strong authentication, visibility and control over cryptographic assets, secure access, and the ability to maintain or restore trusted services when incidents occur. NIS2 reflects that broader reality by raising expectations for risk management, incident response, business continuity, supply chain security, cryptography, and access control.

Against this backdrop — and to address uneven implementation of the original Directive — the EU revised the NIS framework. NIS2 expands coverage and strengthens cybersecurity requirements to better reflect the threats and dependencies organizations face today.

The updated NIS Directive rectifies the deficiencies of its predecessor and significantly increases the size and scale of its reach. Specifically, compared to NIS1, it:

• Expands the scope to include more sectors.
• Imposes harsher sanctions for noncompliance.
• Mandates more stringent cybersecurity requirements.

Let’s take a closer look at the key differences between the first and second NIS Directive.

NIS2 Fines and Penalties

NIS2 establishes stronger penalties and enforcement measures for noncompliance, including:

1. Non-monetary penalties
NIS2 gives national supervisory authorities the power to levy:

• Compliance orders.
• Binding instructions.
• Security audits.
• Threat notification orders.

2. Administrative fines
Exact penalties depend on the national law implementing NIS2, but the Directive establishes minimum levels for the maximum administrative fines available to Member States:

• For essential entities, the maximum fine must be at least €10 million or 2% of total worldwide annual turnover, whichever is higher.
• For important entities, the maximum fine must be at least €7 million or 1.4% of total worldwide annual turnover, whichever is higher.

3. Management accountability
NIS2 also places greater responsibility on management bodies. They must approve cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements under applicable national law.

For essential entities, competent authorities may ultimately seek temporary restrictions on certain managerial functions when serious compliance deficiencies remain unresolved after other enforcement measures have been exhausted. Criminal penalties, where applicable, are established through individual Member States’ national laws rather than imposed universally by NIS2 itself.

Stricter Requirements

NIS2 also significantly increases cybersecurity requirements for in-scope entities Broadly, it mandates early incident reporting, widened risk management, and a series of minimum-security measures.

The new Directive bolsters cyber resilience by introducing obligations across four areas:

Risk Management

Organizations must adopt cybersecurity risk management measures to minimize the likelihood and impact of various cyber threat vectors. More specifically, they must implement technical, operational, and organizational precautions to mitigate risks affecting their network and information systems, thereby enhancing data protection. These may include incident management procedures, stronger supply chain security, access control systems, and encryption.

Corporate Governance

Management bodies are responsible for overseeing and approving their respective organizations' cybersecurity risk management protocols and must ensure they are implemented effectively.

According to Article 20, Member States should “ensure that the members of the management bodies of essential and important entities are required to follow training,” and should encourage them to offer similar training programs to their employees consistently. The aim is to enable everyone in a given organization to identify risks and minimize exposure to the best of their ability.

Incident Reporting

Essential and important entities must establish procedures to promptly report security incidents that significantly affect their service delivery and/or users. NIS2 classifies a “significant” security incident as one that:

• Has caused or can lead to serious operational disruption to a critical sector.
• Has affected or can affect other natural or legal persons by causing considerable damage.

Entities must notify their CSIRT or competent authority with an early warning within 24 hours of becoming aware of a significant incident. They must then submit an incident notification within 72 hours, followed by a final report within one month. Where the incident is still ongoing at that point, a progress report is submitted instead, with the final report due within one month of the incident being handled.

Business Continuity

The revised NIS2 aims to guarantee business continuity after an attack. Entities are required to create a credible strategy detailing their response to and recovery from such incidents, aiming to minimize disruptions swiftly. Consequently, NIS2 requires backup management, disaster recovery, and crisis management procedures.

Article 21 identifies baseline cybersecurity risk-management measures that can serve as a practical NIS2 compliance checklist. Organizations should assess whether they have:

1. Risk analysis and information security policies: Policies for risk analysis and information system security.
2. Incident handling: Processes for identifying, managing, and responding to active cybersecurity threats and incidents.
3. Business continuity: Backup management, disaster recovery, and crisis management procedures.
4. Supply chain security: Measures that address cybersecurity risks involving direct suppliers and service providers.
5. Secure systems: Security throughout network and information system acquisition, development, and maintenance, including vulnerability handling and disclosure.
6. Effectiveness assessments: Policies and procedures for evaluating the effectiveness of cybersecurity risk-management measures.
7. Cyber hygiene and training: Basic cybersecurity practices, awareness, and training.
8. Cryptography and encryption: Policies and procedures governing the appropriate use of cryptography and, where appropriate, encryption.
9. Access and asset management: Human resources security, access-control policies, and asset management.
10. Authentication and secure communications: Multi-factor authentication or continuous authentication and secure voice, video, text, and emergency communication systems where appropriate.

Alongside NIS2, EU operators will have to contend with numerous other regulations, including:

• The Digital Operational Resilience Act (DORA).
• The Critical Entities Resilience (CER) Directive.
• The Cyber Resilience Act (CRA).

How do these legislations overlap? Let’s break down the details:

NIS2 vs. DORA

Both NIS2 and DORA are cybersecurity regulations, but their purposes are slightly different. DORA is specifically focused on the financial sector, whereas NIS2 covers a broader range of organizations.

According to Article 4 of the NIS2 Directive, DORA's provisions related to ICT risk management and reporting, digital operational resilience testing, information sharing, and third-party risk shall apply instead of those outlined in NIS2. In other words, financial entities should refer to DORA for these areas and NIS2 for all other requirements.

Bottom line: for financial entities, DORA acts as the sector-specific framework for these overlapping requirements. Organizations should still assess whether other NIS2 provisions or national implementing laws apply to their activities.

Read our guide to DORA compliance.

NIS2 vs. the CER Directive

The CER Directive applies to critical entities, such as energy and transport providers, guiding their defenses against non-cyber-related risks.

Critical entities should comply with NIS2 when it comes to cybersecurity and the CER Directive for non-cyber incidents.

NIS2 vs. CRA

The Cyber Resilience Act focuses on the cybersecurity of hardware and software products with digital elements, such as Internet-of-Things (IoT) devices. Where NIS2 focuses on enhancing the security posture of companies themselves, the CRA requires companies to prioritize the security of the products they manufacture or sell.

The CRA entered into force on December 10, 2024. Its reporting obligations began applying on September 11, 2026, while its main obligations will apply from December 11, 2027.

Generally, the CRA complements NIS2 rather than replacing it. Depending on their activities, organizations may therefore be subject to both.