NIS2: What It Is and Why Your Company Probably Needs to Comply

NIS2 (Directive (EU) 2022/2555) is the EU's updated cybersecurity directive, and the update is the important part: it covers dramatically more companies than the original NIS directive from 2016 ever did. If your company assumed cybersecurity regulation was something that applied to power grids and hospitals, NIS2 is worth a second look, because the sector list is much longer now, and it includes a lot of ordinary mid-sized companies that don't think of themselves as "critical infrastructure."

Who it actually applies to

NIS2 splits covered organisations into "essential" and "important" entities, mainly by sector and size. Essential entities include energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure (cloud providers, data centres, DNS providers), and public administration. Important entities add postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers (online marketplaces, search engines, social networks), and research.

The size thresholds matter: NIS2 generally applies to medium and large companies (50+ employees or €10M+ annual turnover) in these sectors, though some entities are covered regardless of size if their role is critical enough. If your company sits in one of these sectors and clears that size bar, NIS2 almost certainly applies, whether or not you've been formally notified by a national authority.

What it actually requires

NIS2 isn't a checklist of technical controls; it requires organisations to implement "appropriate and proportionate" risk management measures, but it does name specific areas that have to be covered:

• Risk analysis and information system security policies
• Incident handling, including a genuinely tight reporting timeline: an initial notification to the relevant authority within 24 hours of becoming aware of a significant incident, a fuller report within 72 hours
• Business continuity and crisis management, including backup and disaster recovery
• Supply chain security, meaning your vendors' security posture is now partly your problem
• Security in network and information systems acquisition, development, and maintenance
• Policies on the use of cryptography and encryption
• Basic cyber hygiene and security training

Management bodies also carry personal accountability under NIS2: leadership has to approve the cybersecurity risk management measures and can face liability for non-compliance, not just the organisation.

What happens if you don't

Member states had until 17 October 2024 to transpose NIS2 into national law, and enforcement includes real penalties: up to €10 million or 2% of global annual turnover for essential entities, whichever is higher, and up to €7 million or 1.4% of turnover for important entities. National regulators can also impose binding instructions, audits, and in serious cases, temporary suspension of certification or management responsibilities.

Where this overlaps with what you probably already do

If your company already runs ISO 27001, most of the groundwork transfers directly: risk management, incident response, supply chain oversight, and access control are core to both. NIS2 adds the reporting timeline and the direct management liability, but it rarely means starting a security programme from zero if a reasonable one already exists. The practical work is mapping what you already do against NIS2's specific requirements, finding the gaps, most commonly incident reporting speed and formal supply chain risk assessment, and closing them before an incident forces the question.