What is the NIS2 directive
The NIS2 Directive (Directive (EU) 2022/2555) is the European framework for a high common level of cybersecurity. It replaced the first NIS Directive of 2016 and significantly widened the circle of organisations in scope: instead of a narrow list of operators of essential services, it now covers medium-sized and large companies in 18 sectors, plus some entities regardless of size.
As a directive, NIS2 does not apply directly to companies. Each member state transposes it into national law, designates its competent authorities and national CSIRT, and sets details such as registration procedures, transition periods and penalties. Examples of national laws include the ZInfV-1 in Slovenia, the Zakon o kibernetičkoj sigurnosti in Croatia, the NIS2UmsuCG in Germany, the NISG in Austria (updated for NIS2) and Legislative Decree 138/2024 in Italy. The pace of transposition has differed between countries, so check the current national text and regulator for every country where you have entities or customers.
To see quickly whether you are in scope, use the tool on this page. The sections below explain how entities are classified and what the NIS2 requirements mean in practice.
Who is in scope: sector and size
Classification rests on two criteria: the sector you operate in and the size of your organisation. The sectors are listed in two annexes of the directive.
- Annex I (sectors of high criticality): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.
- Annex II (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles), digital providers and research.
Size is assessed using the criteria of Commission Recommendation 2003/361/EC. Data from linked and partner enterprises is taken into account, so a subsidiary of a large group can be in scope even if it is small on its own.
| Size | Employees | Financial thresholds | Annex I | Annex II |
|---|---|---|---|---|
| Large enterprise | 250 or more | turnover above EUR 50 M and balance sheet total above EUR 43 M | essential entity | important entity |
| Medium enterprise | 50 to 249 | turnover and balance sheet total above EUR 10 M | important entity | important entity |
| Small or micro enterprise | fewer than 50 | turnover or balance sheet total up to EUR 10 M | generally not in scope* | generally not in scope* |
* Exceptions apply regardless of size. Qualified trust service providers, top-level domain registries and DNS service providers are generally treated as essential entities. A member state may also designate an entity that is the sole provider of a service essential to society or the economy, or whose disruption would significantly affect public safety. Which public sector bodies are covered at regional and local level is decided by national law.
Essential and important entities: what differs
The substantive obligations are almost the same for both groups. They differ mainly in how they are supervised and in the level of penalties.
| Area | Essential entity | Important entity |
|---|---|---|
| Risk management measures (Article 21) | yes | yes |
| Reporting of significant incidents | 24 hours / 72 hours / 1 month | 24 hours / 72 hours / 1 month |
| Supervision | proactive (inspections and audits, also without a trigger) | reactive (typically after an incident or complaint) |
| Maximum fine under the directive | at least EUR 10 M or 2% of worldwide annual turnover | at least EUR 7 M or 1.4% of worldwide annual turnover |
| Management accountability | yes | yes |
The directive sets a minimum for the maximum fine, and member states may go higher. For the amounts that apply in your country, check the national law.
NIS2 requirements in practice
Risk management measures. Measures must be proportionate to the risks and follow an all-hazards approach. Article 21 of the directive requires at least:
- policies on risk analysis and information system security,
- incident handling,
- business continuity, backup management, disaster recovery and crisis management,
- supply chain security, including relationships with suppliers and service providers,
- security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure,
- policies to assess the effectiveness of measures,
- basic cyber hygiene practices and training,
- cryptography and encryption policies,
- human resources security, access control and asset management,
- multi-factor authentication and secured communications.
Incident reporting. For a significant incident, you send an early warning within 24 hours of becoming aware, an incident notification with an initial assessment within 72 hours and a final report no later than one month after the notification. These deadlines can only be met with a prepared procedure, defined roles and collected logs. Read more in the guide Cyber attack response plan: how ready is your company.
Management accountability. The management body must approve the risk management measures, oversee their implementation and undergo regular training. Cybersecurity thereby becomes a matter of corporate governance rather than just an IT department task.
Registration. In-scope entities must provide their details to the competent authority and keep them up to date. The procedure and deadlines are set by national law.
ISO 27001, DORA and the supply chain
ISO/IEC 27001 is the international standard for an information security management system. Organisations that already hold it cover a large part of the Article 21 requirements, since both are built on risk management. The certificate alone does not mean NIS2 compliance. Check in particular incident reporting deadlines, management training, supplier requirements and registration.
DORA (Regulation (EU) 2022/2554) applies to financial entities: banks, insurers, investment firms, payment institutions and others. It is the sector-specific rule for ICT risk management and incident reporting, so financial entities meet these requirements mainly under DORA. ICT service providers to financial institutions meet both frameworks through contractual requirements.
Supply chain. Even if you are not directly in scope, you will probably feel the requirements. In-scope entities must manage supplier risk, so they build security requirements, questionnaires and audit rights into contracts. IT, software and maintenance providers are at the front of that queue.
How to start: a five-step plan
- Classification. Use the tool above to estimate whether you are an essential or important entity, then confirm the result against the national law of each country where you operate.
- Gap analysis. Compare existing measures with the Article 21 requirements. If you have ISO 27001, start from the statement of applicability.
- Priority measures. Implement the highest-impact measures first: MFA, immutable backups, vulnerability management and central event logging.
- Incident procedure. Decide who determines whether an incident is significant, who reports and how you will meet the 24-hour and 72-hour deadlines, possibly across several countries.
- Management and suppliers. Organise training for the board and review contracts with key suppliers.
Humanfrog helps organisations with gap analysis, the implementation of technical measures and managed security, including backup in TIER III data centres. To check your starting point, talk to us.
