What is the NIS2 Directive?
The NIS2 Directive, Directive (EU) 2022/2555, is the EU law that requires essential and important entities in the critical sectors listed in its annexes to manage cybersecurity risk, report significant incidents on fixed deadlines and hold management accountable.
- NIS2 is Directive (EU) 2022/2555, adopted on 14 December 2022; it replaced the first NIS Directive from 18 October 2024.
- It applies to medium and large organizations in the sectors listed in its Annex I and Annex II, sorted into essential and important entities.
- Article 21 sets ten minimum cybersecurity risk-management measures, including incident handling, business continuity and supply chain security.
- Significant incidents follow a 24-hour early warning, a 72-hour notification and a final report within one month.
- Management bodies must approve the measures, oversee them and take cybersecurity training.
NIS2 is the EU law that sets cybersecurity risk-management and incident reporting duties for medium and large organizations in critical sectors, and makes their management bodies accountable for both.
The NIS2 Directive is the European Union law, formally Directive (EU) 2022/2555, that requires medium and large organizations in critical sectors to manage cybersecurity risk and report significant incidents to national authorities.
It was adopted on 14 December 2022 and replaced the first NIS Directive (2016/1148) from 18 October 2024. According to the European Commission, NIS2 came into force in January 2023 and member states had until 17 October 2024 to transpose it, so the exact duties depend on each country's national law.
Why does NIS2 matter?
- It widens EU cybersecurity law from the operators of essential services under NIS1 to essential and important entities across two annexes of sectors.
- It sets fixed reporting deadlines that run from when an entity becomes aware of a significant incident.
- Under Article 20, management bodies approve the risk-management measures, oversee them and must follow training.
Who must comply with NIS2?
NIS2 uses a size-cap rule: in general, medium-sized and larger organizations in a sector listed in Annex I (high criticality, such as energy, transport, banking, health and digital infrastructure) or Annex II (other critical sectors, such as postal services, waste management, chemicals and manufacturing). Some entities are in scope regardless of size. Member states had to list their essential and important entities by 17 April 2025.
| Category | Typical source | Supervision | Maximum fine (Article 34) |
|---|---|---|---|
| Essential entity | Larger entities in Annex I sectors and entities named by a member state | Ex ante and ex post supervision | At least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher |
| Important entity | Other in-scope entities in Annex I and Annex II sectors | Ex post supervision, triggered by evidence of non-compliance | At least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher |
What does NIS2 require?
Article 21 requires proportionate technical, operational and organizational measures that include at least: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; secure acquisition, development and maintenance, including vulnerability handling; assessing the measures' effectiveness; cyber hygiene and training; cryptography; human resources security, access control and asset management; and multi-factor authentication.
Article 23 sets the reporting sequence for a significant incident: an early warning without undue delay and within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification.
For digital infrastructure, ICT service management and digital providers, Implementing Regulation (EU) 2024/2690 sets the technical requirements, and ENISA's NIS2 technical implementation guidance (June 2025) gives examples of evidence.
Related terms
- Cyber risk management
- Incident response
- Supply chain risk management
- Cyber resilience
- Critical or important function under DORA
- NIST Cybersecurity Framework
The requirements and official resources are summarized on the NIS2 (EU 2022/2555) framework page.
Frequently asked questions
What is the difference between NIS and NIS2?
NIS2 replaced the 2016 NIS Directive from 18 October 2024. It covers more sectors, uses a size-cap rule instead of leaving member states to identify operators of essential services, splits entities into essential and important, sets minimum risk-management measures and fixed reporting deadlines, and adds management accountability and higher maximum fines.
What are the NIS2 incident reporting deadlines?
For a significant incident, Article 23 requires an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours that updates the warning with an initial assessment of severity and impact, and a final report no later than one month after the notification. Reports go to the national CSIRT or competent authority.
Does NIS2 apply to companies outside the EU?
It can. NIS2 applies to in-scope entities that provide services or carry out activities in the EU. Under Article 26, digital providers such as cloud, data center and managed service providers that are not established in the EU but offer services there must designate a representative in a member state where they offer those services.
Conclusion
NIS2 sets one EU baseline for cybersecurity risk management, incident reporting and management accountability. Confirm whether your organization is an essential or important entity under each relevant national law, then map your controls to Article 21 and your incident process to the Article 23 deadlines.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.