What is NIS2? The Complete Guide to the EU NIS2 Directive

The Nisura Team · 19 June 2026

The NIS2 Directive (Directive (EU) 2022/2555) is the European Union’s cybersecurity law that sets a high common level of security for network and information systems across the EU. It requires “essential” and “important” organisations in 18 sectors to put strong cyber-risk-management measures in place, secure their supply chains, and report significant incidents to national authorities — with fines up to €10 million or 2% of global turnover, and personal accountability for senior management, for those that don’t comply.

What is the NIS2 Directive?

NIS2 is the second EU-wide directive on the security of network and information systems. It repeals and replaces the original 2016 NIS Directive (Directive (EU) 2016/1148), which member states applied unevenly and which covered too few organisations. NIS2 dramatically widens the scope, harmonises requirements across the Union, and adds real enforcement teeth — including turnover-based fines and personal liability for company leadership.

Its purpose is simple to state and hard to achieve: raise the baseline of cyber resilience across Europe’s critical and important services, from energy and healthcare to manufacturing and digital providers, and make sure that resilience extends through the supply chain.

When did NIS2 come into force?

NIS2 entered into force on 16 January 2023. EU member states then had until 17 October 2024 to transpose it into national law, meaning the national rules apply from 18 October 2024. The European Commission must review the Directive by 17 October 2027. In practice this means NIS2 is already the law of the land across the EU — enforcement is ramping up, not pending.

Who does NIS2 apply to?

NIS2 uses a “size-cap” rule: it generally applies to medium-sized and large organisations — broadly, 50 or more employees, or more than €10 million in annual turnover — that operate in one of the covered sectors. Member states can also bring smaller, higher-risk entities into scope. Organisations are then classified as either essential or important entities, which determines how strictly they are supervised. Not sure if you qualify? Use our 2-part test to check whether NIS2 applies to your company. In Germany, NIS2 also absorbs and expands the existing KRITIS regime.

The 18 NIS2 sectors

Sectors of high criticality (Annex I): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, and space.

Other critical sectors (Annex II): postal & courier services, waste management, chemicals, food, manufacturing (medical devices, computers & electronics, machinery, vehicles, etc.), digital providers (online marketplaces, search engines, social platforms), and research organisations.

What does NIS2 require? (Article 21)

Article 21 is the heart of NIS2. It requires in-scope entities to take “appropriate and proportionate technical, operational and organisational measures” to manage cyber risk, based on an all-hazards approach. At minimum, that means:

• Risk-analysis and information-system security policies
• Incident handling
• Business continuity — backups, disaster recovery, crisis management
• Supply-chain security — including the security of relationships with direct suppliers and service providers
• Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure
• Policies to assess the effectiveness of risk-management measures
• Basic cyber hygiene and cybersecurity training
• Cryptography and encryption
• Human-resources security, access control, and asset management
• Multi-factor authentication, and secured voice, video and text communications

The supply-chain clause is the one reshaping procurement fastest — we cover it in depth in why mid-market suppliers are losing enterprise contracts under NIS2.

Incident reporting under NIS2

For any incident with a significant impact, NIS2 sets a strict, multi-stage reporting timeline to the national CSIRT or competent authority:

• 24 hours — an early warning from becoming aware of the incident
• 72 hours — a full incident notification with an initial assessment
• 1 month — a final report with a detailed description, root cause, and mitigation

NIS2 penalties and management liability

This is what changes the boardroom conversation. NIS2 caps administrative fines at:

• Essential entities: at least €10,000,000 or 2% of total worldwide annual turnover — whichever is higher
• Important entities: at least €7,000,000 or 1.4% of total worldwide annual turnover — whichever is higher

Crucially, NIS2 makes management bodies personally accountable. Senior leadership must approve and oversee the cybersecurity risk-management measures, undergo training, and can be held liable for failures — and for essential entities, authorities can even temporarily suspend managers from their functions. Cyber risk is now, explicitly, a board-level legal exposure. For the full breakdown — including the non-financial enforcement powers and how fines are calculated — see NIS2 fines & penalties explained.

NIS2 vs the original NIS Directive vs DORA

NIS2 replaces the 2016 NIS Directive, expanding it from a handful of operators to 18 sectors, harmonising requirements, and adding fines and management liability. DORA (the Digital Operational Resilience Act) is a separate, sector-specific regulation for the EU financial sector; where DORA applies, it generally takes precedence over NIS2 for those financial entities (lex specialis). Many organisations will need to consider both — see our full NIS2 vs DORA comparison.

How to comply with NIS2 — and prove it

Compliance is not a one-off audit; NIS2 expects continuous, demonstrable risk management. The practical path: confirm whether you’re in scope, map your external attack surface, close the gaps Article 21 calls out, stand up 24/72-hour incident reporting, and — critically — be able to prove your posture to regulators and to enterprise buyers who are now obligated to audit their suppliers.

This is exactly where Cyber Risk Quantification helps: instead of a static questionnaire, it translates your live security posture into a defensible, board-ready figure and generates supply-chain evidence on demand. See how the Nisura framework automates NIS2 Article 21 evidence, or read why boards are moving from heatmaps to Expected Annual Loss. Check whether NIS2 binds you with the free NIS2 Scope Checker, or run a free simulation to see your projected exposure and NIS2 liability in minutes.

Sources & official references

• European Commission — NIS2 Directive: FAQs and the official Digital Strategy portal
• Commission Guidelines on the application of Article 3(1) and (2) of Directive (EU) 2022/2555 (scope)
• The full legal text — Directive (EU) 2022/2555 on EUR-Lex — and ENISA’s NIS2 implementation guidance