Back

NIS-2 Directive — Compliance Guide

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union

What is the NIS-2 Directive?

The NIS-2 Directive (Directive (EU) 2022/2555) is an EU directive that establishes cybersecurity risk management and incident reporting obligations for organizations operating in critical sectors. Adopted on 14 December 2022, it replaces the original NIS Directive (2016/1148) and significantly expands both the scope of covered entities and the stringency of requirements.

Unlike the Cyber Resilience Act (CRA), which targets product manufacturers, NIS-2 targets the organizations operating essential and important services. Its primary goal is to achieve a high common level of cybersecurity across the European Union by harmonizing requirements and strengthening cooperation between member states.

Who Must Comply?

NIS-2 distinguishes between two categories of entities, each with different supervisory regimes and penalty levels.

Essential Entities (Annex I — high-criticality sectors)

Energy (electricity, oil, gas, hydrogen, district heating)
Transport (air, rail, water, road)
Banking and financial market infrastructures
Health (hospitals, laboratories, pharma, medical devices)
Drinking water and waste water
Digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs)
ICT service management (managed service providers, managed security service providers)
Public administration (central government)
Space

Important Entities (Annex II — other critical sectors)

Postal and courier services
Waste management
Chemicals (manufacturing, production, distribution)
Food (production, processing, distribution)
Manufacturing (medical devices, computers, electronics, machinery, motor vehicles)
Digital providers (online marketplaces, search engines, social networking platforms)
Research organizations

Size thresholds: Generally medium+ enterprises (50+ employees OR EUR 10M+ annual turnover). Some sectors — DNS providers, TLD registries, telecommunications, and public administration — apply regardless of size.

Article 21 Security Measures

All essential and important entities must implement risk-based security measures covering at minimum 10 domains defined in Article 21:

1

Risk analysis and information security policies

Establish and maintain a comprehensive risk management framework

2

Incident handling

Procedures for detection, response, and recovery from security incidents

3

Business continuity and crisis management

Backup management, disaster recovery, and crisis management plans

4

Supply chain security

Assess and manage cybersecurity risks in supply relationships

5

Security in network and information systems

Secure acquisition, development, and maintenance practices

6

Vulnerability handling and disclosure

Policies for identifying, managing, and disclosing vulnerabilities

7

Cybersecurity risk assessment effectiveness

Procedures to assess the effectiveness of measures

8

Cybersecurity hygiene and training

Basic cyber hygiene practices and regular training programs

9

Cryptography and encryption

Policies and procedures for the use of cryptography

10

Human resources security and access control

Active directory security, asset management, multi-factor authentication

Incident Reporting

NIS-2 requires a three-stage reporting process for "significant incidents":

Within 24 hours

Early Warning

Early warning to the competent national CSIRT. Must indicate whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have cross-border impact.

Within 72 hours

Incident Notification

Incident notification with initial assessment, including severity, impact, and indicators of compromise where applicable.

Within 1 month

Final Report

Final report with detailed description of the incident, root cause analysis, mitigation measures applied, and cross-border impact if applicable.

What is a "significant incident"? An incident that has caused or is capable of causing severe operational disruption or financial loss, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

National Implementation

NIS-2 is a directive (not a regulation), meaning each EU member state must transpose it into national law. The transposition deadline was 17 October 2024. Status varies significantly by country:

Already transposed

Belgium, Croatia, Czech Republic, Denmark, Finland, Germany, Greece, Hungary, Italy, Latvia, Lithuania, Malta, Romania, Slovakia, Slovenia, Sweden, and others.

In progress

Austria, Bulgaria, Estonia, France, Ireland, Luxembourg, Netherlands, Poland, Portugal, Spain.

Each country designates its own competent authority (e.g., BSI in Germany, ANSSI in France, CCB in Belgium). Registration requirements and deadlines vary by country.

CS Compliance tracks country-specific transposition status and deadlines — see our interactive deadline tracker in the platform.

Management Liability

One of the most significant changes from NIS-1. Under NIS-2:

  • Management bodies of essential and important entities must approve cybersecurity risk-management measures
  • Management must oversee the implementation of these measures
  • Management members must undergo cybersecurity training
  • Management can be held personally liable for failure to comply with these obligations
  • Member states may introduce measures allowing the temporary suspension of managers of essential entities who fail to comply

This represents a paradigm shift: cybersecurity is no longer just an IT issue — it is a boardroom responsibility.

Penalties

Essential entities

Fines up to EUR 10 million or 2% of total worldwide annual turnover (whichever is higher)

Important entities

Fines up to EUR 7 million or 1.4% of total worldwide annual turnover (whichever is higher)

  • Personal liability for management bodies
  • Potential temporary suspension of certifications and authorizations for essential entities
  • Naming and shaming: competent authorities may make compliance failures public

NIS-2 vs CRA

AspectNIS-2 DirectiveCyber Resilience Act
TypeDirective (national transposition)Regulation (directly applicable)
FocusOrganizations operating servicesProducts with digital elements
WhoEssential & important entitiesManufacturers, importers, distributors
RequirementsRisk management, incident reportingProduct security, vulnerability handling
PenaltiesUp to EUR 10M / 2% turnoverUp to EUR 15M / 2.5% turnover

Many organizations will need to comply with BOTH NIS-2 and CRA. CS Compliance supports both frameworks in a single platform.

How to Comply (5 Steps)

1

Determine if you're in scope

Check if your organization falls under Annex I or II sectors and meets size thresholds

2

Register with your national authority

Complete required registration with the competent authority in your country

3

Implement Article 21 measures

Conduct risk assessment and implement the 10 required security domains

4

Establish incident reporting

Set up processes to detect, assess, and report significant incidents within required timelines

5

Train management

Ensure board members and senior management complete cybersecurity training and formally approve risk management measures

Run Your NIS-2 Gap Analysis

CS Compliance helps you assess Article 21 compliance, manage incidents, track governance training, and monitor country-specific deadlines.

Start Free Gap Analysis →
→ Read Cyber Resilience Act GuideLast updated: February 2026
NIS-2 Directive — Compliance Guide | CS Compliance | Compliance Platform