The NIS2 Directive,
explained plainly

NIS2 is Directive (EU) 2022/2555 — the European Union's framework for a high common level of cybersecurity across the bloc. It replaces the original 2016 Network and Information Security Directive (NIS1), which covered far fewer organizations and left wide gaps between how member states applied it. NIS2 is the EU's answer to a decade of growing attacks on the services that economies and societies depend on.

The crucial thing to understand is that NIS2 is a directive, not a regulation and not a certification. There is no "NIS2 certificate" to earn. A directive sets the outcome the EU wants and leaves each member state to write the national law that delivers it. So in practice you do not comply with NIS2 directly — you comply with your country's national transposition of it, which is where the precise obligations, authorities and penalties actually live.

NIS2 raises the floor in three ways at once: it pulls many more organizations into scope, it spells out the security measures they must take, and it makes senior management answerable for whether those measures happen. The sections below walk through each.

NIS2 sorts in-scope organizations into two classes (essential entities and important entities) and the split largely follows sector and size. The directive lists sectors of high criticality (energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space) and other critical sectors (postal and courier, waste management, chemicals, food, manufacturing, digital providers and research). That is roughly eighteen sectors in total — a dramatic widening from NIS1.

A size cap then decides who is actually caught: as a general rule, medium and large entities operating in those sectors fall in scope, while micro and small entities are usually excluded — though some entity types are in scope regardless of size because of the role they play. The clean way to read it is sector first, then size, then the special cases.

Both classes face broadly the same security and reporting duties. What differs is supervision: essential entities are subject to proactive oversight (authorities can audit them without waiting for something to go wrong) while important entities are supervised reactively, with authorities stepping in when there is evidence of a problem. Either way, the obligations you have to meet are substantially the same.

Article 21 is the heart of NIS2. It requires in-scope entities to take "appropriate and proportionate technical, operational and organisational measures" to manage the risks to their network and information systems, on an all-hazards basis — meaning you account for everything from cyber-attacks to physical and environmental threats, not just hackers.

The directive then names a baseline set of measures every entity is expected to address: risk-analysis and information-security policies; incident handling; business continuity, including backup management and crisis management; supply-chain security; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; policies to assess whether the measures are working; basic cyber-hygiene and training; cryptography and, where appropriate, encryption; human-resources security, access-control policies and asset management; and the use of multi-factor authentication and secured communications.

It is a list a security team will recognize — it lines up closely with established practice and with ISO 27001 controls. What NIS2 adds is the force of law behind it and the expectation that the measures are proportionate to the risk the entity actually carries: a large energy operator and a mid-size manufacturer are held to the same baseline but apply it to very different risk pictures.

NIS2 sets one of the tightest reporting timelines in EU cybersecurity law, and it is the obligation teams most often underestimate. When an incident is "significant" (broadly, one that causes or could cause serious operational disruption or financial loss, or that affects others through material damage) a multi-stage reporting clock starts against your national CSIRT or competent authority.

The stages are fixed. An early warning is due within 24 hours of becoming aware of the significant incident — a short, first notification, flagging whether the incident looks malicious or could have cross-border impact. A fuller incident notification follows within 72 hours, updating the early warning with an initial assessment, severity, impact and any indicators of compromise. A final report is then due within one month, setting out a detailed description, the type of threat or root cause, the mitigation applied and any cross-border effects.

The practical consequence is that NIS2 reporting is not a single form filed after the dust settles — it is a sequence that begins while you are still firefighting. Knowing in advance who declares an incident significant, who drafts the 24-hour warning and where the evidence lives is the difference between meeting the clock and missing it. This is why the directive pushes entities toward having incident handling defined and rehearsed before anything happens.

NIS2 deliberately moves cybersecurity out of the IT department and onto the desk of senior management. Management bodies must approve the entity's risk-management measures, oversee their implementation, and can be held liable for failing to do so. This is not incidental wording — making leadership accountable is one of the changes the directive was written to deliver.

In concrete terms, that means the people running the organization are expected to understand the cyber risks the business carries, sign off on how those risks are treated, and follow appropriate training so they can do that meaningfully. Where national law provides for it, supervisory authorities can hold managers personally responsible — and in serious cases can take measures affecting management directly, not just fine the entity.

For a security lead this is a useful lever rather than a burden: NIS2 gives board attention to security that previously had to be argued for. But it also means the programme has to be legible to leadership — they cannot approve and oversee what they cannot see. A measures-and-evidence picture that a non-specialist board can read is now a compliance requirement, not a nicety.

Because NIS2 is a directive, it only takes legal effect through national implementation. The transposition deadline was 17 October 2024 — by that date member states were required to have adopted national law applying the directive. In practice, several states ran late, so the exact statute, the named competent authority and CSIRT, and the registration and penalty details differ by country and continue to settle.

What this means for you is concrete: the obligations you actually have to meet are written in your member state's NIS2 law, not in the directive itself. Two organizations in the same sector in two different EU countries can face the same baseline duties but different reporting portals, registration steps and fine levels. Identify the national implementation that applies to you, and read the directive as the shared backbone underneath it.

For organizations based in Switzerland, NIS2 does not apply directly, but it reaches you the moment you operate in the EU, sit in the supply chain of an in-scope entity, or are asked to evidence equivalent measures by an EU customer. Treating the NIS2 baseline as the bar to clear is increasingly the pragmatic stance for any company doing business across the border.

Supply-chain security is called out explicitly in the Article 21 measures, and it is one of the more demanding parts of NIS2 in practice. In-scope entities have to manage the cybersecurity risks that arrive through their suppliers and service providers (the vulnerabilities, the security practices and the development quality of the vendors they depend on) not just their own systems.

That obligation does not stop at your direct suppliers, and it propagates outward. Because in-scope entities must vet the security of the companies they rely on, organizations that are not themselves caught by NIS2 increasingly feel it anyway — as the security questions, contractual clauses and evidence requests that flow down from in-scope customers. For many smaller vendors, the first encounter with NIS2 is a customer asking them to demonstrate the baseline, which is its own reason to have a managed programme to point to.

These two are complementary, not alternatives, and teams routinely run both. ISO 27001 is a voluntary international standard you can certify against; NIS2 is mandatory EU law you comply with through your national transposition. You can hold an ISO 27001 certificate and still have NIS2 obligations, and meeting NIS2 does not earn you a certificate.

The good news is the overlap is large. The Article 21 risk-management measures map heavily onto ISO 27001's controls — risk analysis, incident handling, business continuity, access control, cryptography, supplier security and the rest are common ground. A working ISO 27001 ISMS gets you a long way toward the NIS2 baseline, and the evidence you maintain for one largely serves the other.

Where NIS2 goes beyond ISO 27001 is in its specifics: the hard 24-hour/72-hour/one-month reporting clock, the registration with a national authority, and the explicit personal accountability of management. The sensible read is to use ISO 27001 as the management-system backbone and layer the NIS2-specific obligations (reporting, registration, board sign-off) on top, rather than building two programmes side by side.

NIS2 backs its obligations with real supervision and significant penalties, and it asks member states to give authorities teeth. Supervisory authorities can audit entities, demand evidence and information, issue binding instructions, and order an entity to bring its security up to the required level. For essential entities this oversight is proactive; for important entities it is triggered by signs of non-compliance.

The directive sets a framework for administrative fines that national law then puts into figures, with the upper bounds for essential entities set higher than for important ones. Beyond fines, the more pointed consequence is the personal exposure of management and, in serious cases, measures that reach leadership directly. The exact numbers and procedures are defined in each member state's implementation, so the penalty you face depends on the national law that applies to you — read that, not the directive, for the specifics.