NIS2: what does it mean for your organization?

The NIS2 Directive replaces the original Network and Information Security Directive and is transposed into national law by each EU member state. Two changes matter more than the rest: many more organizations fall in scope, and responsibility for cybersecurity risk management sits explicitly with management bodies.

Does it apply to you?

Scope is determined by sector and by size. The directive distinguishes essential entities and important entities across sectors including energy, transport, banking, health, water, digital infrastructure, public administration, postal services, waste management, chemicals, food, manufacturing and digital providers. Size thresholds generally bring in medium and large organizations, with exceptions that can capture smaller ones where the service is critical.

Two points are commonly missed. First, national transposition may extend scope beyond the directive's baseline, so the applicable text is your member state's law rather than the directive itself. Second, being out of scope does not mean being unaffected — organizations in scope are required to manage supply chain risk, which reaches their suppliers contractually.

What is actually required

NIS2 sets out risk management measures rather than a control checklist: policies on risk analysis and information system security, incident handling, business continuity and crisis management, supply chain security, security in acquisition and development, policies to assess effectiveness, basic cyber hygiene and training, cryptography, human resources security and access control, and the use of multi-factor authentication.

Alongside these sit reporting obligations. Significant incidents carry an early warning within 24 hours, a fuller notification within 72 hours, and a final report within a month. Meeting those timelines is an operational capability, not a policy statement — it requires someone able to recognise a reportable incident and produce the notification while the incident is still running.

Where to start

Establish scope in writing, against your national law, and record the reasoning. Identify who in the management body carries the accountability, because the directive makes that explicit. Then run a gap assessment against the risk management measures to see what already exists — most organizations have more than they expect, but undocumented and unevidenced.

Prioritise the gaps that are also operational weaknesses rather than the ones that are merely documentation gaps. Incident reporting readiness, multi-factor authentication coverage and supply chain visibility tend to be both.

A note on wording

NIS2 is a regulatory obligation, not a certification. No organization can be "NIS2 certified", and any supplier offering that is describing something else. What you can demonstrate is that you have identified the applicable measures and implemented them.