The NIS2 Directive (Network and Information Security Directive 2) is the EU's most significant cybersecurity legislation to date. It dramatically expands the scope of organisations that must comply with mandatory cybersecurity measures and incident reporting requirements.
Who Does NIS2 Affect?
NIS2 covers "essential entities" (energy, transport, health, banking, digital infrastructure) and "important entities" (manufacturing, food, chemicals, waste management, postal services, and digital providers). This includes any medium or large enterprise in these sectors operating in the EU.
Key Compliance Requirements
- Risk management: Implement risk-based cybersecurity measures including supply chain security
- Incident reporting: Report significant incidents within 24 hours (early warning) and 72 hours (full notification)
- Security audits: Conduct regular security audits and vulnerability assessments
- Business continuity: Implement business continuity and crisis management plans
- Training: Provide cybersecurity training for management and employees
- Encryption: Use end-to-end encryption and multi-factor authentication where appropriate
Penalties for Non-Compliance
The fines under NIS2 are substantial:
- Essential entities: Up to €10 million or 2% of global turnover (whichever is higher)
- Important entities: Up to €7 million or 1.4% of turnover
- Personal liability: Management can be held personally liable for non-compliance
⚠️ Important: Unlike GDPR, NIS2 puts personal liability on company management. Board members and C-suite executives can face individual sanctions if cybersecurity governance is found lacking.
Practical Steps to Prepare
- Scope determination: Determine whether your organisation falls under NIS2 scope (sector + size test)
- Gap analysis: Conduct a gap analysis against NIS2 requirements using frameworks like ISO 27001
- Incident response: Establish an incident response and reporting framework with clear escalation paths
- Supply chain review: Review and secure your supply chain — you're responsible for third-party risks
- Board training: Train your board and senior management on cybersecurity governance
- National authority: Engage with your national competent authority for sector-specific guidance
NIS2 vs GDPR: Key Differences
| Aspect | NIS2 | GDPR |
|---|---|---|
| Focus | Cybersecurity | Data Privacy |
| Reporting | 24h + 72h | 72h |
| Personal liability | Yes (management) | Organisation only |
💡 Key Takeaway: NIS2 compliance isn't optional. Start with a gap analysis, prioritise incident response capabilities, and ensure your board understands their personal accountability.
