What is NIS2?
NIS2 is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union. It replaces the original NIS Directive of 2016. It covers far more entities, harmonizes requirements across the Union and tightens supervision and penalties. Member states had to transpose it into national law by 17 October 2024.
Each member state applies NIS2 through its own national law. That law sets the final list of obligations, the registration deadlines, the competent CSIRTs and the supervisory authorities for each sector, so always check how your country has transposed the directive.
Who does it apply to?
NIS2 divides covered organizations into essential and important entities. The two categories differ in how closely they are supervised and in the level of fines. The directive covers 18 sectors: 11 sectors of high criticality (including energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space) and 7 other critical sectors (including postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research).
As a rule, the directive covers medium and large enterprises: those with at least 50 employees, or with both annual turnover and balance sheet total above EUR 10 million. Some entities are covered regardless of size, for example DNS service providers, top-level domain name registries, trust service providers and entities designated as critical. In practice, requirements also reach smaller suppliers through their customers’ supply chain security obligations.
Key obligations
The core of the directive is Article 21, which requires appropriate and proportionate cybersecurity risk-management measures, and Article 23, which sets out a multi-stage scheme for reporting significant incidents.
- Article 21 measures: risk analysis and information system security policies, incident handling, business continuity and crisis management (backups, disaster recovery), supply chain security, security in the acquisition, development and maintenance of systems, assessment of the effectiveness of measures, cyber hygiene and training, cryptography and encryption, human resources security and access control, multi-factor authentication and secured communications.
- Significant incident reporting: an early warning to the CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month, with a progress report instead if the incident is still ongoing (Article 23).
- Management accountability: management bodies must approve the risk-management measures, oversee their implementation and can be held liable for infringements (Article 20).
- Mandatory cybersecurity training for members of management bodies. Entities are also encouraged to train their employees regularly.
- Registration of the entity with the competent national authority and cooperation with supervisory authorities and CSIRTs as required by national law.
Incident reporting deadlines step by step
The Article 23 reporting scheme applies to significant incidents: those that have caused or are capable of causing severe operational disruption of the services or financial loss for the entity, or that have affected or are capable of affecting other natural or legal persons by causing considerable material or non-material damage. The clock starts when the entity becomes aware of the incident. The procedure must therefore clearly define who decides that an incident is significant, and on what basis, including at night and on weekends.
- Step 1. Early warning, within 24 hours of becoming aware: a short notification to the CSIRT or competent authority stating whether the incident is suspected of being caused by unlawful or malicious acts and whether it could have a cross-border impact.
- Step 2. Incident notification, within 72 hours of becoming aware: an update of the early warning plus an initial assessment of the incident, including its severity and impact and, where available, indicators of compromise.
- Step 3. Intermediate report, on request: status updates during incident handling, if the CSIRT or competent authority asks for them.
- Step 4. Final report, within one month of the incident notification: a detailed description of the incident (severity and impact), the type of threat or root cause, applied and ongoing mitigation measures and, where applicable, the cross-border impact. If the incident is still ongoing at that time, a progress report is submitted instead, and the final report follows within one month of handling the incident.
- In parallel, service recipients: where appropriate, the entity informs the recipients of its services without undue delay about a significant incident likely to adversely affect the provision of those services. For a significant cyber threat, it informs potentially affected recipients about measures they can take themselves.
- Overlapping obligations: if the incident involves personal data, the separate 72-hour GDPR deadline for notifying the data protection authority runs independently. These are two distinct notifications to two different authorities.
Penalties
NIS2 introduces administrative fines comparable to GDPR levels, differentiated by entity category. Supervisory authorities can also issue binding instructions and orders to remedy infringements. For essential entities, they can temporarily suspend a certification or authorization, or temporarily prohibit a person with managerial responsibilities from exercising managerial functions (Article 32).
- Essential entities: fines of up to EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higher.
- Important entities: fines of up to EUR 7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher.
- Personal accountability of managers, including a temporary ban from exercising managerial functions in essential entities.
NIS2 in national law
The NIS2 Directive does not apply to companies directly. It works through national law, and each member state transposes it in its own way. The Article 21 risk-management measures are common to the whole Union, while the formal rules differ from country to country.
National law settles what the directive leaves to member states: how essential and important entities are identified and registered, the deadlines for each obligation, which CSIRT receives incident reports, which authority supervises each sector, and how fines are imposed. For companies this means two layers of work. The first is the security measures, common across the Union. The second is the formalities set by national law, such as registration, contact points, reporting channels and deadlines.
Guardiso covers both layers. The full NIS2 gap analysis asks 204 questions taken directly from the directive, and the compliance module cross-maps NIS2 requirements to ISO/IEC 27001 controls, so work done in your information security management system counts toward NIS2.
How to prepare in 90 days
Full NIS2 compliance is a program measured in months, but a solid foundation, one that survives a first inspection and a real incident, can be built in three months, working in 30-day stages. The order matters: first, knowledge of your own situation and management accountability; then the processes with hard statutory deadlines; finally suppliers, training and checking that the measures work.
- Days 1 to 30, assessment and foundation: determine your entity status (essential or important) and complete registration; run a gap analysis against the Article 21 measures; assign accountability with a board resolution approving the program and a designated cybersecurity coordinator; inventory key services, systems and assets.
- Days 31 to 60, processes with hard deadlines: adopt the security policy and risk assessment methodology and perform the first assessment; implement the incident handling and reporting procedure with the 24-hour, 72-hour and one-month deadlines (significant incident criteria, on-call arrangements, report templates, contact details of the competent CSIRT); put backups and the business continuity plan in order; enforce multi-factor authentication for remote and administrative access.
- Days 61 to 90, suppliers, people and verification: classify suppliers and add security clauses to contracts; train the board and employees; run a tabletop exercise of the incident reporting process and time the path to the 24-hour deadline; perform the first effectiveness assessment of the measures and present the board with a report and a plan of further actions.
- After 90 days, the system must run in cycles: recurring risk assessments, access reviews, restore tests, annual training and regular board reports. The free NIS2 self-assessment in Guardiso shows your starting point and generates the gap list worth starting from on day one.
How does Guardiso help?
Guardiso guides you through NIS2 compliance from determining your entity category to day-to-day management of the obligations. The free NIS2 qualifier assesses within minutes whether your organization is an essential or important entity and which obligations apply. The full gap analysis covers the directive with 204 questions, and NIS2 requirements are cross-mapped to ISO/IEC 27001 controls, so your existing management system feeds your NIS2 compliance.
For digital service providers, Guardiso offers a dedicated module for Commission Implementing Regulation (EU) 2024/2690, which details the technical requirements for that group. Built-in incident management tracks the 24-hour, 72-hour and one-month deadlines, with ready-made report templates and an incident timeline. The compliance dashboard shows management the current implementation status, which helps document the oversight the directive requires.