NIS2 Directive
NIS2 — Directive (EU) 2022/2555 — is the EU’s cybersecurity law for essential and important entities. It mandates risk-management measures, incident reporting with a 24-hour early-warning deadline, and personal accountability for management bodies across 18 critical sectors.
Who it covers
NIS2 dramatically widened the original NIS scope: energy, transport, health, banking, digital infrastructure, ICT service providers, manufacturing, food, waste management, space, and more — split into essential entities (larger, stricter supervision) and important entities. Member states transposed it into national law from October 2024; in Austria it is implemented through the NISG.
Obligations include a defined set of risk-management measures (incident handling, supply-chain security, cryptography, MFA, training), registration with national authorities, and a two-stage incident reporting duty — early warning within 24 hours, full notification within 72 hours.
NIS2 vs DORA
Financial entities are generally carved out because DORA — the sector-specific regulation — takes precedence wherever the two overlap. For everyone else in scope, NIS2 is the baseline, and ISO/IEC 27001 remains the most common framework for structuring the required measures.
Related Standards
- •Directive (EU) 2022/2555 (NIS2)
- •National transposition laws — e.g., Austria NISG 2026
Free Tools & Resources
Products & Services
Need help with this?
We consult and build across all of these domains — tell us what you are working on.