NIS2 (Directive (EU) 2022/2555) replaced the original NIS directive and expanded EU cybersecurity law from a narrow set of operators to roughly 160,000 organizations across 18 sectors. The transposition deadline passed in October 2024, and through 2025–2026 member-state enforcement has ramped up: national registers opened, competent authorities began supervision, and the first national transposition laws started carrying real penalties. If you operate in the EU in a covered sector and employ 50+ people — or turn over more than EUR 10M — NIS2 almost certainly applies to you.
Essential vs. Important Entities
NIS2 splits in-scope organizations into two classes with the same obligations but different supervision and penalty tiers:
- Essential entities (EE): large organizations (250+ employees or EUR 50M turnover) in Annex I sectors — energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. Essential entities face proactive supervision and fines up to EUR 10M or 2% of global turnover.
- Important entities (IE): medium-sized organizations (50+ employees or EUR 10M turnover) in Annex I, plus medium and large organizations in Annex II sectors — postal services, waste management, chemicals, food, manufacturing, digital providers (marketplaces, search engines, social platforms), and research. Important entities are supervised mainly after incidents, with fines up to EUR 7M or 1.4%.
Some entities are in scope regardless of size: domain-name registries, TLD operators, DNS providers, cloud providers, content-delivery networks, managed service providers, and — under the "single point of failure" logic — any entity whose disruption could have significant impact on public safety or systemic risk.
Article 20: Management Is Personally on the Hook
NIS2's sharpest edge is Article 20: the management body must approve the cybersecurity measures, oversee their implementation, and can be held liable for infringements. Member-state laws can temporarily suspend responsible managers from their functions in cases of non-compliance. This is not an IT problem that can be delegated away — boards are required to understand cyber risk well enough to supervise it, and training for management is explicitly mandated.
Article 21: The Ten Required Measures
All covered entities must implement "appropriate and proportionate" technical, operational, and organizational measures across ten areas:
- Risk-analysis and information-security policies
- Incident handling (prevention, detection, response)
- Business continuity, backup management, disaster recovery, and crisis management
- Supply-chain security — including security of each supplier and service provider
- Security in network and information system acquisition, development, and maintenance — including vulnerability handling and disclosure
- Policies and procedures to assess the effectiveness of the risk-management measures
- Cyber-hygiene practices and cybersecurity training
- Policies on cryptography and, where appropriate, encryption
- Human resources security, access-control policies, and asset management
- Multi-factor or continuous authentication, secured voice/video/text communications, and secured emergency communication systems
Article 23: The Reporting Clock
NIS2 compresses incident notification into tight deadlines — to the national CSIRT or competent authority:
- 24 hours — early warning after becoming aware of a significant incident (also, where feasible, whether it is suspected criminal).
- 72 hours — incident notification with initial assessment: severity, impact, indicators of compromise.
- 1 month — final report: full description, threat type, applied mitigation, cross-border impact.
An incident is "significant" when it causes or can cause severe operational disruption or financial loss, or when it affects other parties. Entities must also notify service recipients of measures they can take in response — and, for certain digital services, of the significant cyber threats they face.
NIS2, DORA, and GDPR: Where the Regimes Overlap
Financial entities already under DORA are covered by its sector-specific rules, which prevail over NIS2 where they overlap. Personal-data breaches still run through GDPR's 72-hour channel in parallel — NIS2 reports go to the CSIRT, GDPR notifications to the data protection authority, and a single incident can trigger both. The practical consequence: incident-response playbooks need parallel reporting lanes, not a single "72-hour rule."
The ISO 27001 Shortcut
Here is the part that saves months: ISO/IEC 27001 covers the large majority of Article 21. Risk-analysis policies map to Clause 6 and the risk assessment process; incident handling to A.5.24–A.5.28; business continuity to A.5.29–A.5.30; supply chain to A.5.19–A.5.23; secure development to A.8.25–A.8.31; cryptography to A.8.24; HR security and access control to A.5.15–A.5.18 and A.6.x; MFA to A.8.5. Our Annex A control reference lists all 93 controls — the mapping is almost one-to-one.
ISO 27001 certification is not automatic NIS2 compliance — the directive adds the reporting clock, management accountability, registration duties, and sector specifics no certificate covers. But an operational ISMS gives you the management system, the Statement of Applicability as your control register, and the audit trail regulators ask for first. Several national transposition laws and supervisory guidance explicitly treat certified ISMSs as strong evidence of Article 21 conformity.
A Practical Sequence
- Confirm scope. Sector, size, and the size-independent categories — or whether a customer in scope pushes obligations onto you through the supply chain.
- Register. Many member states require covered entities to register with the national authority — check your transposition law.
- Brief the board. Article 20 accountability is personal: management needs documented approval and oversight of the measures.
- Baseline against ISO 27001. Run a gap analysis — it doubles as your NIS2 readiness map.
- Build the reporting lane. 24-hour early warning requires detection-to-decision processes that run outside business hours.
- Extend to the supply chain. Supplier security clauses and vendor registers are obligations, not nice-to-haves.
If you want the ISMS-as-evidence approach implemented rather than documented, our GRC & management-system automation service builds the gap analysis, SoA register, and incident-reporting workflows — or request a quote. The NIS2 glossary entry covers the directive's terminology.
Frequently Asked Questions
Is my company in scope for NIS2?
If you operate in an Annex I or II sector in the EU and have 50+ employees or over EUR 10M turnover, yes. Digital infrastructure, cloud, DNS, and managed-service providers are covered regardless of size — and even a small company can be designated by a member state as critical to public safety or systemic resilience.
Can directors really be held personally liable?
Yes — Article 20 requires the management body to approve the measures, oversee implementation, and train accordingly. National laws implement liability through fines on the entity and, for essential entities, the power to temporarily suspend responsible managers from their functions.
Is ISO 27001 certification enough for NIS2?
Not alone — the directive adds the 24/72-hour reporting regime, registration, management accountability, and sector-specific rules no certificate covers. But a certified ISMS implements most of Article 21 and provides the evidence structure supervisors expect; it is the fastest credible path.
How does NIS2 relate to DORA?
DORA is sector-specific law for financial entities — where the two overlap, DORA prevails as lex specialis. Banks, insurers, and CASPs follow DORA's testing, incident, and register regimes; their non-financial group entities may still sit under NIS2.
What if an incident is also a personal-data breach?
Both regimes apply in parallel: report the significant incident to the CSIRT under NIS2's 24/72-hour clock and the personal-data breach to the data protection authority under GDPR's 72-hour rule. Plan for two lanes, not one.
