NIS2 Directive: A Practical Compliance Roadmap for Organisations

NIS2: A Significant Expansion

The NIS2 Directive was adopted in December 2022 and required transposition into national law by EU member states by October 2024. It replaces the original NIS Directive from 2016, significantly expanding scope, strengthening requirements, and harmonising enforcement across the EU.

The scope expansion is the most immediate impact. The original NIS Directive applied to Operators of Essential Services in seven sectors. NIS2 expands to cover essential entities in eleven sectors and important entities in seven additional sectors, meaning many organisations not previously subject to NIS requirements now have explicit cybersecurity regulatory obligations.

Essential vs Important Entities

Essential entities in covered sectors are subject to proactive supervision — supervisory authorities can conduct audits and inspections without waiting for incidents. Management bodies bear personal accountability.

Important entities face reactive supervision — authorities investigate following complaints or evidence of non-compliance. The security and reporting obligations are the same; the supervisory approach differs.

Security Measure Requirements

NIS2 requires "appropriate and proportionate technical, operational and organisational measures" to manage cybersecurity risks. Article 21 specifies minimum measures:

• Policies on risk analysis and information system security
• Incident handling processes and procedures
• Business continuity and crisis management including backup management and disaster recovery
• Supply chain security addressing relationships with direct suppliers and service providers
• Security in network and information systems acquisition, development and maintenance
• Policies and procedures to assess the effectiveness of cybersecurity risk management measures
• Cyber hygiene and cybersecurity training
• Policies and procedures regarding the use of cryptography
• Human resources security, access control policies and asset management
• Use of multi-factor authentication or continuous authentication solutions

Incident Reporting Requirements

NIS2 establishes mandatory reporting timelines:

• Early warning within 24 hours of becoming aware of a significant incident
• Incident notification within 72 hours with initial assessment
• Final report within one month with full description, root cause analysis, and implemented measures

A "significant incident" is one that causes or is capable of causing severe operational disruption or financial loss, or that affects other persons by causing significant damage.

Management Accountability

NIS2 introduces explicit personal accountability for management bodies — boards and executive teams are responsible for approving cybersecurity risk management measures and can be held personally liable for infringements. Competent authorities can impose temporary bans on senior management exercising management roles for persistent NIS2 non-compliance.

Building a Compliance Programme

Determine whether you are an essential or important entity; identify your competent national authority; conduct a gap assessment against NIS2 requirements; prioritise remediation based on risk and compliance materiality; establish incident detection and reporting processes; and build the governance framework demonstrating management accountability.