NIS2 Directive
Also known as: NIS2, NIS 2 Directive, Directive (EU) 2022/2555, EU cybersecurity directive
The NIS2 Directive is the EU's main cybersecurity law for organizations in critical and important sectors, from energy and health care to digital infrastructure, waste management, and manufacturing.
It requires risk management measures, fast incident reporting, and accountability at the top, since management can be held personally responsible. While it replaced a narrower 2016 law, the real change is scale: NIS2 brings many more organizations into scope.
NIS2 Directive, explained at three levels
At home
Think of NIS2 as a safety inspection regime for the plumbing of modern life: power, water, hospitals, transport, internet services, and many factories. Covered organizations must lock their digital doors, have a plan for when something breaks, and warn authorities quickly when an attack hits. The goal is fewer disruptions to the services people depend on every day.
At work
NIS2 is an EU directive that sets cybersecurity duties for medium and large organizations in 18 critical sectors, and for some smaller ones, such as DNS providers. Each member state writes it into national law. Covered organizations must manage cyber risk, report significant incidents quickly, and have leadership oversee security. Businesses care because scope expanded dramatically and executives can be held personally accountable.
At home
NIS2's incident reporting works like a staged alarm. Within 24 hours of becoming aware of a significant incident, an organization sends an early warning to its national CSIRT or authority, flagging whether it may be malicious or cross-border. Within 72 hours comes a fuller notification with an initial assessment, and within a month a final report on causes and fixes. Organizations may also have to tell their customers when the incident affects them.
At work
NIS2 sorts organizations into 'essential' and 'important' entities, mainly by sector and size, with medium enterprises starting at 50 employees or more than €10 million in turnover. Article 21 lists the minimum measures: risk analysis, incident handling, business continuity and backups, supply chain security, secure development, vulnerability handling, cryptography, access control, multi-factor authentication, and cyber hygiene training. Essential entities face proactive supervision and audits, while important entities are mainly checked after an incident or complaint.
At home
Under NIS2, management bodies must approve cybersecurity risk measures, oversee how they are carried out, and take regular training, and they can be held liable for failures. For essential entities, authorities can even temporarily bar a chief executive from managerial duties. While that may sound harsh, in my opinion personal accountability is the directive's biggest change, because it moves cybersecurity from the IT budget into the boardroom's risk agenda.
At work
Fines can reach €10 million or 2% of global turnover for essential entities and €7 million or 1.4% for important entities. Because NIS2 is a directive, national laws differ on registration, sector scope, and supervision, so multinationals need a country-by-country view, though digital providers such as cloud and DNS services are mostly regulated where their EU headquarters sits. Supply chain duties push security requirements onto vendors, including non-EU suppliers, through contracts and audits.
Real-world examples
At home
Fatima's local hospital in Belgium had to delay some appointments after a ransomware attack. Under NIS2, the hospital reported the incident to national authorities within 24 hours, and the national cybersecurity centre helped coordinate the response.
At work
Thomas is the IT security lead at a mid-sized food manufacturer in Germany. After confirming the company fell under NIS2 as an important entity, he briefed the board, set up an incident reporting process with the 24-hour deadline in mind, and started reviewing supplier security.
How it compares
| feature | NIS2 Directive | Original NIS Directive |
|---|---|---|
| Scope | Many more sectors and medium-sized organizations | Fewer sectors, inconsistently defined |
| Management accountability | Explicit, with training and liability | Not explicit |
| Incident reporting | 24 hours, 72 hours, one month | Without undue delay, less specific |
| Fines | Up to €10 million or 2% of turnover | Set nationally, often low |
| Supply chain | Required to be addressed | Limited |
NIS2 is broader, stricter, and more specific than the original NIS Directive.
For analysts
The 24-hour early warning is the hardest NIS2 requirement to meet in practice. I'd test it with a tabletop exercise: who decides an incident is significant, who files the report, and what happens at 2 a.m. on a Sunday.
History & origin
The original NIS Directive, adopted in 2016, was the EU's first cybersecurity law, but member states applied it inconsistently and it covered too few organizations. NIS2 was adopted in December 2022, with a transposition deadline of October 17, 2024, by which member states had to turn it into national law. Most missed the deadline: in November 2024, the European Commission opened infringement proceedings against 23 member states. National laws arrived through 2025 and beyond. In my view, NIS2's most important clause is the one making senior management responsible for cybersecurity. Technical controls are easy to require. Making leadership care is harder.