Skip to main content
Policy Authority
Category: Regulatory Compliance

NIS2 Directive

Also known as: NIS2, Network and Information Systems Directive 2, Network and Information Security Directive 2, Directive (EU) 2022/2555
Simply put

NIS2 is a European Union law aimed at strengthening cybersecurity across the EU. It is the updated version of the earlier NIS Directive and applies to organizations operating in a range of critical sectors. It sets expectations for how these organizations protect their network and information systems.

Formal definition

NIS2 (Directive (EU) 2022/2555) is an EU directive that establishes a unified legal framework for cybersecurity across critical sectors within the European Union, replacing the original NIS Directive (Directive (EU) 2016/1148). As a directive, it sets obligations that EU Member States are required to transpose into their respective national laws, meaning specific implementation details, thresholds, and enforcement mechanisms can vary by Member State. According to the European Commission, its scope covers 18 critical sectors and it calls on Member States to take corresponding measures. This entry describes the instrument's purpose and scope at a high level; it does not cover sector-specific applicability determinations, national transposition specifics, or legal advice on individual compliance obligations, which depend on jurisdiction and organizational circumstances.

Why it matters

NIS2 represents a significant expansion of the European Union's approach to cybersecurity regulation. As the successor to the original NIS Directive (Directive (EU) 2016/1148), it establishes a unified legal framework intended to raise the level of cybersecurity across critical sectors within the EU. For organizations operating in the covered sectors, NIS2 signals that cybersecurity is treated not merely as an operational concern but as a matter of legal compliance subject to Member State enforcement.

Because NIS2 is a directive rather than a directly applicable regulation, its practical significance depends heavily on how each EU Member State transposes it into national law. Specific implementation details, thresholds, and enforcement mechanisms may vary across jurisdictions. This means that an organization operating in multiple Member States may face differing obligations depending on where it operates, making jurisdictional awareness an important part of any compliance assessment. Organizations should not assume that a single, uniform set of requirements applies EU-wide.

The European Commission describes NIS2's scope as covering 18 critical sectors, reflecting a broader reach than the earlier NIS Directive. Determining whether a particular organization falls within scope, and what obligations follow, requires a sector-specific and jurisdiction-specific analysis that is beyond the level of this entry. Compliance and legal teams typically treat scope determination as an early and consequential step, since it drives the subsequent assessment of applicable measures.

Who it's relevant to

Compliance officers
Compliance professionals in organizations operating within the EU's covered critical sectors need to understand NIS2's scope and how it has been transposed in the relevant Member States. Because obligations are defined through national transposition, compliance teams should treat scope and applicability determination as jurisdiction-specific exercises rather than assuming uniform EU-wide requirements.
Risk managers
Risk managers may find NIS2 relevant when assessing cybersecurity-related uncertainty affecting organizational objectives in the covered sectors. The directive frames cybersecurity as a regulated area, which can inform how cyber risk is identified, assessed, and treated, though the specific measures depend on national law and organizational circumstances.
Legal and regulatory specialists
Legal specialists advising organizations in the EU are positioned to interpret how Directive (EU) 2022/2555 has been transposed in particular Member States, since implementation details, thresholds, and enforcement mechanisms can vary. This entry does not constitute legal advice, and applicability determinations require jurisdiction-specific analysis.
Governance professionals
Those responsible for governance structures and decision rights may need to consider how NIS2 obligations are assigned and overseen within the organization, particularly given that enforcement mechanisms are established at the Member State level. The directive's emphasis on cybersecurity across critical sectors can influence how oversight responsibilities are structured.

Inside NIS2

Scope and covered entities
NIS2 is a European Union directive that broadens the range of sectors and entities subject to cybersecurity obligations compared with its predecessor. It commonly distinguishes between categories often described as essential and important entities, with the classification typically influenced by sector, size, and criticality. Because it is a directive rather than a regulation, its precise application depends on how each EU Member State transposes it into national law, and specific thresholds may vary by jurisdiction.
Cybersecurity risk-management measures
The directive typically requires covered entities to adopt appropriate and proportionate technical, operational, and organizational measures to manage risks to network and information systems. These commonly address areas such as risk analysis and information system security, incident handling, business continuity, and supply chain security, though the detailed implementation is left to entities and to national transposition.
Incident reporting obligations
NIS2 commonly establishes obligations to report significant incidents to designated national authorities or computer security incident response teams, often within a phased timeline. The exact triggers, thresholds, and deadlines depend on the directive's provisions as transposed nationally and should be verified against applicable national law.
Governance and management accountability
The directive commonly emphasizes the role of management bodies in approving and overseeing cybersecurity risk-management measures, spanning the governance pillar of GRC. This reflects an expectation that senior leadership holds accountability for cyber risk oversight rather than delegating it entirely to technical functions.
Supervision and enforcement
NIS2 provides for supervisory activities by competent national authorities and for enforcement mechanisms. The specific supervisory regimes, powers, and any penalties depend on national transposition and jurisdiction; particular figures or amounts are not stated here to avoid inaccuracy.

Common questions

Answers to the questions practitioners most commonly ask about NIS2.

Does NIS2 apply only to organizations in the technology or telecommunications sector?
No. NIS2 is a European Union directive whose scope extends well beyond traditional technology and telecommunications providers. It covers a range of sectors that the directive characterizes as essential or important, which may include areas such as energy, transport, banking, health, water, digital infrastructure, and public administration, among others, subject to how each is defined in the directive and in national transposition. Because NIS2 is a directive rather than a directly applicable regulation, its precise sectoral coverage and thresholds depend on how individual EU Member States transpose it into national law, and the exact categories in scope can vary across jurisdictions. Organizations should assess their status against the applicable national transposing legislation rather than assume the directive is confined to the IT sector.
Is NIS2 simply a compliance checklist that, once met, guarantees an organization is secure?
No. NIS2 sits primarily within the compliance pillar as an obligation to adhere to legal requirements, but meeting its requirements does not guarantee security outcomes. The directive is typically associated with cybersecurity risk-management measures and incident-reporting obligations, and satisfying these creates an expectation of process and diligence rather than an assurance that incidents will not occur. Treating NIS2 as a one-time checklist misreads its nature; the underlying risk-management expectations are ongoing and should be integrated with an organization's broader risk management and governance activities. Compliance status and actual security posture are related but distinct, and one should not be inferred from the other.
How can an organization determine whether it falls within the scope of NIS2?
Scope determination generally begins with identifying the applicable national legislation transposing the directive in each Member State where the organization operates, since NIS2 is a directive implemented through national law. From there, an organization typically examines whether its activities fall within the sectors and categories the directive addresses and whether it meets the relevant size or significance thresholds, which can differ by jurisdiction. Because these determinations depend on jurisdiction-specific transposition, organizations operating across multiple Member States may find their obligations differ. This entry does not provide legal advice; where scope is uncertain, qualified legal counsel familiar with the relevant national implementation should be consulted.
What role do governance structures and senior management play under NIS2?
NIS2 is commonly understood to place emphasis on management-level accountability for cybersecurity risk-management measures, connecting the compliance obligation to organizational governance. In practice, this typically means that decision rights and oversight responsibilities for the relevant measures are assigned within existing governance structures, and that senior management is expected to be informed of and engaged with these obligations. The specific accountability arrangements and any associated consequences are defined by the applicable national transposing law. Organizations often integrate these responsibilities into established governance forums rather than creating parallel structures.
How might NIS2 obligations be integrated with an existing risk management program?
Because NIS2 is commonly associated with cybersecurity risk-management measures, its requirements can often be addressed within an organization's existing risk management framework rather than as a wholly separate exercise. This typically involves mapping the directive's expectations to identified risks, assessing them against the organization's objectives, and treating them through controls that are documented and monitored. Care should be taken to keep the compliance obligation distinct from the risk it addresses: the legal requirement is a driver, while the risk-treatment activity is the management response. This entry does not cover specific tooling or implementation detail, which will vary by organization and jurisdiction.
How should incident-reporting obligations under NIS2 be operationalized?
NIS2 is commonly associated with obligations to report certain significant incidents to designated authorities within specified timeframes, but the precise definitions, timelines, and reporting recipients depend on the applicable national transposing legislation and may vary across Member States. Operationalizing these obligations typically involves establishing internal processes to detect, assess, and escalate qualifying incidents, and to prepare and submit the required notifications to the relevant authority. Because the specific thresholds and deadlines are set by national law, organizations should confirm the exact requirements in each relevant jurisdiction rather than rely on a single standard. This entry does not state specific timeframes or figures, which should be verified against the governing legislation.

Common misconceptions

NIS2 applies uniformly across the EU because it is EU law.
NIS2 is a directive, not a regulation, so it takes effect through transposition into each Member State's national law. Details such as thresholds, reporting timelines, supervisory arrangements, and penalties may differ across jurisdictions, and practitioners should consult the applicable national implementation.
NIS2 is purely a technical or IT security matter.
While it addresses cybersecurity risk-management measures, the directive also commonly places accountability on management bodies for oversight, making it a governance concern as well. It spans the governance, risk, and compliance pillars rather than sitting solely with technical teams.
Complying with NIS2 guarantees that an entity will avoid or prevent cyber incidents.
The directive establishes obligations for proportionate risk-management measures and incident handling, but adopting these measures reduces and manages risk rather than guaranteeing that incidents will not occur. Residual risk typically remains even where required controls are in place.

Best practices

Confirm whether and how the directive has been transposed in each relevant Member State, and rely on the applicable national law rather than the directive text alone for specific thresholds, timelines, and penalties.
Determine whether the organization falls within scope and, if so, its classification, since obligations may differ by sector, size, and criticality across jurisdictions.
Engage the management body in approving and overseeing cybersecurity risk-management measures, documenting accountability at the governance level.
Establish and test incident-handling and reporting procedures aligned to the notification obligations as transposed nationally, including phased reporting timelines where applicable.
Extend risk-management measures to supply chain and third-party dependencies, treating supplier cyber risk as part of the overall risk assessment.
Maintain evidence of proportionate technical, operational, and organizational measures and review them periodically, recognizing that measures manage rather than eliminate residual risk.
Application Security Isn’t Optional Anymore.