NIS2 for European companies – what is actually required of you

The NIS2 Directive (EU 2022/2555) replaces the first NIS Directive and widens the circle of organisations that must meet explicit cybersecurity requirements. The short version: more companies are in scope, the requirements are more concrete, and accountability moves up to management.

Here is what the regulation means in practice — and where you should begin.

Are you in scope?

Two questions decide it: which sector you operate in and how large you are.

Sectors are effectively split into two groups. One covers energy, transport, banking and financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management and space. The other covers postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

On size, the rules generally target medium-sized and large enterprises — but there are important exceptions. Some entities are in scope regardless of size, for example qualified trusted service providers, providers of publicly available electronic communications services and key DNS service providers. Smaller companies can also be in scope if they are the sole provider of a service that is critical to society.

The conclusion: make a documented assessment of sector, size and any special rules. If you are unsure, assume you may be in scope and verify — that is cheaper than discovering it during a supervisory review.

The requirements themselves

NIS2 is not a checklist of products. It is a requirement for a management system for information security, covering these core areas:

• Risk analysis and security policy that is documented and actually followed.
• Incident handling with defined roles, escalation paths and exercises.
• Business continuity — backup, restoration and a plan for keeping critical functions running.
• Supply chain — you are responsible for the security of the suppliers you use, not only your own.
• Vulnerability handling and updates, including a routine for known vulnerabilities.
• Multi-factor authentication and protected communications where relevant.
• Training for management and staff.
• Encryption where appropriate.

Reporting is the hard deadline

Incident reporting is the part most often underestimated, because the clock is against you. A significant incident must be notified in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

In practice that means you cannot invent the routine when the incident happens. You need:

1. A definition of a significant incident, anchored in the business.
2. A named person who can submit the early warning — even at three in the morning.
3. A template and a contact path to the supervisory authority, ready before it is needed.
4. Logging that makes it possible to describe what happened within 72 hours.

Management accountability

One of the most important changes is that management cannot delegate accountability away. Management must approve the risk management measures, oversee their implementation and undergo cybersecurity training. For serious infringements, sanctions can be directed at the organisation — and in some cases at senior individuals.

In practical terms, NIS2 is a management topic, not an IT topic. A good first step is to put cyber risk on the agenda with a standing item: what is our most critical system, what happens if it stands still for 72 hours, and who is accountable?

Where to start

1. Scope assessment. Sector, size and special rules — documented.
2. Gap analysis against the requirements above. Where is there a policy, and where is there only an intention?
3. Incident routine first. It has the hardest deadline and is the cheapest to fix.
4. The supplier list. Which third parties have access to your critical systems, and what security requirements do you impose on them in contracts?
5. Management anchoring. Decisions, responsibilities and training — documented.

Do it in that order. The regulatory requirements are fundamentally the same work that actually reduces risk — the difference is that it must now be documented, owned and demonstrable.