The Short Difference Between NIS and NIS2
- broader scope
- essential and important entities
- management accountability
- more explicit cybersecurity measures
- stronger supervision and enforcement
NIS2 Expands and Restructures the Scope Model
- more sectors and entity types
- size-cap approach
- special inclusion rules
- national implementation
- fresh scope assessment required
Essential and Important Entities Replace the Old Classification Logic
- essential entities
- important entities
- shared core obligations
- different supervisory context
- classification evidence
Management Responsibility Is More Explicit Under NIS2
- management approval
- management oversight
- cybersecurity training
- board reporting
- documented governance
NIS2 Sets a More Detailed Cybersecurity Risk-Management Baseline
- risk analysis and security policies
- incident handling
- business continuity
- supply-chain security
- secure development and vulnerability handling
- effectiveness assessment
- cyber hygiene, cryptography and access control
Incident Reporting, Supervision and Enforcement Are Stronger Operational Concerns
- significant-incident reporting workflow
- competent authorities and CSIRTs
- supervisory powers
- evidence requests
- administrative enforcement
What Organisations Moving From NIS to NIS2 Should Recheck
- scope and entity classification
- jurisdiction and registration
- management ownership
- Article 21 control mapping
- incident workflow
- supplier risk
- evidence and audit readiness
Frequently asked questions
Did NIS2 simply rename the original NIS Directive?
No. NIS2 materially changes the scope, classification model, governance expectations, cybersecurity risk-management baseline, incident-reporting framework and supervisory environment.
If an organisation complied with the original NIS Directive, is it automatically compliant with NIS2?
No. Existing controls and procedures can provide a useful foundation, but the organisation should reassess scope, classification, governance, controls, reporting and national requirements against NIS2.
Can an organisation that was outside the original NIS Directive fall within NIS2?
Yes. Because NIS2 broadens and restructures the scope framework, organisations that were not previously covered should still perform a current NIS2 scope assessment.
Related NIS2 guidance
Official sources
This general editorial guidance does not determine
your organisation's legal obligations. Review current
official sources, applicable national law and guidance
from the relevant competent authority.