What Is the NIS2 Directive?

The NIS2 Directive is Directive (EU) 2022/2555, the EU framework for strengthening cybersecurity risk management and incident reporting across a wider range of critical and important sectors. It requires covered entities to implement appropriate and proportionate cybersecurity measures, gives management bodies explicit oversight responsibilities, and requires significant incidents to be reported through the applicable national framework.

NIS2 Is an EU Cybersecurity Directive

Directive (EU) 2022/2555
European Union cybersecurity framework
not a voluntary certification standard
national transposition matters

Why the EU Introduced NIS2

higher common level of cybersecurity
critical and important services
cross-border dependencies
operational resilience
more consistent supervision

Which Organisations Can Be Affected

Annex I and Annex II sectors
entity type
organisation size
special inclusion rules
national designation
jurisdiction

What NIS2 Requires Covered Entities to Do

management oversight
cybersecurity risk-management measures
incident handling
business continuity
supply-chain security
security testing
training and access control

Why Incident Reporting Is a Core Part of NIS2

significant incidents
early warning
notification
final report
competent authority or CSIRT
documented decision process

Why National NIS2 Law Still Matters

transposition deadline passed
Member State implementing law
registration mechanisms
competent authority
national guidance
sector-specific details

Frequently asked questions

Is NIS2 the same as ISO 27001?

No. NIS2 is a legal cybersecurity framework created by an EU Directive. ISO 27001 is a management-system standard. Existing ISO 27001 controls may support a NIS2 programme, but certification should not automatically be treated as proof of NIS2 compliance.

Does NIS2 only apply to technology companies?

No. NIS2 reaches multiple critical and important sectors, including areas such as energy, transport, health, digital infrastructure, public administration and specified manufacturing and service activities.

Does every organisation in a covered sector automatically have the same NIS2 status?

No. Scope and classification can depend on the entity type, organisation size, service provided, special inclusion rules, jurisdiction and applicable national law.

Related NIS2 guidance

Official sources

This general editorial guidance does not determine your organisation's legal obligations. Review current official sources, applicable national law and guidance from the relevant competent authority.