The Network and Information Security Directive 2 (NIS2) is the EU's most comprehensive cybersecurity law, mandating 10 security measures across 18 critical sectors. In force since October 2024.
NIS2 (Directive EU 2022/2555) replaced the original NIS Directive in January 2023 and member states were required to transpose it into national law by October 2024. It significantly expands the scope of organisations subject to cybersecurity obligations and introduces stricter enforcement mechanisms.
Unlike its predecessor, NIS2 covers both essential and important entities across 18 sectors, imposes personal liability on management, and requires mandatory incident reporting within 24 hours of awareness.
NIS2 Article 21(2) requires all covered entities to implement these 10 minimum cybersecurity risk-management measures. These are the baseline regulators and auditors will assess.
Policies on risk analysis and information system security. Organisations must create governance frameworks, structures, and procedures to analyse cybersecurity risks.
Detection, analysis, containment, recovery and notification procedures for cybersecurity incidents.
Backup management, disaster recovery and crisis management to ensure operational resilience.
Security in supplier relationships and third-party service providers. Includes vulnerability assessments of direct suppliers and their cybersecurity practices.
Security in acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure.
Policies and procedures to regularly assess the effectiveness of the cybersecurity risk-management measures in place.
Basic cyber hygiene practices and cybersecurity training for all staff, including role-based and management-level training.
Policies and procedures regarding the use of cryptography and, where appropriate, encryption of data at rest and in transit.
Human resources security procedures, access control policies, and management of hardware and software asset inventories throughout their lifecycle.
Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems within the entity.
NIS2 covers a far wider range of sectors than its predecessor, affecting an estimated 180,000+ entities across the EU.
Start your free trial today. All 10 measures. All 3 panels. No complexity.