NIS2 compliance is often treated as an IT security project. It is not. Directive (EU) 2022/2555 makes cybersecurity a duty of the management body, puts a 24-hour clock on incident reporting, and lets supervisors fine an essential entity up to 2% of worldwide turnover. This guide sets out what the directive requires and the order in which a European institution can meet it.
What NIS2 is
NIS2 replaced the 2016 NIS Directive. Member States had to transpose it by 17 October 2024 and apply it from 18 October 2024. Because it is a directive, the obligations that bind you are those in your national law, not the EU text itself. The national laws follow the same structure, which is what this guide follows.
Four obligations carry most of the weight: registration with the competent authority, risk-management measures (Article 21), incident reporting (Article 23) and management accountability (Article 20).
Are you in scope?
The directive covers medium and large entities in the sectors listed in two annexes:
- Annex I — sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.
- Annex II — other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers and research.
Entities are either essential or important. The obligations are largely the same; the difference is supervision, which is proactive for essential entities and after-the-fact for important ones, and the size of the fines. Some entities are in scope regardless of size, including qualified trust service providers, DNS service providers, top-level domain registries and public administration entities as each Member State defines them.
Financial entities covered by DORA apply DORA's ICT risk and incident rules instead of NIS2's equivalent provisions. If you are in both regimes, map which one governs which obligation before you build anything.
The ten minimum security measures
Article 21 requires "appropriate and proportionate" technical, operational and organisational measures, based on an all-hazards approach. It lists ten that must be covered at a minimum:
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity, including backup management, disaster recovery and crisis management.
- Supply chain security, including the security of relationships with direct suppliers and service providers.
- Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of these measures.
- Basic cyber hygiene practices and cybersecurity training.
- Policies and procedures on cryptography and, where appropriate, encryption.
- Human resources security, access control policies and asset management.
- Multi-factor or continuous authentication, secured communications and secured emergency communications where appropriate.
In our experience the supply chain measure takes longest, because it requires knowing every supplier that can touch your operations and in which jurisdiction they sit. This is the same dependency map that digital sovereignty asks for. Build it once and use it for both.
Item 6 is the one most programmes forget. A control set nobody tests is a document, not a measure.
The reporting clock: 24 hours, 72 hours, one month
Article 23 requires entities to notify their CSIRT or competent authority of any significant incident — one that has caused, or can cause, severe operational disruption or financial loss, or considerable damage to others.
- Within 24 hours of becoming aware: an early warning, saying whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact.
- Within 72 hours: an incident notification with an initial assessment of severity, impact and, where available, indicators of compromise.
- Within one month of the notification: a final report with a detailed description, the likely root cause, the mitigation applied and any cross-border impact.
The clock starts at awareness, not at the incident. Write down who decides that an incident is "significant" and who sends the early warning, with a deputy for nights and weekends. If you also report under GDPR, DORA or the EU AI Act, use one incident taxonomy and one timestamp for all of them; the reasoning is in the AI Act and critical infrastructure.
Management bodies are now personally accountable
Article 20 requires the management body to approve the cybersecurity risk-management measures, oversee their implementation, and be held liable for infringements. Members of the management body must follow training, and entities are encouraged to offer similar training to staff.
For essential entities, Article 32 lets authorities, as a last resort, temporarily prohibit a person with managerial responsibility from exercising those functions. The practical consequence: a board needs a short, regular report it can actually challenge, and minutes that show it did.
Supervision and fines
Articles 32 to 34 set the supervisory tools — on-site inspections, security audits, binding instructions — and the minimum maximum fines:
- Essential entities: up to at least €10 million or 2% of total worldwide annual turnover of the undertaking in the preceding year, whichever is higher.
- Important entities: up to at least €7 million or 1.4%, whichever is higher.
Member States may go higher, and may decide whether and how fines apply to public administration entities.
National transposition: check your own law
Transposition was uneven, and several Member States missed the October 2024 deadline. Two examples relevant to our practice:
- Greece transposed NIS2 through Law 5160/2024, with the National Cybersecurity Authority as the competent authority.
- Germany transposed it through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which amends the BSI Act. Entities register with the BSI.
National laws differ on registration deadlines, on how public administration is treated and on reporting portals. Read your national law, and the guidance of your authority, before you set dates.
A 90-day NIS2 compliance plan
Weeks 1–3: scope and register. Confirm whether each legal entity is essential, important or out of scope, and why. Register where required. Name the accountable executive.
Weeks 4–7: gap assessment. Score the current state against the ten Article 21 measures, by evidence, not opinion. Build the supplier and dependency map at the same time.
Weeks 8–10: reporting. Define "significant incident" for your operations, name the people on the 24-hour clock, and run one tabletop exercise end to end.
Weeks 11–13: management body. Board approval of the measures, first training session, and a quarterly report format of no more than four pages.
Frequently asked
What is NIS2 compliance? Meeting the obligations of Directive (EU) 2022/2555 as transposed into national law: registering with the competent authority, taking the risk-management measures in Article 21, reporting significant incidents on the 24-hour, 72-hour and one-month clock in Article 23, and having the management body approve and oversee those measures under Article 20.
Who has to comply with NIS2? Medium and large entities in the sectors listed in Annexes I and II of the directive, plus certain entities regardless of size, such as qualified trust service providers, DNS service providers, top-level domain registries and public administration entities as defined by each Member State.
What are the NIS2 reporting deadlines? An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification.
What are the fines for non-compliance with NIS2? For essential entities, at least up to €10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, at least up to €7 million or 1.4%. Member States may set higher maximums.
Sources
To see where your institution stands, the six dimensions of the UberConsul Resilience Audit give a one-page position you can take to a board or a supervisor. Book a time to discuss it.
This essay is general information, not legal advice. Check the national law that applies to you.
First published October 2026 · Frankfurt am Main.