NIS2 turned EU cybersecurity from a rule for designated operators of essential services into a legal duty for most medium and large organisations in critical sectors, with management accountability and a 24-hour reporting clock. Directive (EU) 2022/2555 repealed the first NIS Directive from 18 October 2024 and covers 18 sectors, from energy and health to manufacturing, digital providers and public administration. Obligations reach organisations through national transposition laws, so details differ by country while the core duties do not. This guide covers scope, the two tiers, Article 20 management duties, all ten Article 21 measures, Article 23 reporting, supervision and fines, and transposition as of October 2026. It is written for CISOs, GRC leads, security architects and identity teams who must turn the Directive into controls and evidence.
Key takeaways
- Size and sector decide scope. An entity in an Annex I or II sector that is at least medium-sized and active in the EU is in scope; DNS providers, trust service providers and TLD registries are in scope regardless of size.
- Essential and important entities share the same duties. The tiers differ in supervision (proactive versus after the fact) and maximum fines (at least EUR 10 million or 2% versus EUR 7 million or 1.4% of worldwide turnover).
- The board owns it. Article 20 requires management bodies to approve and oversee the measures and to follow training, and makes them liable for infringements.
- Article 21 is a minimum list. Ten measures from (a) risk analysis to (j) multi-factor authentication, applied on an all-hazards basis; Implementing Regulation (EU) 2024/2690 spells them out for digital providers.
- Reporting runs on three clocks. Early warning within 24 hours of awareness of a significant incident, notification within 72 hours, and a final report within one month.
Who is in scope: the size-cap rule and the two tiers
Article 2(1) applies NIS2 to entities "of a type referred to in Annex I or II" that qualify as medium-sized enterprises under Commission Recommendation 2003/361/EC, or exceed those ceilings, and that provide services or carry out activities in the Union. Medium-sized starts at 50 staff, or more than EUR 10 million in both turnover and balance sheet, assessed at undertaking level with partner and linked enterprises counted, so a 40-person subsidiary of a large group is usually not "small".
- Regardless of size (Art. 2(2)): public electronic communications providers, trust service providers, TLD name registries and DNS service providers; sole providers of an essential service in a Member State; entities whose disruption could significantly affect public safety, security or health or create systemic risk; entities critical at national or regional level; central government, and regional public administration after a risk-based assessment.
- Optional extensions (Art. 2(5)): local public administration and education institutions, especially those doing critical research.
- Exclusions (Art. 2(7)): public administration in national security, public security, defence or law enforcement.
| Annex | Sectors |
|---|---|
| Annex I (high criticality) | Energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs, trust services, public electronic communications); ICT service management (business to business MSPs and MSSPs); public administration; space |
| Annex II (other critical) | Postal and courier; waste management; chemicals; food; manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles, other transport equipment); digital providers (online marketplaces, search engines, social networks); research |
| Question | Essential entity (Art. 3(1)) | Important entity (Art. 3(2)) |
|---|---|---|
| Typical profile | Annex I entity above the medium-sized ceilings; QTSPs, TLD registries and DNS providers of any size; medium-sized public e-comms providers; designated public administration; critical entities under the CER Directive (EU) 2022/2557 | Any other in-scope Annex I or II entity, including medium-sized Annex I entities and Annex II entities not designated essential |
| Article 21 and 23 duties | Full | Full (same list) |
| Supervision | Proactive (Art. 32) | Reactive (Art. 33), on evidence of non-compliance |
| Maximum fine (Art. 34) | At least EUR 10,000,000 or 2% of worldwide annual turnover, whichever is higher | At least EUR 7,000,000 or 1.4%, whichever is higher |
Registration and jurisdiction
- National lists: Article 3(3) required Member States to list essential and important entities by 17 April 2025 and review the lists at least every two years.
- What you submit (Art. 3(4)): name, address and contact details including email addresses, IP ranges and telephone numbers, sector and subsector, and the Member States where you provide in-scope services. Notify changes within two weeks. National CSIRTs use these details to warn you, so treat them as a controlled record.
- Jurisdiction: generally the Member State of establishment, but DNS, TLD, cloud, data centre, CDN, MSP, MSSP and digital providers fall under the Member State of their EU main establishment (Art. 26).
Article 20: management body accountability and training
Article 20(1) requires management bodies to "approve the cybersecurity risk-management measures" taken under Article 21, oversee their implementation, and states that they "can be held liable for infringements". Article 20(2) says members of management bodies "are required to follow training", and that entities should be encouraged to offer similar training to employees regularly.
- Approval needs a record: minutes approving the risk-management policy and Article 21 measures, with a named owner and review date.
- Oversight needs reporting: a recurring report on risk posture, audit findings, significant incidents and remediation, using the metrics below.
- Training needs substance: the aim is that directors can identify risks and judge the entity's practices and their impact on its services, so use scenarios on your own services, and keep attendance per director.
- Sanctions reach individuals: for essential entities, Article 32(5) allows, as a last resort, a temporary ban on a person exercising managerial functions at chief executive or legal representative level. See the Board and CISO Briefing.
Article 21: the ten risk-management measures
Article 21(1) requires "appropriate and proportionate technical, operational and organisational measures", considering the state of the art, standards and cost, and proportionate to exposure, size, and the likelihood and severity of incidents. Article 21(2) requires an all-hazards approach and lists the minimum measures. For DNS, TLD, cloud, data centre, CDN, MSP, MSSP, marketplace, search, social network and trust service providers, Implementing Regulation (EU) 2024/2690 sets detailed requirements in a 13-section Annex. Other sectors are not bound by it, but it is the most precise public statement of what "appropriate" means, and ENISA's June 2025 technical implementation guidance adds examples of evidence and a mapping table.
| Art. 21(2) | Measure (Directive wording) | IR 2024/2690 Annex | Evidence an auditor will ask for |
|---|---|---|---|
| (a) | Policies on risk analysis and information system security | 1, 2 | Approved policy, risk methodology, risk register, treatment plan |
| (b) | Incident handling | 3 | Procedure, classification criteria, monitoring, post-incident reviews |
| (c) | Business continuity, such as backup management and disaster recovery, and crisis management | 4 | BCP and DR plans, restore test results, crisis roles |
| (d) | Supply chain security | 5 | Supplier inventory by criticality, contract clauses, assessments |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | 6 | Secure development policy, patch SLAs, scan reports, disclosure policy |
| (f) | Policies and procedures to assess effectiveness | 7 | Audit plan, control testing, KPIs to management |
| (g) | Basic cyber hygiene practices and cybersecurity training | 8 | Hygiene baseline, training records |
| (h) | Cryptography and, where appropriate, encryption | 9 | Cryptography policy, key management |
| (i) | Human resources security, access control policies and asset management | 10, 11, 12 (13 physical) | Screening, leaver records, access reviews, asset inventory |
| (j) | Multi-factor or continuous authentication, secured voice, video and text, secured emergency communications | 11.6, 11.7 | MFA coverage by population, emergency communication plan |
- Supply chain (Art. 21(3)): consider "the vulnerabilities specific to each direct supplier and service provider", the quality of their products and secure development practices, and EU coordinated risk assessments under Article 22(1). Annex section 5.1 adds contract terms: incident notification, audit rights, vulnerability handling, subcontractor requirements and data return or disposal.
- Corrective action (Art. 21(4)): non-compliance must be corrected "without undue delay". A dated gap register is better evidence than a perfect policy set.
- Vulnerabilities (Annex 6.10): monitor CSIRT and supplier channels, scan at planned intervals, fix critical issues without undue delay, and document why where remediation is not needed.
Where identity fits: Article 21(2)(i) and (j)
Two of the ten measures are identity controls, and section 11 of the Implementing Regulation is the most specific identity text in EU cybersecurity law. Use it as the benchmark even if you are not a digital provider.
| IR 2024/2690 Annex | Requirement (summarised) | Practical control |
|---|---|---|
| 11.2 Access rights | Need-to-know, least privilege, separation of duties; adjust on leaving or role change; third-party access limited in scope and duration; register of changes; reviews at planned intervals | Joiner-mover-leaver automation, time-bound supplier access, periodic certification |
| 11.3 Privileged accounts | Strong authentication such as MFA; dedicated admin accounts used only for administration; individualised, restricted privileges; periodic review | Separate admin identities, PAM vaulting, phishing-resistant MFA |
| 11.4 Administration systems | Used only for administration, logically separated, protected by authentication and encryption | Privileged access workstations or jump hosts |
| 11.5 Identification | Unique identities linked to one person; shared identities only when justified, approved and documented; unneeded identities deactivated without delay | An owner for every account, including service accounts and API identities |
| 11.6 Authentication | Strength by asset classification; credentials changed initially, at intervals and on suspected compromise; lockout; end inactive sessions; separate privileged credentials | Secret rotation, session timeouts, leaked credential response |
| 11.7 MFA | MFA or continuous authentication where appropriate, by asset classification | Remote access, email, admin consoles and cloud control planes first |
- Non-human identities count: shared service accounts and long-lived API keys conflict with 11.5 and 11.6. See the Service Account Security Guide.
- MFA and privileged access: see the MFA Guide and the Privileged Access Management Guide.
- Supplier access and reviews: see the Third-Party Access Guide and the Access Reviews Guide.
Article 23: incident reporting
An incident is significant under Article 23(3) if it has caused or can cause "severe operational disruption of the services or financial loss for the entity concerned", or considerable material or non-material damage to others. For entities under Implementing Regulation 2024/2690, Article 3 adds objective triggers: direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower; exfiltration of trade secrets; death or considerable damage to health; or "suspectedly malicious and unauthorised access" capable of causing severe operational disruption. Under Article 4, incidents recurring at least twice in six months with the same apparent root cause, which together meet the financial threshold, count as one significant incident.
| Stage (Art. 23(4)) | Deadline | Content |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether malicious acts are suspected; possible cross-border impact |
| Incident notification | Within 72 hours of becoming aware | Initial assessment of severity and impact, indicators of compromise where available |
| Intermediate report | On request of the CSIRT or authority | Status updates |
| Final report | One month after the incident notification | Description, root cause, mitigation, cross-border impact |
| Progress report | At that deadline if still ongoing | Status, then final report within one month of handling |
- Who you notify: the national CSIRT or competent authority, and, where appropriate, affected service recipients.
- No penalty for telling: "The mere act of notification shall not subject the notifying entity to increased liability."
- Parallel clocks: a personal data breach still needs GDPR Article 33 notification within 72 hours, often to a different authority. Run one triage with several outputs.
Supervision and fines
- Essential entities (Art. 32): on-site and off-site supervision, regular and targeted audits, ad hoc audits after a significant incident, security scans and evidence requests; binding instructions and orders; as a last resort, suspension of certifications or authorisations and temporary bans on managers.
- Important entities (Art. 33): ex post supervision when there is evidence of non-compliance, with similar inspection and order powers but without suspension or management bans.
- Fines (Art. 34): "effective, proportionate and dissuasive", for infringements of Article 21 or 23, on top of supervisory measures. The amounts are floors for the maximum, so national laws may set higher ceilings; Member States decide on fines for public administration.
Transposition status and national differences
Member States "had until 17 October 2024 to transpose the NIS2 Directive into national law", in the Commission's words. Many missed it. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025 to 19 Member States: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice, seeking "a lump sum and daily penalties". Check the Commission's transposition page and your national authority before relying on any status.
- Where national laws differ: local government and education scope (Art. 2(5)); which entities are designated essential; registration portals; the authority and CSIRT; fine ceilings above the floor; fines for public bodies; enforcement of management liability.
- Where they should not: the Article 21(2) list, the Article 23 timeline and the tier structure.
- Proposed amendments: on 20 January 2026 the Commission proposed COM(2026) 13 to simplify jurisdictional rules, streamline ransomware data collection and ease cross-border supervision, with a reinforced ENISA role, easing compliance for "28,700 companies, including 6,200 micro and small-sized enterprises". It is a proposal: plan against the current text.
- Sector rules: where a sector-specific EU act imposes equivalent requirements it takes precedence; DORA plays that role for most financial entities.
How to implement NIS2: a phased approach
- Confirm scope per legal entity (weeks 1 to 4): map each EU entity to Annex I or II activities, apply the SME test with linked enterprises, check the Article 2(2) triggers, and record tier and Member States. Keep the calculation on file and register where national law is in force.
- Set governance (month 2): board approval of the policy, an accountable executive, director training and a reporting cadence.
- Assess gaps (months 2 to 3): use the 2024/2690 Annex and ENISA mapping table as the test set, score all 13 sections and keep a dated gap register.
- Build the reporting path (month 3): significance criteria, a 24-hour early warning template, out-of-hours authority contacts, and a tabletop that times the 24-hour, 72-hour and one-month sequence.
- Close identity and supplier gaps (months 3 to 9): MFA on remote access and admin accounts, separate privileged accounts, supplier clauses. Deploy MFA in report-only mode, then pilot groups, then enforcement, with a break-glass path and a rollback to the previous policy if sign-in failures spike.
- Prove effectiveness (ongoing): control testing under Article 21(2)(f), board metrics, and reassessment after significant incidents or changes.
Decision guidance
- Essential or important: obligations are identical, so build one programme. The tier changes how audit-ready evidence must be at any moment.
- ISO/IEC 27001 certified: a strong base for (a), (b), (f) and (i), but it does not cover the reporting timeline, director training, registration or specific MFA and supplier contract expectations. Map, do not assume.
- Small and mid-sized entities: proportionality is in the text. Prioritise incident handling, restore tests, access control, MFA and a short critical supplier list; if you use managed services, manage them as critical suppliers.
- Large groups: one group control framework with national overlays, and an early decision on jurisdiction per entity.
Detection, measurement and framework mapping
What to monitor and measure
Log authentication on remote access, privileged account use, access rights changes (11.2 requires a register), supplier connections and backup results. Metrics that show the programme works:
- Time to significance decision: median and worst case against the 24-hour deadline.
- MFA coverage: percentage of remote access, privileged and email accounts with MFA enforced, per population.
- Unowned and dormant accounts: shared or ownerless human and non-human accounts, and accounts dormant over 90 days.
- Access review completion: reviews completed on time and rights removed.
- Critical supplier coverage: critical suppliers with security clauses and a current assessment.
- Restore success: restore tests meeting recovery time objectives.
Framework mapping
| NIS2 Art. 21(2) | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|
| (a) Risk analysis and policy | GV.RM, GV.PO, ID.RA | 5.1 |
| (b) Incident handling | DE.AE, RS.MA, RS.CO | 5.24 to 5.28 |
| (c) Continuity and crisis | RC.RP, PR.DS | 5.29, 5.30, 8.13 |
| (d) Supply chain | GV.SC | 5.19 to 5.22 |
| (e) Development and vulnerabilities | ID.RA, PR.PS | 8.8, 8.25 to 8.29 |
| (f) Effectiveness | ID.IM, GV.OV | 5.35, 5.36 |
| (g) Hygiene and training | PR.AT | 6.3 |
| (h) Cryptography | PR.DS | 8.24 |
| (i) HR, access control, assets | PR.AA, ID.AM | 5.9, 5.15 to 5.18, 6.1, 6.5, 8.2 |
| (j) MFA and secured communications | PR.AA | 5.17, 8.5 |
This mapping is indicative; ENISA publishes its own mapping of the Implementing Regulation, which auditors may prefer.
Common failure patterns
- Scoping only the parent: SME tests count linked enterprises, and each legal entity may need its own registration.
- Policies without board evidence: controls that management never approved or reviewed still fail Article 20.
- MFA everywhere except where attackers go: the Colonial Pipeline attack began with an unused VPN account, and the Change Healthcare breach with a remote access login without MFA.
- Supplier security on paper: questionnaires but no notification or audit clauses, and no view of how suppliers reach your systems. The Marks and Spencer cyberattack shows how impersonating a third-party user can become the entry point.
- Untimed reporting plans: nobody knows who decides "significant" or how to reach the CSIRT at night.
Practitioner checklist
- Record scope, tier and Member States for every EU legal entity, with the size calculation.
- Register with each authority and update contacts and IP ranges within two weeks of change.
- Minute management approval of the Article 21 measures and train every director.
- Assess all ten Article 21(2) items against the 2024/2690 Annex.
- Test the 24-hour, 72-hour and one-month reporting sequence in a tabletop.
- Enforce MFA on remote access, email and privileged accounts; use dedicated admin accounts.
- Give every service account and API credential an owner; remove shared and dormant identities.
- Add notification, audit and vulnerability clauses to critical supplier contracts.
- Report effectiveness metrics to the board quarterly and track national transposition changes.
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS 2 Directive)
- EUR-Lex: Commission Implementing Regulation (EU) 2024/2690
- ENISA: NIS2 Technical Implementation Guidance
- European Commission: NIS2 Directive
- European Commission: NIS2 Directive transposition in EU countries
- European Commission: Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice
- European Commission: Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act
Related NHI Mgmt Group resources: Identity Security Regulatory Map · MFA Guide · Privileged Access Management Guide · Third-Party Access Guide. This guide summarises Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 as of 16 October 2026 and is not legal advice.