NIS 2 Directive explained: scope, requirements and how to prepare

What organizations and professionals need to know

Cyberattacks on hospitals, energy suppliers, transport operators, and digital service providers have shown how much Europe depends on secure networks and information systems.

To raise the level of cybersecurity across the Union, the European Union adopted the NIS 2 Directive.

NIS 2 brings far more organizations into scope than the original NIS Directive, sets stricter security and reporting requirements, and makes senior management directly accountable for cybersecurity.

This guide explains what NIS 2 is, who it applies to, what it requires, and how organizations can prepare.

What is the NIS 2 Directive?

The NIS 2 Directive, formally Directive (EU) 2022/2555, is EU legislation on measures for a high common level of cybersecurity across the Union.

It entered into force on 16 January 2023 and replaced the original NIS Directive of 2016. Member States had to transpose it into national law by 17 October 2024.

Because NIS 2 is a directive, not a regulation, it applies through each country’s national cybersecurity law. The core requirements are the same across the EU, but details such as registration procedures and supervisory authorities vary by country.

Who does NIS 2 apply to?

NIS 2 applies to public and private entities in specific sectors that meet the size threshold, which generally means medium-sized and large organizations. Some entities, such as certain digital infrastructure providers and public administration bodies, can be in scope regardless of size.

Sectors of high criticality

• Energy, transport, and health
• Banking and financial market infrastructures
• Drinking water and waste water
• Digital infrastructure, such as cloud computing, data centres, and DNS providers
• ICT service management, including managed service providers and managed security service providers
• Public administration and space

Other critical sectors

• Postal and courier services
• Waste management
• Manufacture, production, and distribution of chemicals
• Production, processing, and distribution of food
• Manufacturing, including medical devices, electronics, machinery, and vehicles
• Digital providers, such as online marketplaces, search engines, and social networking platforms
• Research organizations

Essential and important entities

In-scope organizations are classified as either essential or important entities. Both must meet the same security and reporting obligations, but essential entities face proactive supervision, while important entities are mainly supervised after an incident or evidence of non-compliance.

Key NIS 2 requirements

Cybersecurity risk-management measures

Organizations must take appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks. NIS 2 lists a minimum set, including:

• Risk analysis and information system security policies
• Incident handling
• Business continuity, including backup management, disaster recovery, and crisis management
• Supply chain security, including the security of relationships with suppliers and service providers
• Security in the acquisition, development, and maintenance of systems, including vulnerability handling and disclosure
• Policies to assess the effectiveness of security measures
• Basic cyber hygiene practices and cybersecurity training
• Cryptography and, where appropriate, encryption
• Human resources security, access control, and asset management
• Multi-factor authentication and secured communications, where appropriate

Management accountability

NIS 2 places cybersecurity firmly on the board’s agenda. Management bodies must approve and oversee the risk-management measures, can be held liable for infringements, and are required to follow cybersecurity training.

Incident reporting

Significant incidents must be reported to the national CSIRT or competent authority in stages:

• Within 24 hours – an early warning after becoming aware of the incident
• Within 72 hours – an incident notification with an initial assessment
• Within one month – a final report

Meeting these deadlines requires clear internal processes for detecting, assessing, and escalating incidents before one happens.

What are the penalties?

NIS 2 sets minimum maximums for administrative fines. Essential entities can be fined up to €10 million or 2% of worldwide annual turnover, whichever is higher, and important entities up to €7 million or 1.4%. National authorities can also issue binding instructions, order audits, and, for essential entities, temporarily suspend managers in serious cases.

Where NIS 2 stands in 2026

Most Member States have now transposed NIS 2 into national law, although several were late. In 2026, the European Commission referred a number of Member States to the Court of Justice of the EU for failing to complete transposition.

In January 2026, the Commission also proposed targeted amendments to NIS 2 as part of a wider cybersecurity package, aimed at improving legal clarity and reducing the burden on some smaller organizations. The core obligations remain in place, so organizations should continue their compliance work and follow the national law that applies to them.

NIS 2 and ISO/IEC 27001

Many organizations ask whether ISO/IEC 27001 helps with NIS 2. It does.

An information security management system (ISMS) based on ISO/IEC 27001:2022 already covers much of what NIS 2 requires, including risk assessment, security policies, supplier security, incident management, business continuity, access control, and continual improvement.

ISO/IEC 27001 certification does not automatically make an organization NIS 2 compliant. NIS 2 adds specific legal obligations, such as registration, management accountability, and strict incident reporting deadlines. However, an ISMS provides a strong, recognized foundation to build on.

How organizations can prepare

• Determine whether you are in scope – check your sector, size, and the national law in each country where you operate.
• Register with the competent authority where national law requires it.
• Run a gap analysis against the NIS 2 risk-management measures.
• Brief and train management on their responsibilities.
• Review supplier security across your critical supply chain.
• Prepare incident reporting procedures that can meet the 24-hour, 72-hour, and one-month deadlines.
• Test business continuity and recovery plans regularly.

Training paths for NIS 2

Professionals can build NIS 2 expertise through several PECB training paths available at MIC:

Certified NIS 2 Directive Foundation

A good starting point for professionals who need to understand the directive’s scope, requirements, and key concepts.

NIS 2 Directive Lead Implementer

This course develops the competence to plan, implement, and manage a cybersecurity program that meets NIS 2 requirements. It is particularly relevant to security managers, compliance professionals, consultants, and those responsible for NIS 2 programs.

ISO/IEC 27001 Lead Implementer

For professionals who want to build the information security management system that underpins NIS 2 compliance.

ISO/IEC 27035 Lead Incident Manager

Incident handling and reporting are central to NIS 2. This course focuses on planning and managing an effective information security incident management process.

Start your NIS 2 learning journey with MIC

NIS 2 is changing how organizations across Europe manage cybersecurity, and demand for professionals who understand it continues to grow.

My ISO Certification (MIC) provides access to official PECB training, with study materials, the exam, and the certification application fee included.

Ready to lead your organization’s NIS 2 program?

Explore the NIS 2 Directive Lead Implementer course and take the next step toward building your cybersecurity compliance expertise.

---