NIS2 Compliance Requirements: What Businesses Must Implement

NIS2 compliance requirements cover cybersecurity controls, incident reporting, supply chain security and management accountability. Organisations in scope need working controls and evidence, supported by clear responsibilities across the business.

The NIS2 Directive (Directive (EU) 2022/2555) replaced the original NIS Directive, Directive (EU) 2016/1148. The national transposition deadline was 17 October 2024, and national measures were due to apply from 18 October 2024.

The starting point is understanding which legal entities and services are covered, then turning those obligations into an achievable implementation programme.

Key takeaways

• Establish scope by sector, size, service and jurisdiction, including exceptions for certain smaller organisations.

• Implement all ten Article 21 risk-management areas through proportionate controls and documented evidence.

• Prepare for reporting within 24 hours, 72 hours and one month, alongside management oversight and training.

Which organisations fall within NIS2?

Annex I and Annex II sectors

NIS2 covers 18 sectors, although coverage depends on the entity types defined within each sector.

Annex I contains 11 high-criticality sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, business-to-business ICT service management, public administration and space.

Annex II contains seven other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Manufacturing coverage concerns defined categories, rather than every manufacturer.

Essential and important entities

Large Annex I businesses are generally essential entities. The usual large-enterprise threshold is 250 or more employees, or turnover above EUR 50 million together with a balance sheet above EUR 43 million.

Medium-sized Annex I businesses are generally important entities. Annex II businesses meeting medium or large size criteria are generally important entities.

Medium-sized businesses commonly have 50 to 249 employees. However, the EU definition combines headcount and financial criteria, with turnover and balance-sheet ceilings of EUR 50 million and EUR 43 million. Partner and linked enterprises can affect calculations.

Some entities, including DNS service providers and top-level domain registries, are covered regardless of size. Cloud providers, data centres and managed security service providers aren't automatically size-exempt, although other designation rules can bring smaller entities into scope.

For multinational groups, assess each legal entity, its services, applicable national legislation, competent authority and registration obligations. A group-wide label isn't sufficient.

The ten Article 21 NIS2 compliance requirements

Article 21 requires appropriate and proportionate technical, operational and organisational measures. These must address cybersecurity risks and the physical environment supporting network and information systems.

These ten areas translate into proportionate risk management measures and practical implementation work.

Article 21 area	What businesses should implement
Risk analysis and security policies	Defined risk criteria, documented assessments, approved policies and accountable risk owners.
Incident handling	Detection, triage, escalation, response procedures and evidence preservation.
Business continuity	Tested backups, disaster recovery arrangements, crisis management and agreed recovery priorities.
Supply chain security	Direct-supplier assessments, contractual safeguards and ongoing risk reviews.
Secure acquisition, development and maintenance	Security requirements, vulnerability handling, disclosure processes and patch management.
Effectiveness assessment	Control testing, meaningful metrics, internal reviews and corrective actions.
Cyber hygiene and training	Secure working practices, staff awareness and role-specific cybersecurity training.
Cryptography and encryption	Policies governing cryptographic protection, encryption and key management where appropriate.
HR security, access control and asset management	Personnel safeguards, maintained inventories, access approvals and timely removal of permissions.
Authentication and secured communications	Use multi-factor authentication or continuous authentication, secured communications and emergency communications where appropriate.

Tested recovery arrangements support business continuity and disaster recovery when an incident disrupts operations.

Assign an owner to each area, including access control and incident handling, and document operating procedures. Record evidence, test controls and incident handling procedures, and track corrective actions. A policy alone doesn't demonstrate implementation.

Supply chain security needs operational evidence

Article 21(2)(d) addresses security relationships with direct suppliers and service providers. Assessment should consider their vulnerabilities and security practices, including secure development.

Tier suppliers according to access, sensitive information and operational dependency. A provider supporting production systems needs greater scrutiny than a low-risk administrative supplier.

Contracts should establish incident notification expectations, security responsibilities and proportionate audit or assurance rights. These are practical ways to support the obligation, rather than a universally prescribed contractual template.

For cloud services, retain evidence about privileged access, recovery arrangements and shared responsibilities. BSI's discussion of cloud security and major breaches illustrates why provider selection doesn't transfer accountability.

ENISA's NIS Investments 2024 identified business continuity and vulnerability handling as implementation challenges for 49% of respondents.

NIS2 incident reporting deadlines

Recognising a significant incident

An incident is significant when it causes, or could cause, severe operational disruption or financial loss to the entity. It also qualifies when it affects, or could affect, others through considerable material or non-material damage.

A reportable incident doesn't need to involve stolen personal data. Service disruption can be sufficient. Additional thresholds apply to certain digital providers under Implementing Regulation (EU) 2024/2690.

Set escalation criteria and incident handling procedures before an incident occurs. Our guidance on ISO 27001 incident response supports preparation and evidence handling.

Record the relevant national CSIRT's contact route and out-of-hours process before an incident occurs.

Meeting the reporting timetable

Notifications go to the relevant national CSIRT or competent authority, without undue delay and within these limits.

Stage	Deadline	Main information
Early warning	Within 24 hours of awareness	Suspected malicious activity and potential cross-border effects.
Incident notification	Within 72 hours of awareness	Initial severity and impact assessment, plus available indicators of compromise.
Final report	Within one month of the incident notification	Incident details, likely cause, mitigation and cross-border impact.

The one-month deadline runs from the incident notification, not initial awareness.

For deadline calculation, awareness at 09:00 on 5 October means limits of 09:00 on 6 October and 8 October. Notification on 8 October means a final report by 8 November. Ongoing incidents require a progress report, followed by a final report within one month of handling the incident. Trust service providers face a shorter incident-notification deadline.

Management accountability and penalties

What the management body must demonstrate

Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee implementation and undertake training.

Retain board minutes, training records, approved budgets, risk decisions and evidence of follow-up. Record who accepted material residual risks and why.

A vCISO can support governance, reporting and programme coordination. Management accountability remains with the organisation's leadership.

National law determines personal liability. For essential entities, supervisory measures can include temporary bans on relevant senior managers until identified failings are addressed, subject to statutory conditions.

Financial exposure

For breaches of Articles 21 and 23, national laws must set maximum administrative fines at least as high as these baselines, with percentage limits tied to global turnover.

Entity classification	Maximum fine baseline
Essential entity	EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
Important entity	EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher.

The percentage-based maximum uses the undertaking's worldwide annual turnover for the preceding financial year. The important-entity percentage is 1.4%, not 1.5%.

Corrective orders and supervisory action can apply alongside financial penalties. Essential entities also face more extensive proactive supervision than important entities.

Using ISO 27001 and existing frameworks

Build on the ISMS, then close NIS2 gaps

ISO/IEC 27001:2022 provides a strong information security management foundation. Its risk assessment, internal audit, management review, improvement processes and access control measures can support relevant Article 21 obligations.

Its 93 Annex A reference controls sit across four themes: organisational, people, physical and technological. The Statement of Applicability records control decisions, implementation status and justified exclusions.

Certification doesn't establish NIS2 compliance. Compare the certified boundary with regulated operations, then address supplier assurance, statutory reporting and management accountability.

Our ISO 27001 consultancy supports gap assessment and implementation. ISO 27001 training should prepare control owners for their responsibilities, whilst internal auditing tests operational evidence.

Keep framework-specific obligations separate

Shared controls can reduce duplicated work, but frameworks aren't interchangeable. ISO 42001 addresses AI management, whilst CMMC concerns contract-linked protection of US defence information.

For automotive organisations, TISAX training and consultancy can draw on shared access reviews, supplier assessments and incident procedures. TISAX assessment follows its own scope and ENX assessment arrangements.

DORA is different because it has a legal relationship with NIS2. Recital 16 establishes its sector-specific role for covered financial entities. Corresponding DORA risk-management and reporting obligations take precedence; this isn't a blanket exemption for every financial-sector organisation.

What UK and non-EU businesses must consider

NIS2 isn't UK domestic law. The NIS Regulations 2018 remain the UK framework, whilst the proposed Cyber Security and Resilience (Network and Information Systems) Bill would expand coverage and update reporting obligations.

UK organisations can have direct NIS2 obligations through covered EU operations or specified services offered within the EU. National transposition means applicable requirements and competent authorities can vary by country, so check the relevant country's implementing law.

Certain non-EU digital providers, including cloud providers and managed security service providers, must designate an EU representative when offering covered services in the EU. This requirement doesn't apply to every overseas business.

UK suppliers can also receive contractual security requirements from EU customers. Distinguish these commercial obligations from direct regulatory duties, and assign responsibility for each in the implementation plan.

Frequently asked questions

How does NIS2 compare with NIST?

NIS2 is a legal framework with scope, reporting, supervision and enforcement requirements. NIST's Cybersecurity Framework 2.0 organises security outcomes around Govern, Identify, Protect, Detect, Respond and Recover. It can structure implementation, but alignment doesn't establish legal compliance.

Does implementation require specialist compliance software?

NIS2 doesn't prescribe a particular software platform. Existing registers and controlled repositories can support implementation if ownership, approvals, evidence and review dates remain clear. Use tools that fit the organisation's complexity rather than treating a new platform as the starting point.

Turn NIS2 obligations into demonstrable controls

Effective NIS2 implementation connects legal scope, operational controls and management evidence. Assign owners to identified gaps, prioritise material risks and test whether reporting and recovery arrangements work.

If you would like to find out more information or require any of our services please Contact Us and complete our contact form.