NIS 2

NIS 2 (Network and Information Security 2) is European Directive (EU) 2022/2555 of 14 December 2022, which replaced the original NIS Directive of 2016. It substantially raises the cybersecurity bar across the EU economy by expanding scope, harmonizing requirements, and tightening enforcement.

NIS 2 distinguishes two categories of in-scope organizations. Essential entities: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, and space. Important entities: postal services, waste management, chemicals, food, manufacturing of medical devices, computers, machinery, motor vehicles, digital providers (search, social, marketplace), and research. Size thresholds apply (typically medium-sized or larger), with critical-actor exceptions regardless of size.

Obligations span ten control domains: risk analysis and information system security policies, incident handling, business continuity, supply chain security, security in network and information systems acquisition/development, policies and procedures for assessing effectiveness, basic cyber hygiene and training, cryptography, access control and asset management, and human resources security.

Incident notification is tiered: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours with initial assessment, and a final report within one month. Penalties reach €10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and €7 million or 1.4% for important entities. Personal liability for management bodies is explicitly contemplated.

The shift from NIS 1 to NIS 2 multiplies by 5 to 10 the number of in-scope entities across the EU — moving from a few hundred critical operators to tens of thousands of organizations. Many directors discover in 2025-2026 that their entity now falls in scope, having not been concerned by NIS 1.

Personal liability for management bodies is one of the most consequential changes. NIS 2 explicitly contemplates personal sanctions and even temporary suspension of directors for serious failures. This represents a culture shift: cybersecurity is no longer a CISO concern delegated downward, it's a board-level accountability with personal exposure.

Compliance cost varies dramatically with maturity. For an organization already running ISO 27001 or aligned with HIPAA / DORA, the delta is manageable. For a mid-sized industrial company or municipal authority discovering the topic, it's a 12 to 24-month transformation program with meaningful budget.

For non-EU organizations: NIS 2 has limited extraterritorial reach but the supply chain provisions push obligations down to vendors regardless of location.