NIS 2
Find out more about the NIS directive and how partnering with Resillion can improve your cyber resilience.
What is NIS2?
NIS2 is an EU-wide set of rules designed to strengthen the cyber resilience of key sectors. It sets minimum cyber security standards, requires faster incident reporting, and makes senior leadership directly accountable for managing cyber risk.
Who it applies to
NIS2 applies to medium and large organisations in critical sectors such as: Energy, Transport, Healthcare, Drinking and waste water, Banking and financial infrastructure, Public administration, Digital infrastructure and ICT services, Manufacturing, food, chemicals, postal services, digital services, research, and more.
It splits organisations into two categories:
-
Essential entities – face stricter supervision
-
Important entities – still regulated, but with lighter oversight
Who’s not covered?
NIS2 generally does not apply to organisations with fewer than 50 employees and annual turnover or balance sheet below €10 million.
But there are exceptions: Some smaller but strategically important players – like certain trust-service providers or communication services – can still be brought in.
If your organisation falls into one of those sectors and meets the size criteria, you now have real legal obligations. These include:
- Managing cyber risk rigorously.
- Reporting major cybersecurity incidents within tight timeframes.
- Making senior management accountable – under NIS2, leadership can be held personally liable for compliance failures
By April 2025, EU Member States must create official lists of all essential and important entities, as well as organisations that provide domain name registration services.
To be included on these lists, organisations will be required to give their national authorities at least the following information:
-
The organisation’s name
-
Its address and up-to-date contact details, including email addresses, IP ranges, and phone numbers
If any of this information changes, the organisation must report the update within two weeks.
ENISA, the EU Agency for Cybersecurity, is responsible for creating and maintaining a central registry for organisations providing cross-border services – including DNS providers, TLD registries, domain name registration services, cloud providers and data centre operators.
These organisations were required to submit their information before 18 January 2025, meaning the deadline has now passed and all in-scope entities should already be registered.
Management bodies of essential and important entities must also approve and oversee the organisation’s cyber security risk-management measures. They can be held personally liable if the organisation fails to comply with its NIS2 requirements.
Organisations must put in place appropriate security measures to protect their network and information systems — including their physical environment. ‘Appropriate’ means the measures must match the level of risk the organisation faces.
The directive requires organisations to have, at minimum:
-
Risk analysis and a security policy for their information systems
-
Effective incident-handling processes
-
Business continuity plans, including backups, contingency plans, and crisis-management procedures
-
Supply-chain security measures and controls for the full lifecycle of their systems, including how they handle and disclose vulnerabilities
-
Policies and procedures to assess whether their security measures actually work
-
Basic cyber-hygiene practices and regular cybersecurity training
NIS2 refers to recognised European and international standards when designing these measures, specifically mentioning the ISO 27000 series. Additional practical guidance on cyber security and cyber hygiene can be found on national and governmental websites, such as the Centre for Cyber Security Belgium, the National Cyber Security Centre, and the Rijksinspectie Digitale Infrastructuur in the Netherlands.
Entities covered by NIS2 must send an initial alert without delay for any significant incident or event, and then provide a full incident report to their national CSIRT or competent authority within 72 hours at the latest.
They must also report any changes to the information kept on record — both in the lists maintained by ENISA and in the lists managed by individual Member States.
Member States are responsible for monitoring compliance with NIS2. Essential entities will face active, ongoing supervision. Important entities will be supervised on a passive basis, meaning authorities will step in only when there is a reason to do so, such as after an incident.
Supervisory authorities will have the power to carry out on-site inspections, off-site checks, audits, security scans, and to request documentation or information whenever needed.
Essential entities can face administrative fines of up to €10 million or 2% of global annual turnover. Important entities can be fined up to €7 million or 1.4% of global annual turnover.
NIS2 and the GDPR partly overlap: both require strong security measures and mandatory incident reporting to the relevant authorities.
Where sector-specific laws impose stricter cyber security rules, those requirements take priority. For example, the Digital Operational Resilience Act (DORA) sets stronger rules for the financial sector.
NIS2 creates a coordinated cyber security framework across the EU, covering national strategies, crisis management, and cross-border cooperation.
Each Member State must establish one or more CSIRTs. These teams monitor national cyber threats, handle incidents, issue early warnings, and support essential and important entities during cyber security events.
The EU has also set up EU-CyCLONe to help coordinate the response to major, cross-border cyber incidents.
To prove compliance, Member States may require organisations to use ICT products, services, or processes that are certified under EU cyber security schemes. They are also encouraged to use qualified trust services.
Our AI Partnering Strategy will help you navigate the AI landscape
Get in touch
Providing solutions in a unified, structured approach across all critical domains to enable end-to-end quality – Because we’re the only ones who can.
