Implementing NIS2: obligations, deadlines and the route to compliance

What is NIS2?

NIS2 (Directive (EU) 2022/2555) is the EU-wide legal framework for cybersecurity. It replaces the first NIS Directive and covers considerably more sectors. The minimum requirements are stricter and more uniform across the EU, and there are substantial sanctions. The aim is a high common level of security for critical and important services in the EU.

How does NIS2 take effect in the member states?

NIS2 is a directive. The obligations for organisations arise through the national transposition laws. The transposition deadline was 17 October 2024; member states adopted their laws at different times. The practical details differ by country: which authority you register with, how incidents are reported, which national standards are referenced and the exact penalties. If your group operates sites in several member states, each legal entity is assessed under the law of the country in which it is established, and registration and reporting follow that country’s procedure. Details on the transposition in Germany and Austria are on our German NIS2 pages.

Who is affected by NIS2?

NIS2 distinguishes between essential and important entities. What counts is the combination of the sector (for example energy, transport, health, drinking water, digital infrastructure, public administration, but also manufacturing, chemicals, food, postal services and more, listed in Annexes I and II) and the size of the organisation. Put simply, NIS2 applies from medium-sized enterprises upwards: as a rule from 50 employees, or from more than EUR 10 million annual turnover together with more than EUR 10 million balance sheet total. Some entities fall under it regardless of size, for example providers of certain digital services.

The main obligations

Governance (Art. 20): the management bodies must approve the cybersecurity risk-management measures, oversee their implementation and follow training. They can be held liable for infringements.

Risk management (Art. 21): ten areas of measures are required, including incident handling, business continuity and crisis management, supply chain security, cyber hygiene and training, and policies to assess the effectiveness of the measures. All ten areas are explained in our article on the NIS2 requirements under Art. 21.

Reporting obligations (Art. 23): significant incidents must be reported in stages to the national CSIRT or the competent authority.

Reporting obligations and deadlines

• Early warning within 24 hours of becoming aware of the incident.
• Incident notification within 72 hours.
• Final report within one month of the notification.

Keeping to this reporting chain under time pressure is one of the hardest tasks in practice. That is why it is a typical part of realistic exercise scenarios.

Registration

Entities in scope must register with the competent authority of their member state and provide basic data such as name, sector, address and contact details. The deadlines are short, typically a few months after an entity first falls under the national law.

Sanctions

NIS2 provides for substantial fines: for essential entities up to EUR 10 million or 2 % of the worldwide annual turnover, for important entities up to EUR 7 million or 1.4 %, whichever is higher (Art. 34). Added to that is the liability of the management bodies.

The underestimated obligation: test and exercise regularly

Measures on paper are not enough. NIS2 requires you to assess their effectiveness and to keep operating in a crisis. Tabletop exercises make that possible with little effort: your team plays through a realistic scenario, makes decisions and rehearses the reporting chain. At the end there is an after-action report that you can present in the audit. SecDrills guides the exercise and produces this report automatically.

Implementing NIS2 in 6 steps

1. Clarify whether you are in scope and classify the entity as essential or important.
2. Register with the competent authority.
3. Establish the risk-management measures under Art. 21.
4. Involve and train the management bodies (Art. 20).
5. Define reporting and crisis processes (Art. 23).
6. Exercise, document and improve regularly, for example with tabletop exercises.

Frequently asked questions