NIS 2 LI cheat sheet

NIS 2 (Directive (EU) 2022/2555) replaced NIS 1 and entered into force on 16 January 2023; Member States had to transpose it into national law by 17 October 2024.

Scope is set by Article 2 plus Annexes I and II: entities in listed sectors that are medium-sized or larger (50+ employees or turnover above EUR 10 million) are essential or important entities.

Essential entities: Annex I sectors (energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management, space) meeting the size threshold, plus qualified trust service providers, TLD registries and DNS providers regardless of size.

Important entities: Annex II sectors (postal, waste, chemicals, food, manufacturing, digital providers, research) meeting the size threshold; a breach of NIS 2 duties by an important entity triggers ex post supervision only.

Article 3(1) and 3(2) distinguish essential from important entities; classification drives supervisory regime, not the baseline Article 21 measures, which apply to both.

Article 21(2) lists ten minimum risk-management areas: risk analysis, incident handling, business continuity and backup, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, access control and asset management, MFA and secure communications.

Management bodies must approve risk-management measures, oversee implementation and undergo training (Article 20); Member States must provide for personal liability of management for infringements.

Article 34 sets maximum administrative fines: essential entities at least EUR 10 million or 2% of global annual turnover, important entities at least EUR 7 million or 1.4%, whichever is higher.

NIS 2 is a minimum-harmonisation directive: Member States may adopt stricter national rules, so the applicable national transposition law governs concrete obligations and deadlines.

Step 1 is a legal scoping test: sector listed in Annex I or II, then size threshold (medium: 50+ employees or turnover/balance sheet above EUR 10 million), then exceptions such as micro/small enterprises and Article 2(3)/2(4) exclusions.

Sector-specific lex specialis applies: entities covered by Regulation (EU) 2022/2554 (DORA) are excluded from NIS 2 cyber risk-management and reporting duties, and CER Directive critical entities have parallel resilience obligations.

Registration: Article 27 requires essential and important entities to submit at least name, address, contact details, Member State and IP ranges to the competent authority; implementing acts set the format and deadlines.

Governing law for cross-border entities is the Member State of the main establishment (Article 26); for DNS, TLD, cloud, data centre, CDN, managed service and managed security service providers it is the Member State where services are mainly offered.

Entity lists: Member States had to identify essential and important entities by 17 April 2025 and review them at least every two years thereafter.

Gap assessment maps current controls against the ten Article 21(2) areas and Article 23 reporting duties; output is a prioritised roadmap with owners, budget and target dates.

Governance artefact set: management-body approval of the risk-management policy, a named responsible person or CISO, documented roles, and evidence of management training.

Supply chain due diligence is a programme workstream, not an IT task: contractual security clauses, supplier risk tiering and concentration-risk review (Article 21(2)(d)).

Plan for proportionality: Article 21 obligations must be proportionate to exposure, size and likelihood of risk, which supports a tiered control baseline rather than uniform controls.

Article 21(1) requires risk-management measures that are appropriate and proportionate, based on an all-hazards approach, to protect network and information systems and prevent or minimise incident impact.

Article 21(2)(a): risk analysis and information system security policies - documented methodology, asset inventory, and a repeatable risk assessment cycle.

Article 21(2)(b): incident handling - detection, triage, containment, eradication, recovery, plus post-incident review feeding back into controls.

Article 21(2)(c): business continuity, backup management and disaster recovery, with tested restore procedures and crisis management.

Article 21(2)(d): supply chain security - security properties of suppliers and service providers, their quality and resilience practices, and vulnerability handling across the chain.

Article 21(2)(e): security in acquisition, development and maintenance, including vulnerability handling and disclosure (coordinated vulnerability disclosure, SBOM).

Article 21(2)(f): policies and procedures to assess effectiveness of measures; (g) basic cyber hygiene practices and security training.

Article 21(2)(h): cryptography and, where appropriate, encryption; (i): human resources security, access control policies and asset management.

Article 21(2)(j): multi-factor authentication or continuous authentication, secured voice/video/text communications, and secured emergency communication systems.

Article 21(3) allows implementing acts for technical and methodological requirements for DNS, TLD, cloud, data centre, CDN, managed service and managed security service providers, and for critical products.

Article 23 reporting applies to significant incidents: those causing severe operational disruption of services or financial loss for the entity, or affecting other persons through considerable material or non-material damage.

Three-stage reporting to the CSIRT or competent authority: early warning without undue delay and within 24 hours, incident notification within 72 hours, final report within one month.

Early warning content: whether the incident is suspected malicious, whether it is likely to cross borders, and whether it is likely to cause severe impact; it does not need full technical detail.

Incident notification updates the early warning, sets out an initial assessment of severity, impact and indicators of compromise; a status update is due on request.

Final report covers root cause analysis, applied and ongoing mitigation measures, cross-border impact, and lessons learned - the basis for continual improvement.

Article 23(4) permits delayed or omitted notification where reporting would risk national security or public security, or where the incident is a criminal matter under investigation.

Intermediate entities that are providers of trust services, DNS, TLD, cloud, data centre, CDN, managed services or managed security services must notify significant incidents under Article 23(4a) (added by amending Directive (EU) 2024/2690).

Users of the entity's services that are likely to be affected must be informed without undue delay, including measures they can take to mitigate the incident.

Supply chain security: assess supplier criticality, require incident notification from suppliers, embed security requirements in contracts, and evaluate concentration risk of shared dependencies.

CSIRT-to-CSIRT and CSIRT-to-ENISA cooperation flows through the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe) for large-scale incidents and cross-border coordination.

Supervision of essential entities is ex ante: proactive monitoring, on-site inspections, audits, security scans and requests for information (Article 32).

Supervision of important entities is ex post: action follows evidence of non-compliance (Article 33), with a lighter evidence burden.

Enforcement ladder: warnings, binding instructions, orders to implement audit recommendations, designation of a monitoring officer, and temporary suspension of certification or authorisation.

Evidence model: retain risk assessments, control operating evidence, incident records, training logs and supplier reviews; audits are sampled, so evidence must be retrievable by control and period.

Certification is optional under NIS 2 but recognised as an assurance mechanism; ENISA and the Commission support schemes, and national transpositions may require or incentivise certification.

Article 25 permits implementing acts for certification schemes for ICT products and services; conformity with a European cybersecurity certification scheme can be used as evidence of compliance with Article 21 requirements.

Monitoring metrics should cover control coverage against the ten Article 21(2) areas, incident detection-to-report times against the 24/72-hour clocks, and supplier review completion.

Continual improvement loop: post-incident reviews, internal audit findings, supervisory feedback and threat landscape changes feed the next risk assessment cycle.

Review cadence: risk assessment and control effectiveness at least annually and on significant change; entity registration data updated as required by the competent authority.

Incident definition (Article 6(6)): an event compromising availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of services offered by or accessible through network and information systems.

A near miss under Article 6(5) is not reportable under Article 23 but should be logged and reviewed, since recurring near misses indicate control weakness.

Reporting duty falls on the entity itself, not on the customer; for managed service providers, the contractual chain must guarantee the provider notifies the affected client.

Cross-border incidents: the early warning must state whether the incident is likely to affect other Member States; CSIRTs then coordinate via the EU-CyCLONe and the CSIRTs network.

Sectoral reporting duties (e.g. GDPR breach notification to a DPA within 72 hours, financial-sector reporting) run in parallel and are not displaced by NIS 2.

Supply chain contract clauses to require: security requirements, right to audit, incident notification timelines, vulnerability disclosure, subcontractor controls and exit/assured deletion terms.

Concentration risk review: identify single suppliers or shared platforms whose failure would disrupt multiple essential services, and document mitigating alternatives.

Penalty decision-making considers degree of fault, prior infringements, whether the incident was notified, and the entity's cooperation with the authority.

Public disclosure: competent authorities may publish decisions on infringements, which raises reputational risk beyond the fine itself.

Certification readiness sequence: define scope, map controls to the chosen scheme, run an internal audit, close findings, then undergo the external assessment.

Evidence traceability: each control should link to a policy clause, an operating record and an owner - auditors test the link, not the policy text alone.

Management review minutes are a key supervisory artefact: they should show risk decisions, resource approvals and follow-up on incident lessons.

Benchmarking and peer review against sector CSIRT guidance and ENISA threat landscape reports keeps controls current between formal assessments.

Public administration entities are in scope under Annex I only where they provide services at central government level; national transpositions may extend scope to regional and local bodies.

Group structures: assess scope entity by entity, since size thresholds and sector classification apply per legal entity rather than to the consolidated group.

Outsourcing does not remove responsibility: an entity remains accountable for the Article 21 measures even when functions are delegated to a provider.

Programme timeline should anchor on statutory dates (registration deadlines, 24/72-hour reporting readiness) and internal milestones for gap closure.

Article 6 definitions matter for scoping: 'network and information system', 'essential entity', 'important entity', 'significant incident' and 'near miss' each carry legal weight.

NIS 2 is without prejudice to GDPR and the ePrivacy Directive; processing of personal data for security purposes must still satisfy lawfulness and minimisation.

National transposition law, not the Directive text, creates the enforceable duties; always cite the applicable national act alongside the Directive article.

The Directive does not prescribe a single framework (ISO 27001, NIST CSF are not mandated) - it prescribes outcomes, so framework choice is an implementation decision.

Asset management underpins every other measure: without a current inventory of hardware, software, data and services, risk analysis and access control cannot be evidenced.

Vulnerability handling includes timely patching, a documented disclosure channel and a register of accepted risks where patching is delayed.

Access control measures to evidence: least privilege, joiner-mover-leaver process, privileged access review, and MFA on remote and administrative access.

Training must target management bodies as well as staff; Article 20 makes management training a distinct obligation from general cyber hygiene training.

The 24-hour early warning clock starts when the entity becomes aware of the significant incident, not when it is confirmed malicious.

If the final report cannot be delivered within one month, a reasoned justification must be provided; the one-month deadline is not extendable at the entity's discretion.

Where an incident affects two or more Member States, the initially notified CSIRT informs the other affected CSIRTs and ENISA.

Notification templates and channels are set nationally; entities should pre-register contact points and test the reporting channel before an incident.

Internal audit independence: the auditor should not own the controls being tested, and findings need a tracked remediation owner and due date.

Metrics for supervisory readiness: percentage of Article 21(2) areas with documented controls, mean time to report, and closure rate of audit findings.

Certification scope statements must define systems, locations and services covered; out-of-scope assets remain the entity's responsibility under NIS 2.

Continual improvement must be evidenced by change: compare successive risk assessments and show that identified gaps were closed or formally accepted.