NIS 2 LI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIS 2 transposition deadline

Member States had to bring into force the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2022/2555 by 17 October 2024.

Essential entity definition

An entity in an Annex I sector meeting the size threshold, or a qualified trust service provider, TLD registry or DNS provider regardless of size, subject to ex ante supervision.

Important entity definition

An entity in an Annex II sector meeting the size threshold; it is subject to the same Article 21 baseline duties but only ex post supervisory action.

Size threshold rule

Medium-sized or larger means 50 or more employees, or annual turnover and balance sheet total above EUR 10 million; micro and small enterprises are generally excluded.

Significant incident test

An incident causing severe operational disruption of services or financial loss for the entity, or considerable material or non-material damage to other persons.

Article 21 ten areas

Risk analysis, incident handling, continuity and backup, supply chain, secure development, effectiveness assessment, hygiene and training, cryptography, access control, and MFA.

Management body obligations

Under Article 20 management bodies approve risk-management measures, oversee implementation, and must undergo training; Member States provide for personal liability.

Maximum administrative fines

Essential entities face at least EUR 10 million or 2 percent of worldwide annual turnover; important entities at least EUR 7 million or 1.4 percent, whichever is higher.

Lex specialis exclusion

Entities covered by Regulation (EU) 2022/2554 on digital operational resilience for the financial sector are excluded from NIS 2 cyber risk-management and reporting duties.

Main establishment rule

For cross-border entities, the Member State of the main establishment governs supervision; for certain digital providers it is where services are mainly offered.

Entity registration duty

Article 27 requires essential and important entities to submit name, address, contact details, Member State and IP ranges to the competent authority.

Entity identification deadline

Member States had to establish lists of essential and important entities by 17 April 2025 and review those lists at least every two years.

Gap assessment output

A prioritised roadmap mapping current controls against the ten Article 21 areas and Article 23 reporting duties, with owners, budget and target dates.

Proportionality principle

Article 21 measures must be appropriate and proportionate to the entity's exposure, size and likelihood of risk, supporting a tiered control baseline.

All-hazards approach

Risk-management measures must address any event compromising availability, authenticity, integrity or confidentiality, not only known attack patterns.

Business continuity requirement

Article 21(2)(c) requires backup management, disaster recovery and crisis management, with restore procedures that are actually tested.

Supply chain security measure

Article 21(2)(d) requires assessing security properties of suppliers, their quality and resilience practices, and vulnerability handling across the chain.

Multi-factor authentication duty

Article 21(2)(j) requires MFA or continuous authentication, secured communications, and secured emergency communication systems where appropriate.

Cryptography measure

Article 21(2)(h) requires policies on use of cryptography and, where appropriate, encryption to protect data in transit and at rest.

Vulnerability handling

Part of Article 21(2)(e): security in acquisition, development and maintenance, including coordinated disclosure and timely remediation of identified vulnerabilities.

Effectiveness assessment

Article 21(2)(f) requires policies and procedures to assess whether implemented risk-management measures actually work, not merely that they exist.

24-hour early warning

Without undue delay and within 24 hours of awareness, notify the CSIRT or authority whether the incident is suspected malicious, cross-border or severely impactful.

72-hour incident notification

Within 72 hours the entity updates the early warning with an initial severity assessment, impact description and indicators of compromise.

One-month final report

Within one month of notification the entity submits root cause analysis, applied and ongoing mitigations, cross-border impact and lessons learned.

Delayed notification grounds

Article 23(4) allows delayed or omitted notification where reporting would risk national or public security, or where a criminal investigation applies.

User notification duty

The entity must inform users of its services likely to be affected by a significant incident, without undue delay, including mitigation measures they can take.

Concentration risk review

Identifying suppliers or shared platforms whose failure would disrupt multiple essential services, and documenting mitigating alternatives or redundancy.

Ex ante supervision

The regime for essential entities: proactive monitoring, on-site inspections, audits, security scans and information requests by the competent authority.

Ex post supervision

The regime for important entities: supervisory action is triggered by evidence of non-compliance rather than by routine proactive inspection.

Enforcement ladder

Warnings, binding instructions, orders to implement audit recommendations, appointment of a monitoring officer, and temporary suspension of authorisation or certification.

Certification under NIS 2

Certification is optional but recognised; conformity with a European cybersecurity certification scheme can evidence compliance with Article 21 requirements.

Evidence traceability

Each control should link to a policy clause, an operating record and a named owner, because auditors test the link rather than policy text alone.