NIS 2 Foundation cheat sheet

NIS 2 is Directive (EU) 2022/2555, adopted 14 December 2022, replacing Directive (EU) 2016/1148 (NIS 1); transposition deadline for Member States was 17 October 2024.

Scope covers 'essential' and 'important' entities that are medium-sized or larger (generally 50+ staff or over EUR 10 million turnover/balance sheet), plus certain small entities regardless of size: qualified trust service providers, top-level-domain name registrars, DNS service providers, public electronic communications networks/services, and sole providers of critical services.

Annex I sectors (high criticality, mostly essential entities): energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, space.

Annex II sectors (other critical, mostly important entities): postal and courier, waste management, chemicals, food, manufacturing (medical devices, computer/electronic/optical, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social networks), research.

Essential entities are generally large enterprises in Annex I sectors plus qualified trust service providers, TLD registrars, DNS providers, and public electronic communications networks/services; important entities are large Annex II entities and medium-sized Annex I entities.

Special rules: public administration entities are in scope at central and regional level; entities providing domain name registration services are in scope except those in the public sector; size thresholds do not apply to entities whose sole activity is providing a critical service.

Member States must establish a list of in-scope entities by 17 April 2025 and review it at least every two years; entities self-identify and register where required by national law.

NIS 2 does not apply to entities covered by Regulation (EU) 2022/2554 (DORA) for financial entities, nor to micro/small entities in most cases; national law may extend scope to smaller entities and additional sectors.

NIS 2 is a minimum-harmonisation directive: Member States may adopt stricter national rules, so compliance depends on the transposing national law of the Member State where the entity is established or provides services.

Article 21 requires a risk-management approach with at least ten measures: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in acquisition/development/maintenance; effectiveness assessment; cyber hygiene and training; cryptography and encryption; access control and asset management; MFA and secure communications.

The management body must approve the measures and oversee their implementation; Member States may make management bodies accountable for infringements (Article 20).

Measures must be proportionate to risk and appropriate to the entity's exposure, size, and likelihood/severity of incidents; no fixed prescriptive checklist is mandated.

Supply chain security must address vulnerabilities specific to each direct supplier and service provider, and their overall product/service quality and cybersecurity practices; ENISA and the NIS Cooperation Group provide guidance.

Entities must notify the CSIRT or competent authority of any significant incident without undue delay, and in any event within 24 hours of becoming aware (early warning), then a full notification within 72 hours, and a final report within one month.

An incident is 'significant' if it has caused or is capable of causing severe operational disruption of services or financial loss, or has affected or is capable of affecting other persons through considerable material or non-material damage; national law may add criteria.

Digital infrastructure providers (IXPs, DNS, TLD registries), trust service providers, and electronic communications providers have additional sector-specific obligations and reporting timelines under Article 26 and the relevant Union acts.

Entities must use European or internationally accepted standards and specifications when implementing Article 21 measures; ENISA and the Commission issue technical guidance and implementing acts.

Recipients of significant incidents that may affect service provision must inform their service recipients and, where appropriate, the competent authority; cross-border incidents are coordinated through the CSIRT network and EU-CyCLONe.

Management bodies must approve and oversee the risk-management measures, bear liability for non-compliance, and ensure training for their members; Member States may impose temporary bans on executives for serious infringements.

Supervision differs by classification: essential entities face proactive, ex-post supervision (on-site inspections, audits, security scans, information requests); important entities face reactive, ex-post supervision triggered by evidence, incident, or complaint.

Competent authorities may issue binding instructions, order remedial measures, order audits by independent bodies, appoint a monitoring officer, require notification to service recipients, and impose administrative fines.

Article 34 fines: essential entities up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher); important entities up to EUR 7 million or 1.4% of worldwide annual turnover.

Enforcement must be effective, proportionate, and dissuasive; Member States must provide effective judicial review of supervisory decisions before a court.

Member States must adopt rules on penalties by 17 October 2024 and notify the Commission; penalties apply to public administration entities as well, with national rules governing their liability.

CSIRTs must be designated and have adequate resources; they handle incident notifications, provide early warning and response, and participate in the CSIRT network and EU-CyCLONe for crisis coordination.

Competent authorities must cooperate through the NIS Cooperation Group and may request ENISA assistance; cross-border supervision applies where an entity provides services in multiple Member States, with the main establishment rule for jurisdiction.

Reporting entities must retain records of incidents, notifications, and remediation for supervisory review; supervisory bodies may request evidence of compliance and conduct peer reviews.

Article 24 establishes European cybersecurity certification schemes (e.g., under the EU Cybersecurity Act Regulation (EU) 2019/881) as a way to demonstrate compliance with Article 21 requirements; certification is voluntary unless national or Union law makes it mandatory.

Member States must encourage the use of certified ICT products, services, and processes; the Commission may adopt implementing acts specifying which schemes satisfy specific Article 21 requirements.

ENISA develops candidate certification schemes; the Commission adopts them by implementing act; national cybersecurity certification authorities oversee certification in each Member State.

Standards bodies (CEN, CENELEC, ETSI) and ENISA issue technical standards and guidance; ISO/IEC 27001 and the ISO/IEC 27000 series are commonly used as a baseline but are not formally mandated by NIS 2.

Good practice includes mapping the entity's assets and critical services, performing a risk assessment aligned with Article 21, and defining measurable security objectives and KPIs.

Good practice includes exercising incident response through tabletop exercises and simulations, and testing business continuity and crisis management plans at least annually.

Supply chain due diligence should include contractual security requirements, supplier risk assessments, and monitoring of critical suppliers, aligned with the NIS Cooperation Group's supply chain security guidance.

The NIS Cooperation Group publishes reference documents, sector-specific guidance, and good-practice examples; ENISA publishes threat landscape reports and technical guidelines.

Compliance evidence for supervisory review typically includes risk assessments, policies, incident logs, training records, audit reports, and evidence of management-body oversight.