Who does NIS2 apply to?
NIS2 divides organizations into "essential" and "important" entities across 18 sectors including energy, transport, banking, health, digital infrastructure, ICT service management, public administration, and space. Medium and large organizations in these sectors are automatically in scope. The key change from NIS1: the scope is dramatically wider, covering an estimated 160,000+ entities across the EU.
18
Sectors
160K+
Entities in scope
€10M
Max fine
24h
Incident reporting
Key NIS2 requirements
Risk management measures: implement cybersecurity policies covering incident handling, business continuity, and supply chain security
Incident reporting: notify authorities within 24 hours of significant incidents, with a full report within 72 hours
Supply chain security: assess and manage risks from direct suppliers and service providers
Management accountability: senior management must approve and oversee cybersecurity risk management
Penalties and executive liability
NIS2 penalties reach €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities. Critically, NIS2 introduces personal liability for management bodies. Senior executives can be held individually responsible for compliance failures and may face temporary bans from exercising managerial functions.
