NIS2 Compliance Guide: What Every EU Business Must Know

NIS2 is the most significant expansion of cybersecurity obligations in EU history. It applies to an estimated 160,000+ organizations across 18 critical sectors, and introduces personal liability for executives.

Who does NIS2 apply to?

NIS2 divides organizations into "essential" and "important" entities across 18 sectors including energy, transport, banking, health, digital infrastructure, ICT service management, public administration, and space. Medium and large organizations in these sectors are automatically in scope. The key change from NIS1: the scope is dramatically wider, covering an estimated 160,000+ entities across the EU.

Sectors

160K+

Entities in scope

€10M

Max fine

24h

Incident reporting

Key NIS2 requirements

Risk management measures: implement cybersecurity policies covering incident handling, business continuity, and supply chain security

Incident reporting: notify authorities within 24 hours of significant incidents, with a full report within 72 hours

Supply chain security: assess and manage risks from direct suppliers and service providers

Management accountability: senior management must approve and oversee cybersecurity risk management

Penalties and executive liability

NIS2 penalties reach €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities. Critically, NIS2 introduces personal liability for management bodies. Senior executives can be held individually responsible for compliance failures and may face temporary bans from exercising managerial functions.

Frequently asked questions

What is NIS2 and who does it apply to?

NIS2 (Network and Information Security Directive 2) is an EU directive that sets cybersecurity risk management and incident reporting obligations for organizations across 18 critical sectors, including energy, transport, health, digital infrastructure, ICT service management, and digital providers. It applies to 'essential' and 'important' entities based on sector and size, covering an estimated 160,000+ organizations across the EU.

What are the penalties for NIS2 non-compliance?

Penalties under NIS2 are significant: up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% for important entities. NIS2 also introduces personal liability for management. Senior executives can be held individually responsible for compliance failures.