NIS2 Directive, are you in scope and what must you do
Check whether your organisation is covered, and meet the security and reporting duties.
Official sources
Use these official places to read the text and find the latest version.
Official website
The official text is free in the EU Official Journal. ENISA publishes guidance.
Visit eur-lex.europa.eu (Directive 2022/2555) ↗Get the document
Read the directive free on EUR-Lex. The European Commission also explains it, and each EU country publishes its own national law.
Open the official page ↗What NIS2 is
NIS2 is the EU’s updated cybersecurity law. It sets minimum security measures and incident reporting for medium and large organisations in many sectors, from energy and transport to digital services and manufacturing.
Each EU country turns it into its own law, so details differ by country. Management can be held responsible.
How NIS2 got to where it is today
The milestones that changed what organisations have to do.
NIS Directive
The first EU-wide cybersecurity law.
NIS2 adopted
A wider, stricter directive replaces it.
Member states must apply it
National laws were due by 17 October 2024. Progress varies by country, so check your country.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You operate in an in-scope sector in the EU.
You supply a company that is covered.
You are a medium or large business.
Your board needs to show oversight.
What it asks of you
The requirements fall into six areas.
Scope check
Work out whether you are essential, important or out of scope.
Risk management measures
Policies, access, encryption, continuity.
Incident reporting
Early warning, notification and final report.
Supply chain security
Manage supplier risk.
Management accountability
Leadership approves and oversees measures.
Supervision and fines
National authorities can inspect and fine.
The 7 parts, 13 article groups and 42 obligations
NIS2 covers medium and large organisations in many sectors. It asks leaders to own cyber risk, apply ten types of security measures, report significant incidents in stages, and face supervision and fines.
13 article groups · 42 obligations
Scope and entity classification (Arts. 2-4)Work out whether and how the Directive applies to you.1 article group · 7 obligations
- Art. 2(1)
Check whether you are a medium or large entity operating in a sector listed in Annex I or Annex II.
What you do
- Compare headcount and turnover against the EU size thresholds
- Record the sector and service you provide
- Art. 2(2)
Some entities are covered whatever their size, for example public electronic communications providers, trust service providers, DNS and top-level domain registries, and sole national providers of critical services.
What you do
- Check whether you provide any of these services
- Seek legal advice if unsure
- Art. 3(1)
Large Annex I entities and certain digital infrastructure and public electronic communications providers are classed as essential.
What you do
- Record your classification and review it yearly
- Expect proactive supervision if essential
- Art. 3(2)
Other in-scope entities are classed as important.
What you do
- Record the classification
- Expect supervision mainly after incidents or complaints
- Annex I
High criticality sectors include energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management for businesses, public administration and space.
What you do
- Match each service line to the sector lists
- Include group companies and subsidiaries
- Annex II
Other critical sectors include postal and courier services, waste management, chemicals, food, certain manufacturing, digital providers and research.
What you do
- Match each service line to the list
- Review when you add new services
- Art. 4
Where a sector-specific EU law sets equivalent cybersecurity duties, that law applies instead of the matching NIS2 provisions.
What you do
- Check whether laws like DORA already cover you
- Document which regime applies
Evidence to keep
- Scoping assessment with headcount, turnover and sector evidence
- Entity classification record
- Group structure chart
Governance (Art. 20)Management owns cybersecurity risk.1 article group · 2 obligations
- Art. 20(1)
The management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements.
What you do
- Table the measures for formal board approval at least yearly
- Record decisions in minutes
- Art. 20(2)
Members of the management body follow training so they can assess cyber risks and practices, and similar training is offered to staff regularly.
What you do
- Run an annual board cyber briefing
- Keep attendance records
Evidence to keep
- Board minutes approving risk measures
- Management training records
- Accountability statement
Risk-management measures (Art. 21)Appropriate, proportionate technical and organisational controls.6 article groups · 14 obligations
- Art. 21(1)
Take appropriate and proportionate technical, operational and organisational measures to manage risks to network and information systems and to limit the impact of incidents, using an all-hazards approach.
What you do
- Run a documented risk assessment of systems and services
- Choose measures based on risk and cost
- Art. 21(5)
Follow any implementing rules for your sector, for example technical requirements adopted for digital infrastructure and service providers.
What you do
- Check whether an implementing act applies to you
- Map your controls to it
Evidence to keep
- Documented cyber risk assessment
- Statement of applicable measures
- Risk treatment plan
- Art. 21(2)(a)
Have policies on risk analysis and information system security.
What you do
- Maintain approved policies reviewed yearly
- Assign owners
- Art. 21(2)(b)
Have processes for handling incidents.
What you do
- Write an incident response plan with roles and contact lists
- Test it with a tabletop exercise
Evidence to keep
- Information security policy set
- Risk analysis document
- Incident response plan and logs
- Art. 21(2)(c)
Maintain business continuity, including backup management and disaster recovery, and crisis management.
What you do
- Set recovery targets and test restores
- Define a crisis team
- Art. 21(2)(d)
Manage security in the supply chain, including relationships with direct suppliers and service providers.
What you do
- Rate suppliers by criticality
- Put security terms in contracts
Evidence to keep
- Business continuity and disaster recovery plans
- Backup test records
- Supplier register and risk assessments
- Art. 21(2)(e)
Include security in acquiring, developing and maintaining network and information systems, including vulnerability handling and disclosure.
What you do
- Patch within set timeframes
- Publish a way to report vulnerabilities
- Art. 21(2)(f)
Use policies and procedures to assess the effectiveness of your cybersecurity risk-management measures.
What you do
- Run internal audits and security testing
- Track findings to closure
- Art. 21(2)(g)
Apply basic cyber hygiene practices and provide cybersecurity training.
What you do
- Run regular awareness training and phishing exercises
- Cover starter checklist items such as updates and backups
Evidence to keep
- Vulnerability handling procedure
- Control effectiveness review
- Training records
- Art. 21(2)(h)
Have policies and procedures on cryptography and, where appropriate, encryption.
What you do
- Define approved algorithms and key management rules
- Encrypt devices and data in transit
- Art. 21(2)(i)
Apply human resources security, access control policies and asset management.
What you do
- Run joiner, mover, leaver processes
- Keep an asset inventory
- Art. 21(2)(j)
Use multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications where appropriate.
What you do
- Enforce MFA on admin, remote and email access
- Provide a backup communication channel for incidents
Evidence to keep
- Cryptography policy
- Access control and asset records
- MFA coverage report
- Art. 21(3)
Consider vulnerabilities specific to each direct supplier and the overall quality of suppliers' products and cyber practices, including their secure development.
What you do
- Add security quality to vendor selection
- Review suppliers regularly
- Art. 22
Be aware that coordinated EU risk assessments can cover critical ICT supply chains.
What you do
- Watch EU risk assessment outputs
- Update supplier plans accordingly
Evidence to keep
- Supplier quality and security review records
Incident reporting (Art. 23)Notify authorities of significant incidents on a fixed timetable.1 article group · 7 obligations
- Art. 23(1)
Notify your national CSIRT or competent authority of any significant incident without undue delay.
What you do
- Name who decides and who sends
- Pre-load contact details
- Art. 23(3)
Treat an incident as significant if it causes or can cause severe operational disruption or financial loss, or considerable damage to others.
What you do
- Write criteria into the incident plan
- Apply them in triage
- Art. 23(4)(a)
Send an early warning within 24 hours of becoming aware of a significant incident, stating if malicious action is suspected or cross-border impact possible.
What you do
- Practise a 24-hour drill
- Use a short template
- Art. 23(4)(b)
Send an incident notification within 72 hours with an initial assessment, severity, impact and indicators of compromise.
What you do
- Prepare the 72-hour report in advance
- Update details as you learn more
- Art. 23(4)(c)
Provide an intermediate report if the authority asks for a status update.
What you do
- Keep facts and timeline current
- Name a reporting coordinator
- Art. 23(4)(d)
Provide a final report within one month of the incident notification covering root cause, mitigation and cross-border impact.
What you do
- Schedule a post-incident review
- File the report and lessons learned
- Art. 23(2)
Tell affected service recipients about significant cyber threats and the measures they can take.
What you do
- Prepare customer communication templates
- Link them to the incident plan
Evidence to keep
- Reporting procedure and templates
- Incident notifications sent
- Significant incident criteria
Registration and information sharing (Arts. 3, 27-30)Register and take part in sharing.1 article group · 4 obligations
- Art. 3(4)
Provide your national authority with required entity details such as name, sector, contacts and IP ranges so you can be listed.
What you do
- Gather the registration details
- Update when they change
- Art. 27
Expect certain digital infrastructure and provider entities to be listed in an EU registry maintained by ENISA.
What you do
- Check whether you provide those services
- Supply data on time
- Art. 29
Consider joining voluntary cybersecurity information-sharing arrangements.
What you do
- Join a sector sharing group
- Set rules on what can be shared
- Art. 30
Consider voluntary notification of incidents, near misses and cyber threats.
What you do
- Define when to send them
- Review the privacy implications
Evidence to keep
- Registration confirmation
- Information sharing agreement records
sup2Supervision and penalties (Arts. 31-36)What regulators can do and how much they can fine.2 article groups · 6 obligations
- Art. 32
Essential entities can be subject to proactive supervision including on-site checks, security audits, scans, information requests and binding instructions.
What you do
- Keep evidence of each Art. 21 measure ready
- Nominate an audit contact
- Art. 33
Important entities are supervised mainly after evidence of non-compliance, using similar tools.
What you do
- Keep documentation current
- Respond to requests within the deadline
- Art. 32 (managers)
For essential entities, authorities can in serious cases take steps directed at senior managers, so leaders have personal exposure.
What you do
- Train leaders on their personal exposure
- Record management oversight actions
Evidence to keep
- Audit and inspection preparation pack
- Evidence index for Art. 21 measures
- Corrective action plans
- Art. 34(4)
Essential entities can be fined up to a maximum of at least 10 million euro or 2 percent of worldwide annual turnover, whichever is higher.
What you do
- Report exposure to the board
- Prioritise gaps by risk
- Art. 34(5)
Important entities can be fined up to a maximum of at least 7 million euro or 1.4 percent of worldwide annual turnover, whichever is higher.
What you do
- Report exposure to the board
- Track remediation to closure
- Art. 36
Member States set further penalty rules and must make them effective and dissuasive.
What you do
- Check your national legislation
- Update your compliance register
Evidence to keep
- Board paper on penalty exposure
- Remediation tracker
National transposition (Art. 41)Each Member State had to turn the Directive into national law.1 article group · 2 obligations
- Art. 41
Member States had to adopt and publish national measures by 17 October 2024 and apply them from 18 October 2024.
What you do
- Check the status in each country where you operate
- Do not wait for the national law to start Art. 21 work
- IE-NOTE
In Ireland the NCSC stated the deadline was not met and national legislation was still being drafted, with the General Scheme published in 2024.
What you do
- Check the National Cyber Security Bill status before relying on this note
- Prepare using the draft risk-management measures and CyFun framework
Evidence to keep
- National law register entry per jurisdiction
- Monitoring notes on transposition
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from Directive (EU) 2022/2555, NIS2 (EUR-Lex), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Check scope
Sector, size and country.
- 2
Assess gaps
Against the required measures.
- 3
Set up incident reporting
Roles and templates.
- 4
Cover suppliers
Contracts and checks.
- 5
Brief the board
Document their oversight.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Scope check | Scope assessment record |
| Risk management measures | Controls library with evidence |
| Incident reporting | Incident workflow with timers |
| Supply chain security | Vendor register |
| Management accountability | Approvals and training records |
| Supervision and fines | Evidence pack |
Free NIS2 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Scope checklist
- Incident notification templates
- Supplier security questionnaire
- Board briefing note
Share or cite this page
Writing about NIS2? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/nis2/">NIS2 explained in plain English - Optimus CyberX</a>Common questions
Does NIS2 apply to us?
As a rule it covers medium and large entities in the listed sectors, with some exceptions regardless of size. It also depends on your country. Use the scope check.
Is ISO 27001 enough?
It helps a lot but does not cover every legal duty.
What are the fines?
Set at national level, within EU limits. The directive sets maximum fines of at least 10 million euros or 2% of turnover for essential entities, and 7 million euros or 1.4% for important entities.
Who regulates it?
A national authority in each EU country.
Related frameworks
See how ready you are for NIS2
Answer questions across every area. We email you a report showing where you comply and where you do not.