NIS2: The EU Cybersecurity Directive Explained for IT Companies

NIS2 is the European Union’s cybersecurity directive for organisations in sectors that society depends on. It replaced the original NIS Directive of 2016 and applies to far more organisations, including many IT, cloud and managed service providers. Because it is a directive, each EU member state had to turn it into national law by 17 October 2024, so the exact rules depend on the country.

This guide is general information, not legal advice.

What is NIS2?

NIS2 sets minimum cybersecurity rules across the EU. It does three main things:

1. Defines who is in scope: “essential” and “important” entities in 18 sectors.
2. Sets obligations: risk management measures, management accountability and incident reporting.
3. Strengthens supervision and enforcement: proactive audits for essential entities, after-the-fact supervision for important entities, and harmonised maximum fines.

It also improves cooperation between member states through national CSIRTs (computer security incident response teams), the NIS Cooperation Group, the CSIRTs network and EU-CyCLONe for large-scale crises.

History and why it was introduced

NIS2 was introduced because NIS1 left too much to national discretion, covered too few sectors, and didn’t keep pace with ransomware, supply chain attacks and Europe’s growing dependence on digital services.

Main objectives:

1. Raise the baseline level of cybersecurity across the EU.
2. Apply consistent rules to a much wider set of sectors.
3. Make senior management accountable for cybersecurity.
4. Secure supply chains.
5. Speed up incident reporting and information sharing.

Who needs to comply?

Sectors

Digital infrastructure includes cloud computing service providers, data centre service providers, content delivery networks, DNS service providers, top-level domain registries, internet exchange points, trust service providers and providers of public electronic communications networks or services.

ICT service management (B2B) means managed service providers (MSPs) and managed security service providers (MSSPs).

Digital providers means online marketplaces, online search engines and social networking platforms.

Size

Generally, NIS2 applies to medium and large entities in these sectors:

• Medium: 50 to 249 employees, or annual turnover above EUR 10 million and balance sheet above EUR 10 million.
• Large: 250 or more employees, or turnover above EUR 50 million and balance sheet above EUR 43 million.

Some entities are in scope regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and public electronic communications providers, and entities a member state designates as critical.

Essential vs important entities

Jurisdiction for IT companies

Most entities are supervised in each member state where they operate. For DNS providers, TLD registries, cloud, data centre, CDN, MSP and MSSP providers and digital providers, the member state of the main establishment in the EU has jurisdiction. Such providers not established in the EU but offering services there must designate a representative in the EU.

Is it mandatory?

Yes, for in-scope entities, through each member state’s national law. Entities must usually register with the national authority, providing details such as their sector, contact details and IP ranges.

Management liability. Article 20 requires management bodies to approve risk management measures, oversee their implementation and follow training. Member states must be able to hold them liable for infringements. For essential entities, authorities can, in certain cases, temporarily prohibit a responsible manager from exercising managerial functions.

Key requirements

Article 21: cybersecurity risk management measures

Measures must be appropriate and proportionate, using an all-hazards approach, and include at least:

For digital infrastructure, MSPs, MSSPs and digital providers, Implementing Regulation (EU) 2024/2690 sets out these measures in detailed technical and methodological terms, and defines when an incident counts as significant.

Article 23: incident reporting

A significant incident is one that has caused or can cause severe operational disruption or financial loss, or considerable damage to others.

Entities must also inform recipients of their services, without undue delay, about significant incidents likely to affect them, and in some cases about significant cyber threats and possible remedies.

Other obligations

• Registration with the national authority.
• Use of certified products where a member state requires EU cybersecurity certification for certain ICT products.
• Cooperation with supervision: audits, inspections and information requests.

How to implement NIS2

1. Confirm scope and status in each country where you operate: sector, size, essential or important, main establishment.
2. Register with the competent authority by the national deadline.
3. Brief and train management, and set up formal approval and oversight of cyber risk measures.
4. Run a gap assessment against Article 21 and, if applicable, Implementing Regulation 2024/2690.
5. Strengthen supply chain security: supplier inventory, risk-based assessment, security clauses, monitoring.
6. Build the reporting process: define “significant”, set up 24/72-hour and one-month workflows, and practise them.
7. Close technical gaps: MFA, encryption, vulnerability handling, logging, backup and recovery.
8. Test business continuity, disaster recovery and crisis management.
9. Document and evidence everything for supervision.
10. Pass requirements down to your own suppliers, and prepare for customer questionnaires.

Documentation and policies

• Scope and entity classification assessment
• Registration records
• Management approval and oversight records, and training records
• Information security policy and risk analysis
• Incident handling and reporting procedures, with templates for each stage
• Business continuity, backup and disaster recovery plans, and crisis management plan
• Supply chain security policy and supplier assessments
• Secure development and vulnerability handling and disclosure policy
• Effectiveness assessment procedure (audits, tests, metrics)
• Cryptography and encryption policy
• HR security, access control and asset management policies
• MFA and secure communications standards
• Training and cyber hygiene programme

Audits, supervision and enforcement

• Essential entities face proactive supervision: on-site inspections, regular and targeted audits, security scans and information requests.
• Important entities face supervision after the fact, triggered by evidence or indications of non-compliance.
• Authorities can issue warnings, binding instructions and orders, and impose fines.
• There is no official NIS2 certificate. An ISO 27001 certificate is useful evidence but does not prove NIS2 compliance on its own.

Cost

Benefits

• Stronger resilience against ransomware and supply chain attacks.
• Clear expectations from regulators and customers across the EU.
• Management engagement and budget for cybersecurity.
• A competitive edge for suppliers who can show NIS2 readiness to regulated customers.

Risks of non-compliance

• Fines up to EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities.
• Personal consequences for management.
• Binding orders and public statements naming the entity.
• Loss of customers in regulated sectors.

Common mistakes

• Assuming you are too small without checking the size rules and the regardless-of-size categories.
• Treating it as an IT project without management oversight.
• Ignoring national differences in registration deadlines, sector definitions and penalties.
• No 24-hour reporting path, especially outside business hours.
• Forgetting suppliers, a core part of Article 21.
• Reporting to the wrong authority in multi-country operations.

Challenges for IT companies

• Multi-country presence with different national laws, unless the main establishment rule applies.
• Being both regulated and a supplier to regulated entities, facing NIS2 and DORA requirements from customers.
• Detecting and classifying incidents fast enough for a 24-hour early warning.
• Customer-facing notifications when incidents affect service recipients.
• Overlap with GDPR breach reporting, which may run in parallel.

Best practices

• Use ISO 27001 or the NIST CSF as your management framework and map Article 21 to it.
• Prepare reporting templates for each stage and pre-agree who decides “significant”.
• Run a tabletop exercise that includes management and the 24-hour clock.
• Maintain one supplier register with criticality ratings.
• Track national laws through official government sources and ENISA.

Tools that help

How NIS2 relates to other frameworks

Real-world examples

• National laws. Belgium and Italy were among the first member states to adopt NIS2 laws in 2024; others followed through 2025 and 2026, some after the Commission started infringement proceedings.
• ENISA guidance. ENISA has published technical implementation guidance to support the Implementing Regulation for digital infrastructure and ICT service providers.
• Illustrative scenario, not a real company: a 120-person MSP in the Netherlands serves hospitals and logistics firms. It confirms it is an important entity, registers, trains its directors, formalises a 24-hour incident reporting process, and tightens access to customer environments with MFA and privileged access management.

Frequently asked questions

Does NIS2 apply to my SaaS company? It depends on whether you are a cloud computing service provider or another listed provider, your size, and whether you serve the EU. Many SaaS companies are in scope; others are affected through customer contracts.

Does NIS2 apply to companies outside the EU? Yes, certain digital providers that offer services in the EU without an EU establishment must designate an EU representative and comply.

What is the difference between essential and important entities? Mainly the supervision regime and the maximum fines. The security and reporting obligations are similar.

How fast must incidents be reported? Early warning within 24 hours, notification within 72 hours, and a final report within one month.

Are managers personally liable? Management bodies must approve and oversee measures and can be held liable under national law.

Is there a NIS2 certification? No. ISO 27001 helps demonstrate compliance but is not a substitute.

Has every EU country transposed NIS2? Not all on time. Check the status for each country where you operate on its official government or authority website.

Next steps

• Check your sector, size and main establishment to confirm whether you are in scope.
• Register with the national authority if required.
• Brief management and record their approval of your cyber risk measures.
• Build and test a 24-hour incident reporting process.
• Review supplier security across your supply chain.