The NIS2 Directive: Overview, Scope, and Key Provisions
NIS2 is the EU’s most significant cybersecurity legislation in a decade. StartComply helps European organisations understand their scope, map Article 21 controls, evidence management oversight, and prepare for regulator-ready compliance without spreadsheet chaos.
Trusted by 100+ organisations across Europe
NIS2 
Article 21 
24h Reporting 
Management Liability What you need to know about the NIS 2 Directive
- The NIS 2 Directive (EU 2022/2555) replaced the original NIS Directive and required national transposition by 17 October 2024.
- NIS2 automatically brings medium and large enterprises in 18 sectors into scope without requiring national designation.
- Organisations are classified as essential or important entities, with different supervisory regimes but largely identical security obligations.
- Article 21 mandates cybersecurity risk management measures including supply chain security, incident handling, access control, and business continuity.
- Article 20 holds management bodies personally accountable for approving and overseeing cybersecurity measures.
- Article 23 requires a 24-hour early warning, 72-hour full notification, and one-month final report for significant incidents.
- Fines reach €10 million or 2% of global turnover for essential entities, and €7 million or 1.4% for important entities.
Based on NIS2 Directive (EU 2022/2555). Last updated January 2025.
NIS2 Is Enforceable and Requires Compliance Evidence
A structured, evidenced cybersecurity programme
- Article 21 cybersecurity risk management measures for network and information systems
- Supply chain security covering direct suppliers and service providers
- Article 23 incident reporting: 24-hour early warning, 72-hour notification, one-month final report
- Article 20 management approval, oversight, training, and personal accountability
- Audit-ready evidence available for national competent authorities
Penalty exposure: essential entities face fines up to €10M or 2% of global annual turnover. Important entities face up to €7M or 1.4%.
Policies, spreadsheets, and manual follow-ups
- No clear mapping between Article 21 obligations and implemented controls
- Incident escalation paths that cannot reliably meet the 24-hour deadline
- Supplier security risks tracked manually, if they are tracked at all
- Management approval recorded once, with no continuous oversight trail
- Evidence scattered across files, inboxes, ticketing tools, and policy folders
- No regulator-ready view of scope, gaps, remediation, and open risk
The audit reality: authorities do not just ask whether controls exist. They ask who approved them, when they were reviewed, what changed, and where the evidence sits.
Map Every NIS2 Requirement Into One Compliance Workflow
Scope and Entity Classification
Confirm whether your organisation falls within the NIS2 size-and-sector model, identify whether you are an essential or important entity, and keep your scope decisions documented.
- Covered sector and size-threshold mapping
- Essential vs important entity classification
- National authority registration tracking where required
- Evidence of scope decisions and assumptions
Article 21 Control Mapping
Map the minimum cybersecurity risk management measures directly to operational controls, responsible owners, review cadences, and evidence records.
- Risk analysis and information system security policies
- Incident handling, business continuity, and crisis management
- Supply chain security and third-party risk evidence
- MFA, access control, cryptography, and cyber hygiene coverage
Incident Reporting Readiness
NIS2 Article 23 creates a three-stage reporting obligation. StartComply helps teams prepare the workflows, escalation paths, and evidence needed before the clock starts.
- 24-hour early warning readiness
- 72-hour full incident notification workflows
- One-month final report evidence pack
- Predefined escalation ownership and status tracking
Management Accountability Evidence
Article 20 makes cybersecurity oversight a board-level responsibility. StartComply creates a clear record of approval, review, training, decisions, and follow-up.
- Management dashboard for Article 20 oversight
- Approval logs for adopted cybersecurity measures
- Training and awareness evidence for management bodies
- Remediation ownership and executive visibility
StartComply vs. The Alternatives
NIS2 compliance is not just a policy exercise. Your approach needs to produce structured, traceable, regulator-ready evidence.
StartComply was built for European organisations that need NIS2 evidence, not another disconnected policy library.
What Is the NIS 2 Directive?
The NIS 2 Directive (Directive EU 2022/2555) is the EU’s updated cybersecurity law. It replaced the original NIS Directive, expanded the number of covered sectors, and introduced stronger obligations for cybersecurity risk management, incident reporting, supply chain security, and management accountability.
The directive was published in the Official Journal of the European Union on 27 December 2022 and entered into force on 16 January 2023. Member States had until 17 October 2024 to transpose it into national law. From that point, in-scope entities became legally obligated to comply.
NIS2 adopts a size-and-sector threshold model, which means medium and large enterprises in covered sectors are brought into scope automatically, without waiting for national authorities to designate them one by one.
The practical meaning: NIS2 compliance must be operational. Regulators expect evidence that controls are implemented, reviewed, monitored, and approved by management.
How to Approach NIS 2 Directive Compliance Operationally
Confirm coverage NIS2 Art. 2
Confirm whether your organisation meets the size thresholds and operates in a covered sector. Document the legal entities, services, geographies, and assumptions used for the assessment.
Essential or important entity Annex I / Annex II
Determine whether the organisation is an essential or important entity. The obligations are largely similar, but the supervision model and maximum fine level differ.
Map Article 21 controls Cybersecurity measures
Map current policies, technical controls, supplier controls, incident procedures, access management, training, and continuity measures against the directive’s minimum requirements.
Build the audit trail Regulator-ready proof
Policies are not enough. Store control evidence, review dates, owners, approvals, incidents, supplier assessments, and remediation actions in a structure that can be shown to regulators.
Prepare incident reporting 24h / 72h / 1 month
Set up escalation paths, decision ownership, and notification workflows before an incident occurs. Twenty-four hours is not the time to start looking for who owns the report.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About the NIS 2 Directive
What is the NIS 2 Directive and when did it take effect?
The NIS 2 Directive (EU 2022/2555) is an EU cybersecurity law that replaced the original NIS Directive. It entered into force on 16 January 2023 and required transposition into national law by 17 October 2024. From that date, in-scope organisations became legally obligated to comply with its security and incident reporting requirements. It applies to medium and large enterprises across 18 sectors operating in the EU.
Which sectors does the NIS 2 Directive cover?
NIS2 covers 18 sectors divided into two annexes. Annex I includes sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. Annex II adds postal services, waste management, chemicals, food, manufacturing of critical products, and digital providers.
What is the difference between essential and important entities under NIS2?
The security obligations under Article 21 are largely the same for both categories. The difference lies in supervision and fines. Essential entities face proactive supervision, while important entities face reactive supervision. Essential entities face fines up to €10 million or 2% of global turnover, while important entities face up to €7 million or 1.4% of global turnover.
What are the incident reporting deadlines under NIS2 Article 23?
NIS2 Article 23 sets three deadlines for reporting significant incidents. Within 24 hours of becoming aware, organisations must submit an early warning. Within 72 hours, a full incident notification is required. Within one month, a final report must be submitted. The early warning must indicate whether the incident appears to involve malicious or unlawful acts and whether it has potential cross-border impact.
Can senior management be held personally liable under the NIS 2 Directive?
Yes. NIS2 Article 20 holds management bodies directly accountable for approving and overseeing cybersecurity risk management measures. Management members must receive cybersecurity training and can be personally liable for failures. In serious cases, competent authorities can issue temporary bans preventing individuals from holding management roles.
Does the NIS 2 Directive apply to non-EU companies?
NIS2 applies to entities that provide services within the EU, regardless of where they are established. Non-EU companies that offer services to EU customers in covered sectors are required to designate a representative in the EU under Article 26. That representative can be held accountable by national competent authorities.
Stop Managing NIS2 Compliance with Spreadsheets.
What Is NIS2 and Who Does It Apply To?
NIS2 (Directive EU 2022/2555) is the EU’s updated cybersecurity framework. It replaced the original NIS Directive and expanded the scope of organisations required to meet mandatory cybersecurity standards.
You’re covered if your organisation operates in the EU, falls within a covered sector, and meets the size thresholds below. The directive distinguishes between two tiers:
Personal liability is real. Article 20 makes management bodies directly accountable for approving and overseeing cybersecurity risk management measures.
NIS2 Directive Timeline: Where Things Stand Now
NIS2 was published in the Official Journal of the European Union as Directive EU 2022/2555.
The directive entered into force, replacing the original NIS Directive framework.
Member States reached the transposition deadline. In-scope organisations became legally obligated under national implementation laws.
National competent authorities gained powers to audit, inspect, issue binding instructions, and supervise NIS2 compliance.
Compliance evidence matters. Organisations need to show implemented controls, incident reporting readiness, supplier risk management, and management oversight.
National enforcement varies by country.
Each EU Member State designates competent authorities responsible for supervision. Germany uses BSI, France uses ANSSI, and the Netherlands uses the NCSC-NL.
The Article 21 Security Measures NIS2 Requires
Article 21 sets the operational backbone of NIS2 compliance. These are the minimum cybersecurity risk management areas your programme must be able to evidence.
Risk analysis and system security policies
Documented policies and risk analysis for network and information system security.
Incident handling
Processes for detecting, escalating, responding to, and documenting cybersecurity incidents.
Business continuity and crisis management
Backup management, disaster recovery, and crisis procedures that reduce operational disruption.
Supply chain security
Assessment and management of cybersecurity risk from suppliers, service providers, and third parties.
Secure acquisition, development, and maintenance
Security controls across systems procurement, development, deployment, vulnerability handling, and maintenance.
Effectiveness assessment
Policies and procedures to evaluate whether cybersecurity risk management measures actually work.
Cyber hygiene and training
Basic cyber hygiene practices and cybersecurity training across the organisation.
Cryptography and encryption
Policies and controls for appropriate use of cryptography and encryption.
HR security and access control
Human resources security, access control policies, and asset management.
Multi-factor authentication
Use of MFA and secure authentication where appropriate to reduce account compromise risk.
