NIS2 Requirements: A Practical Breakdown
NIS2 requirements are not guidelines. They are legal obligations backed by fines of up to €10 million or 2% of global annual turnover. Every essential and important entity operating in the EU must meet them. Full stop.
StartComply maps every one of these obligations to automated workflows, so your team spends time on actual security work rather than chasing spreadsheet cells.
Trusted by 100+ organisations across Europe
Article 21 
Article 23 
Access control 
Audit evidence What you need to know about NIS2 requirements
- NIS2 requirements apply to essential and important entities across 18 sectors. Size thresholds apply but are not absolute.
- Article 21 mandates ten categories of security measures. All require operational evidence, not just written policies.
- Article 23 sets hard incident reporting deadlines: 24-hour early warning, 72-hour detailed notification, one-month final report.
- Articles 20 and 32 make management personally liable for NIS2 infringements. Board members must approve and oversee security measures.
- Supply chain security is a specific Article 21 obligation requiring continuous third-party monitoring, not annual questionnaires.
- MFA is explicitly required under Article 21(2)(j), making it a mandatory control rather than a best practice recommendation.
- Fines for NIS2 non-compliance reach €10 million or 2% of global annual turnover for essential entities.
Last updated January 2025.
NIS2 requirements are legal obligations, not annual checklist items.
Article 21, Article 23, Articles 20 and 32
- Article 21 mandates ten categories of security measures
- Article 23 sets hard incident reporting deadlines
- Articles 20 and 32 make senior management personally liable
- Every essential and important entity operating in the EU must meet them
- Fines can reach €10 million or 2% of global annual turnover
Compliance reality: These are not items to tick off a checklist once a year and forget.
Evidenced controls, not written policies alone
- Training completion records
- Penetration test results
- Business continuity exercise reports
- Supply chain assessment outputs
- Access review logs and process records
Audit reality: Each category requires evidenced controls, not just written policies.
NIS2 Requirements at a Glance
Who the NIS2 Requirements Apply To
NIS2 significantly expanded the scope of the original NIS Directive. Understanding whether your organisation is in scope is the first requirement of all.
The Directive divides in-scope entities into two tiers. Essential entities include operators in energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. Important entities cover postal services, waste management, chemicals, food, manufacturing, digital providers, and research. If your organisation operates in one of these sectors and exceeds 50 employees or €10 million in annual turnover, you are almost certainly in scope.
Size thresholds are not absolute. NIS2 Article 2(2) allows member states to designate smaller entities as essential or important regardless of size if they are sole providers of critical services.
Essential vs Important Entities: Key Differences
The distinction matters because it determines your supervisory regime. Essential entities face proactive, continuous oversight. Important entities are subject to reactive supervision, meaning regulators investigate following an incident or complaint rather than conducting scheduled audits.
Both tiers must meet the same substantive security requirements under Article 21. The difference is enforcement intensity. Essential entities can expect regular inspections, on-site visits, and requests for audit evidence without needing a triggering incident. Plan accordingly.
The compliance burden does not disappear for important entities. The difference is when and how scrutiny usually starts.
NIS2 Article 21: The Ten Security Requirement Categories
Article 21 is the operational core of the NIS2 requirements. It mandates that essential and important entities implement security measures across ten specific categories. These are not optional controls. Regulators will audit against them.
Each category requires evidenced controls, not just written policies. You need operational proof: training completion records, penetration test results, business continuity exercise reports, and supply chain assessment outputs.
Risk analysis and information system security policies
Evidenced methodology, current risk analysis, and approved security policies.
Incident handling
Processes to detect, classify, respond to, and report significant incidents.
Business continuity, including backup management and disaster recovery
Continuity planning, backup management, disaster recovery, and tested recovery evidence.
Supply chain security
Security in relationships with direct suppliers and service providers.
Security in network and information systems acquisition, development, and maintenance
Secure acquisition, development, maintenance, vulnerability handling, and system lifecycle controls.
Policies and procedures to assess the effectiveness of security measures
Documented review, testing, and effectiveness assessment of implemented security measures.
Basic cyber hygiene practices and cybersecurity training
Cyber hygiene practices and training completion records for relevant staff and management.
Policies and procedures regarding the use of cryptography and encryption
Defined and evidenced cryptography and encryption policies and procedures.
Human resources security, access control policies, and asset management
HR security, access control policies, privileged access, remote access, and asset management.
Use of multi-factor authentication or continuous authentication solutions
MFA or continuous authentication solutions, including evidence of implementation.
Three NIS2 Requirements That Need Operational Proof
Risk Analysis and Security Policies
Your organisation must maintain a current risk analysis methodology and apply it continuously. Annual risk assessments do not meet the bar. NIS2 expects you to identify, assess, and treat risks as your environment changes, and to evidence that process.
Security policies must be formally approved, version-controlled, and linked to specific controls. A policy approved in 2022 and never reviewed is a liability, not an asset. StartComply automates policy review cycles and flags overdue approvals before they become audit findings.
Supply Chain Security Requirements
Supply chain security is one of the most operationally demanding NIS2 requirements. Article 21(2)(d) requires organisations to address security in relationships with direct suppliers and service providers. You must assess the security practices of your third parties, include security clauses in contracts, and monitor those relationships continuously.
This is not a one-time vendor questionnaire exercise. Regulators expect you to know which suppliers are critical, what risks they introduce, and what you have done to mitigate those risks. Our nis 2 directive guide covers the legislative context in detail.
Multi-Factor Authentication and Access Control
MFA is explicitly named in Article 21(2)(j). This is unusual for a framework regulation: most directives set principles and leave controls to standards. The explicit MFA reference signals how seriously regulators view identity-based attacks.
Access control policies must be documented and enforced, covering privileged access, remote access, and third-party access. Evidence of implementation means more than a policy. It means configuration exports, access review logs, and joiners-movers-leavers process records.
NIS2 Article 23: Incident Reporting Requirements
The deadlines run from the moment you become aware, not from when the incident started or when your team agrees it is significant.
When a significant incident occurs, you must submit an early warning within 24 hours of becoming aware.
A detailed incident notification follows within 72 hours, including an initial assessment of severity and impact.
A final report is due within one month of submitting the detailed notification.
The reporting chain goes to your national competent authority or CSIRT. Most member states have a designated NIS2 authority.
Failure to report on time is a separate infraction from the underlying security failure. You can be fined for both.
What Counts as a Significant Incident
A significant incident is defined as one that causes or is capable of causing severe operational disruption, financial loss, or significant impact on other natural or legal persons. This is a broad definition. When in doubt, report.
ENISA guidance and national competent authority publications have clarified the criteria. Consider an incident significant if it causes service unavailability for a large number of users, results in data loss affecting your ability to deliver services, involves a breach of critical systems, or triggers major financial loss.
When assessing significance, apply the test quickly. The 24-hour clock starts at the point of awareness, and an organisation that delays classification because it is unsure whether an incident is significant enough will still miss the deadline. Build decision trees into your incident response playbooks so the classification happens in minutes, not hours.
When in doubt, report. The Article 23 timelines are short and non-negotiable.
Management Accountability Under NIS2
NIS2 Articles 20 and 32 created something that the original NIS Directive did not: personal accountability for senior management. This is not boilerplate liability language. It has teeth.
Article 20 requires management bodies to approve cybersecurity risk management measures and oversee their implementation. Management body members must undertake cybersecurity training. They can be held personally liable for infringements of the Directive if the organisation fails to meet its obligations.
This accountability requirement changes the compliance conversation. Security is no longer a technical matter delegated to IT. It is a boardroom obligation with personal consequences attached. StartComply produces board-level reporting dashboards that give management real-time visibility into compliance posture, with evidence trails regulators can inspect.
For essential entities, competent authorities can temporarily prohibit a person from exercising managerial functions if serious infringements persist. This means your CISO or CEO can be barred from their role.
How to Meet NIS2 Requirements Without Building a Compliance Empire
Compliance teams are not infinite. Most organisations in scope for NIS2 have small security and compliance functions. Building manual processes around ten Article 21 categories, 24-hour incident reporting, continuous supply chain monitoring, and board reporting is not realistic without automation.
Spreadsheets will not get you through a NIS2 audit. A spreadsheet cannot send automated alerts when a supplier questionnaire is overdue. It cannot notify your incident response team the moment a ticket breaches the 24-hour reporting threshold. It cannot generate an audit-ready evidence pack on demand when a regulator asks for it.
StartComply automates the entire NIS2 compliance workflow. Controls are continuously monitored and mapped to Article 21 categories. Incident workflows enforce the Article 23 timelines automatically. Supplier assessments are distributed, tracked, and scored without manual chasing. Evidence is centralised and export-ready at any time.
For a full overview of the regulatory landscape, including scope, penalties, and transposition timelines across member states, see our NIS2 compliance guide. To understand the legislative background and how NIS2 evolved from its predecessor, our what is nis2 page covers the context in detail.
The organisations that will struggle are those treating NIS2 as a documentation exercise. The organisations that will pass audits are those that have operationalised every requirement, can evidence it continuously, and can generate proof within hours of a regulator asking. That is what compliance automation is for.
Mapping NIS2 Requirements to ISO 27001:2022
Many organisations in scope for NIS2 are already running an ISO 27001:2022 programme. The overlap is significant but not complete. ISO 27001:2022 Annex A controls cover most of the Article 21 categories, but NIS2 adds specific obligations around incident reporting timelines, supply chain security depth, and management accountability that ISO does not mandate in the same way.
Running both frameworks in parallel does not mean running two separate programmes. A unified control framework mapped to both NIS2 and ISO 27001 eliminates duplication and reduces audit preparation time considerably. StartComply supports multi-framework mapping out of the box, so a single control can satisfy obligations across NIS2, ISO 27001, and DORA simultaneously.
One control can satisfy multiple obligations. That is the point of multi-framework mapping.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About NIS2 Requirements
What are the main NIS2 requirements organisations must meet?
NIS2 requirements fall into three main areas. First, security measures under Article 21: ten categories covering risk analysis, incident handling, business continuity, supply chain security, access control, MFA, cryptography, cyber hygiene training, and asset management. Second, incident reporting under Article 23: a 24-hour early warning, 72-hour detailed notification, and one-month final report for significant incidents. Third, management accountability under Article 20: board-level approval and oversight of cybersecurity measures, with personal liability attached. All requirements apply to both essential and important entities.
What fines can organisations face for failing NIS2 requirements?
Essential entities face fines of up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face fines of up to €7 million or 1.4% of global annual turnover. These figures are maximums. Actual fines depend on the severity, duration, and impact of the infringement, as well as whether the organisation cooperated with the competent authority. Management can also face personal sanctions, including temporary bans from exercising managerial functions.
How long do you have to report a cybersecurity incident under NIS2?
NIS2 Article 23 sets three reporting obligations. An early warning to your national competent authority or CSIRT must be submitted within 24 hours of becoming aware of a significant incident. A detailed incident notification follows within 72 hours, including an initial assessment of severity and impact. A final report is due within one month of submitting the detailed notification. The clock starts when your organisation becomes aware of the incident, not when it began. Missing any deadline is a separate infraction that can attract its own fine.
Does NIS2 apply to small businesses?
Generally, NIS2 applies to organisations with more than 50 employees or over €10 million in annual turnover operating in one of 18 designated sectors. However, Article 2(2) allows member states to designate smaller entities as essential or important if they are critical sole providers of a service, or if disruption could have a significant impact on public safety or security. Micro-enterprises are typically excluded, but you should verify your position against the national transposition law in each EU member state where you operate.
What is the difference between essential and important entities under NIS2?
Both tiers must meet the same substantive security requirements under Article 21. The difference is the supervisory regime. Essential entities face proactive, ongoing supervision: regular inspections, on-site audits, and continuous oversight by the competent authority. Important entities are subject to reactive supervision, meaning the regulator investigates following an incident, complaint, or evidence of a breach rather than conducting scheduled audits. Essential entities also face higher maximum fines. The distinction does not reduce the compliance burden for important entities; it changes when you are likely to be scrutinised.
Are company directors personally liable under NIS2?
Yes. NIS2 Article 20 requires management bodies to approve cybersecurity risk management measures and oversee their implementation. Article 32 allows competent authorities to hold natural persons in managerial positions personally liable for infringements committed by essential entities. For persistent serious infringements, authorities can temporarily ban an individual from exercising managerial functions across the organisation. This makes NIS2 compliance a board-level obligation, not a matter that can be fully delegated to IT or security teams.
