What Is NIS2? The EU Cybersecurity Directive Explained
NIS2 is the European Union’s second Network and Information Systems directive, replacing NIS1 and significantly expanding the scope, obligations, and penalties for cybersecurity across the EU. The directive is not advisory. NIS2 creates binding legal obligations for thousands of organisations across 18 critical sectors, covering everything from incident reporting timelines to board-level accountability.
Trusted by 100+ organisations across Europe
NIS2 
Article 21 
Audit Ready 
DORA + GDPR Context What you need to know about NIS2
- NIS2 is a binding EU directive that entered into force in January 2023 and required national transposition by 17 October 2024.
- It applies to medium and large organisations in 18 critical sectors, covering essential and important entities across the EU.
- Article 21 sets out ten mandatory cybersecurity measures, including supply chain security, incident handling, and multi-factor authentication.
- Incident reporting timelines are strict: 24-hour early warning, 72-hour detailed notification, one-month final report.
- Management bodies must approve cybersecurity measures and can be held personally liable for serious infringements under Article 20.
- Fines reach €10 million or 2% of global annual turnover for essential entities.
- NIS2 sits alongside DORA and GDPR, and organisations in scope for multiple regimes need joined-up compliance programmes.
Source: Directive (EU) 2022/2555. Last updated April 2026.
NIS2 is binding law. Compliance can no longer live in spreadsheets.
A documented, evidenced cybersecurity programme
- Risk analysis and information system security policies
- Incident handling and strict reporting timelines under Article 23
- Business continuity, backup management, and disaster recovery
- Supply chain security for direct suppliers and service providers
- Management body approval, oversight, and cybersecurity training
Penalty exposure: Essential entities face fines up to €10 million or 2% of global annual turnover. Important entities face fines up to €7 million or 1.4% of global annual turnover.
Quarterly evidence reviews, scattered policies, and audit panic
- Incident classification procedures that are not operational before an incident occurs
- Vendor risk management policies without evidenced supplier assessments
- Board training records that cannot prove management body understanding
- Quarterly spreadsheets instead of continuous evidence collection
- Separate evidence repositories for NIS2, DORA, GDPR, and ISO 27001
- No clear audit trail connecting controls, owners, evidence, and remediation
The audit reality: regulators do not ask whether you have policies. They ask for evidence that the measures are implemented, monitored, and overseen.
How StartComply Makes NIS2 Compliance Operational
Article 21 Control Mapping
Map each technical, operational, and organisational measure to the relevant NIS2 obligation. StartComply helps teams connect controls to policy, ownership, evidence, and remediation.
- Risk analysis and information system security policies
- Business continuity, backup management, and disaster recovery
- Cryptography, encryption, access control, and asset management
- Multi-factor authentication and secure communications
Continuous Evidence Collection
Evidence collection is continuous, not periodic. StartComply automates evidence gathering so your compliance team spends time on risk decisions rather than administrative assembly.
- Automated evidence workflows linked to control owners
- Audit-ready records for measures, dates, actions, and approvals
- Centralised evidence across NIS2, DORA, GDPR, and ISO 27001
- Reporting workflows designed for supervisory review
Incident and Supplier Risk Readiness
NIS2 requires operational procedures before the regulator comes knocking. StartComply helps structure the evidence behind incident handling, supplier risk, and board accountability.
- 24-hour, 72-hour, and one-month incident reporting workflows
- Supply chain security evidence for Article 21(2)(d)
- Management body briefing and cybersecurity training records
- Remediation tracking from gap analysis to audit-ready status
The Difference Between NIS1 and NIS2
NIS2 replaces a narrow, inconsistent directive with a broader and more enforceable cybersecurity framework for the EU.
StartComply helps organisations move from NIS1-style policy coverage to an evidenced NIS2 programme mapped to specific obligations.
What Is NIS2 and Why Does It Exist?
NIS2 stands for the Network and Information Systems Directive 2, formally known as Directive (EU) 2022/2555. The European Parliament adopted it in November 2022 as a direct response to the failures and limitations of the original NIS directive, which came into force in 2016.
The original NIS directive was too narrow. It covered a limited set of operators of essential services and digital service providers, but the scope was inconsistent across member states. Enforcement was weak. Incident reporting thresholds varied wildly. The result was a patchwork of cybersecurity standards across the EU that left critical infrastructure genuinely exposed.
NIS2 fixes that fragmentation by harmonising requirements across all member states and dramatically widening the scope of who must comply. It introduces a two-tier classification system, essential entities and important entities, each carrying different supervisory regimes and penalty structures. The directive also moves cybersecurity accountability firmly into the boardroom, requiring management bodies to approve and oversee cybersecurity measures directly.
StartComply is built specifically for this. Our platform maps your controls to NIS2 Article 21, automates evidence collection, and keeps your compliance programme audit-ready without the spreadsheet chaos that most teams still rely on.
NIS2 Incident Reporting Timelines
Early warning notification Article 23
If your organisation experiences a significant incident, you must notify your national competent authority and CSIRT within 24 hours of becoming aware. That is the early warning notification.
Detailed incident notification Severity and impact
Within 72 hours, you must submit a more detailed incident notification that includes an initial assessment of severity, impact, and indicators of compromise.
Final incident report Root cause analysis
A final report is due within one month, covering a full description of the incident, root cause analysis, and any cross-border impact.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About NIS2
What does NIS2 stand for and when does it apply?
NIS2 stands for the Network and Information Systems Directive 2, formally Directive (EU) 2022/2555. It entered into force in January 2023 and member states were required to transpose it into national law by 17 October 2024. From that date, in-scope organisations must comply with the directive’s cybersecurity obligations or face significant financial penalties. If your national law has transposed NIS2, it applies to you now.
How do I know if my organisation is in scope for NIS2?
Two factors determine scope: sector and size. Your organisation must operate in one of the 18 sectors listed in NIS2 Annexes I or II, and it must be a medium or large enterprise. Medium means 50 or more employees or annual turnover above €10 million. Large means 250 or more employees or turnover above €50 million. Some small organisations can be brought into scope by national authorities if they are deemed critical. Check your national transposition law for any additional criteria.
What is the difference between essential and important entities under NIS2?
Both tiers face identical cybersecurity obligations under Article 21. The difference is supervisory approach. Essential entities face proactive, ex-ante supervision, meaning regulators can audit them at any time. Important entities face ex-post supervision, where regulators typically act following an incident or complaint. The penalty caps also differ: essential entities face fines up to €10 million or 2% of global turnover, while important entities face up to €7 million or 1.4% of global turnover.
What are the NIS2 incident reporting deadlines?
NIS2 Article 23 requires a three-stage reporting process for significant incidents. Within 24 hours of becoming aware of an incident, you must submit an early warning to your national CSIRT or competent authority. Within 72 hours, a more detailed incident notification is required, including severity assessment and indicators of compromise. A final report covering root cause analysis and full impact assessment is due within one month. These timelines are non-negotiable and your incident response procedures must be operational before an incident occurs.
Does NIS2 apply to companies outside the EU?
NIS2 can apply to non-EU companies if they provide services to recipients in the EU and fall within a covered sector. In such cases, the organisation must designate a representative in an EU member state. The lead supervisory authority is typically determined by where the EU representative is located or where the organisation has its main establishment within the EU. Non-EU organisations should not assume the directive does not apply simply because their headquarters are outside Europe.
How does NIS2 relate to ISO 27001?
ISO 27001 certification provides a strong foundation, but it does not satisfy NIS2 compliance on its own. NIS2 adds specific legal obligations, including mandatory incident reporting timelines, supply chain security requirements mapped to Article 21(2)(d), and management body accountability under Article 20. Regulators will not accept ISO certification as a substitute for evidenced compliance with NIS2’s specific requirements. That said, organisations with a mature ISO 27001 programme can map many existing controls to NIS2 obligations and close gaps more efficiently.
Get Your NIS2 Programme Audit-Ready.
Which Organisations Fall Within NIS2 Scope?
NIS2 applies to medium and large organisations operating in sectors the directive classifies as either highly critical or critical. A medium organisation is defined as one with 50 or more employees or an annual turnover exceeding €10 million. A large organisation exceeds 250 employees or €50 million in annual turnover.
The distinction between essential and important entities matters for supervision, not for the security obligations themselves. Both tiers must meet the same cybersecurity requirements under Article 21.
Important entities face ex-post supervision. Essential entities are subject to proactive, ex-ante supervision, meaning regulators can audit them, inspect their systems, and issue binding instructions without waiting for an incident.
NIS2 Compliance Timeline: Where Things Stand Now
The European Parliament adopted NIS2 as Directive (EU) 2022/2555, replacing the original NIS directive.
NIS2 entered into force, beginning the transition to a broader EU cybersecurity framework.
Member states were required to transpose NIS2 into national law by this date.
From national transposition onward, in-scope organisations must comply with the directive’s cybersecurity obligations or face significant financial penalties.
Incident classification, reporting, supplier risk, and evidence procedures need to be operational before a significant incident occurs.
Operating in multiple member states?
NIS2 applies in each jurisdiction. Your lead supervisory authority is typically the member state where your main establishment is located. You cannot consolidate compliance under one filing and consider yourself covered everywhere without checking local transposition laws.
The 10 Minimum Measures Under NIS2 Article 21
Article 21 requires organisations to implement appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risk. The directive specifies ten minimum measures that must be in place.
Risk analysis and system security policies
Policies and processes for identifying and managing cybersecurity risk across network and information systems.
Incident handling
Procedures for detecting, classifying, responding to, and reporting significant cybersecurity incidents.
Business continuity
Backup management, disaster recovery, and crisis management procedures that preserve operational resilience.
Supply chain security
Security risks arising from relationships with direct suppliers and service providers must be addressed and evidenced.
Secure acquisition, development, and maintenance
Security in network and information systems acquisition, development, maintenance, and vulnerability handling.
Effectiveness assessment
Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
Cyber hygiene and training
Basic cyber hygiene practices and cybersecurity training across the organisation.
Cryptography and encryption
Policies and procedures for the use of cryptography and, where appropriate, encryption.
HR security, access control, and asset management
Human resources security, access control policies, and asset management requirements.
Multi-factor authentication
Use of multi-factor authentication or continuous authentication solutions and secure communications where appropriate.
