Regulation
What is NIS2?
Also known as: NIS2, NIS 2, Directive (EU) 2022/2555
NIS2 (Directive (EU) 2022/2555) is the EU law that sets cybersecurity risk-management and incident-reporting obligations for medium and large organisations in critical sectors, and makes their management bodies accountable for cybersecurity.
NIS2 replaced the original NIS Directive and widened its scope considerably: it now covers essential and important entities in sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing and digital providers.
Member states had to transpose the directive into national law by 17 October 2024; the national laws set the supervisory authority, registration duties and fines. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.
Core obligations
- Cybersecurity risk-management measures (Article 21): policies, incident handling, business continuity, supply chain security, secure development, vulnerability handling, cryptography, access control, training
- Incident reporting (Article 23): early warning within 24 hours, notification within 72 hours, final report within one month
- Management bodies approve and oversee the measures, follow training and can be held liable (Article 20)
- Registration with the national authority
How Clateway helps
- NIS2 compliance and readiness – Get NIS2 compliant: readiness assessment, AI-generated NIS2 policies, risk register, supplier security, incident management and board reporting in one platform.
- Technology and cyber board advisory – Independent technology and cyber expertise for boards and supervisory boards: advice on management's plans, NIS2 accountability, AI governance and director briefings.
- Vendor and third-party risk management – Third-party risk management: vendor registry, risk scoring, breach history, adverse media monitoring, fourth parties, contract lifecycle and renewal alerts.