Key takeaways
- NIS2 — Directive (EU) 2022/2555 — replaced the original NIS Directive. Member states had to apply it from 18 October 2024, though transposition has been uneven.
- It reaches medium-sized and large organisations in many more sectors than before, including manufacturers of machinery, vehicles, electronics and medical devices.
- Article 21 sets ten minimum measures, from incident handling and supply-chain security to secure development, vulnerability handling and multi-factor authentication.
- Significant incidents need an early warning within 24 hours and an incident notification within 72 hours.
- Management bodies must approve the measures, oversee them and take training, and can be held liable.
Who is in scope
NIS2 replaced the 2016 NIS Directive. Member states had until 17 October 2024 to write it into national law and apply it from the next day. Several missed that date, so the national law that applies to you may differ in detail and timing from the directive itself.
Scope widened sharply. Broadly, medium-sized and large organisations in the sectors the directive lists are in — as essential or important entities, depending on sector and size — and a few, such as DNS and trust service providers, are in regardless of size. The sectors run from energy, transport, health, drinking water, digital infrastructure, managed ICT services and public administration to postal services, chemicals, food, research, digital providers and the manufacture of medical devices, electronics, machinery and vehicles. For banks and other financial entities, DORA applies as the sector-specific act.
The ten minimum measures
Article 21 requires appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach, and lists ten that every entity must cover. Most of them are engineering work:
| Measure | What it means for engineering |
|---|---|
| Risk analysis and security policies | A written view of what you run, what could go wrong and what you do about it, kept current as systems change |
| Incident handling | Detection, triage and response that someone has rehearsed |
| Business continuity and crisis management | Backups that are restored in tests, and recovery that has been timed |
| Supply chain security | Knowing which suppliers and components each service depends on, and how secure they are |
| Secure acquisition, development and maintenance | Secure development practice, including vulnerability handling and disclosure |
| Assessing effectiveness | Measuring whether the controls work, not just that they exist |
| Cyber hygiene and training | Patching, configuration baselines, and training people actually take |
| Cryptography | Policies for encryption, and keys that are managed rather than scattered |
| People, access and assets | Joiners, movers and leavers handled promptly, and an asset inventory you trust |
| Multi-factor authentication and secure communications | MFA where it matters, and secured voice, video and text for emergencies |
Reporting starts with a 24-hour clock
Article 23 sets the sequence for significant incidents: an early warning to the national CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours with an initial assessment, and a final report within a month of that notification. The hard part is the first decision — is this significant? — made quickly, and recorded.
- Agree the significance criteria in advance, in terms your on-call engineers can apply at night.
- Test the route to your CSIRT before you need it: who sends the early warning, and how.
- Capture the timeline automatically from monitoring, alerts and chat, so the 72-hour notification is assembled, not remembered.
Management is accountable
Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee how they are implemented and follow training, and lets them be held liable for infringements. Member states must set maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher.
That changes the conversation with engineering. A board that must sign off the measures needs evidence it can read: what is covered, what is not, and what is being done about the gaps.
Supply chain security is a delivery problem
Every library, cloud service and supplier in the path of a critical service is part of your attack surface. A software bill of materials for what you build, an inventory of what you buy and a security clause in each contract are the minimum. The work is keeping them current: a dependency added in a sprint should update the record in the same sprint.
Where to start
Confirm your scope
Check the national law in each country you operate in, and whether you are an essential or an important entity.
Map services to measures
For each critical service, which of the ten measures are covered, by what, and with what evidence.
Rehearse the first 24 hours
Run an incident exercise to the early-warning deadline, and fix whatever slowed the decision.
Report to the board in its language
Coverage, gaps and plans, rather than a list of tools.