NIS2 Directive Explorer

Aspect	NIS2	DORA	ISO 27001	NIST CSF
Type	EU Directive (transposed)	EU Regulation (binding)	Voluntary standard	Voluntary framework
Sector	18 critical sectors	Financial services	Any	Any
Incident Reporting	24h early warning, 72h notification	4h initial, 72h intermediate	Internal process	Internal process
Supply Chain	Mandatory supply chain risk assessment	Detailed contractual & oversight rules	Annex A controls	Supply chain category
Pen Testing	Encouraged but not prescribed	Mandatory TLPT for significant entities	Recommended	Recommended
Board Accountability	Explicit personal liability & suspension	Explicit personal liability	Management commitment	Governance function

NIS2 Requirement	What It Means for You	Controls / Tools
Approve cybersecurity measures (Art. 20(1))	Management body must formally approve risk-management measures adopted under Art. 21	GRC platform, board reporting
Oversee implementation (Art. 20(1))	Active oversight of cybersecurity implementation, not passive delegation	Risk dashboards, audit reports
Board cybersecurity training (Art. 20(2))	Board members must undergo training; similar training offered to all employees	Training platform, LMS
Personal liability (Art. 20)	Board members can be held liable for infringements of Art. 21 obligations	Legal/compliance framework

Measure	Description	Tools / Controls
(a) Risk analysis & IS policies	Policies on risk analysis and information system security	GRC platform, policy management
(b) Incident handling	Procedures for detecting, managing, and resolving incidents	SIEM, SOAR, IR playbooks
(c) Business continuity & crisis mgmt	BCP, backup management, disaster recovery, crisis management	BCP/DR tools, backup solutions
(d) Supply chain security	Assess supplier/provider security including during procurement	TPRM platforms, vendor assessments
(e) Acquisition, development & maintenance	Security in network and IS lifecycle including vulnerability handling	SAST/DAST, SDLC tools, vuln scanning
(f) Effectiveness assessment	Policies to evaluate effectiveness of cybersecurity measures	Pen testing, audits, KPIs
(g) Cyber hygiene & training	Basic cyber hygiene practices and cybersecurity training	Awareness training, phishing simulations
(h) Cryptography & encryption	Policies and procedures for cryptographic controls	Key management, PKI, encryption tools
(i) HR security, access control, asset mgmt	Human resources security, access control, and asset management	IAM, PAM, CMDB
(j) MFA & continuous authentication	Multi-factor authentication, secured communications, emergency access	MFA providers, zero trust architecture

Criterion	Description
Severe operational disruption or financial loss	Has caused or is capable of causing severe operational disruption of services or financial loss for the entity
Affected natural or legal persons	Has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage

Power	Essential Entities	Important Entities
Supervision type	Proactive (ex-ante)	Reactive (ex-post)
On-site inspections	Yes (Art. 32(2)(a))	Yes, when triggered (Art. 33(2)(a))
Security audits	Regular and targeted (Art. 32(2)(b))	Evidence-based (Art. 33(2)(b))
Security scans	Based on risk assessment (Art. 32(2)(c))	When justified (Art. 33(2)(c))
Information requests	Yes (Art. 32(2)(d))	Yes (Art. 33(2)(d))
Access to data/docs	Yes (Art. 32(2)(e))	Yes (Art. 33(2)(e))

Aspect	Essential Entities	Important Entities
Maximum fine	EUR 10M or 2% of global turnover	EUR 7M or 1.4% of global turnover
Supervision model	Proactive, ex-ante	Reactive, ex-post (evidence triggered)
Management suspension	Yes — temporary ban on management functions	Not applicable
Binding instructions	Yes	Yes (when non-compliance found)
Public naming	Yes (naming and shaming)	Yes
Compliance orders	Yes, with deadline	Yes, with deadline

Art. 1 Subject Matter Standard ▶

Establishes measures aimed at achieving a high common level of cybersecurity across the Union.

Key Points

Obligations on Member States to adopt national cybersecurity strategies and designate competent authorities and CSIRTs
Cybersecurity risk-management and reporting obligations for essential and important entities
Rules on cybersecurity information sharing
Supervisory and enforcement obligations for Member States

Art. 2 Scope Important ▶

Defines who is in scope. Applies a "size-cap" rule: entities that are medium-sized or larger in sectors listed in Annex I and II.

Key Points

Applies to entities that qualify as medium-sized enterprises or exceed medium-size thresholds in designated sectors
Some entities are in scope regardless of size: DNS providers, TLD registries, qualified trust service providers, public electronic communications providers
Member States may extend scope to smaller entities meeting specific criteria
Entities subject to sector-specific EU legislation with equivalent requirements (e.g., DORA) are exempt from overlapping NIS2 obligations

Security Engineer Takeaway: The "size-cap" approach means many more entities are in scope compared to NIS1. If your organisation has 50+ employees or EUR 10M+ turnover and operates in a designated sector, you're likely covered. Check Annex I and II to confirm your sector classification.

Art. 3 Essential and Important Entities Important ▶

Defines the two-tier classification: essential entities and important entities. The classification determines the level of supervision and maximum penalties.

Essential Entities Include

Annex I entities exceeding the ceiling for medium-sized enterprises
Qualified trust service providers, TLD registries, DNS service providers (regardless of size)
Public electronic communications providers (medium+)
Public administration entities (central government)
Entities specifically designated by a Member State

Important Entities

Annex I or Annex II entities of medium size or above that are not classified as essential

Security Engineer Takeaway: Know your classification — it drives everything. Essential entities face proactive supervision and higher fines (EUR 10M/2% turnover). Important entities face reactive supervision and lower fines (EUR 7M/1.4%). If you're borderline, expect your national authority to clarify by April 2025.

Art. 4 Sector-Specific Union Legal Acts Important ▶

The lex specialis clause. Where sector-specific EU legislation imposes equivalent or greater cybersecurity requirements, those provisions prevail over NIS2.

Key Points

DORA (Regulation 2022/2554) is explicitly recognised as lex specialis for financial entities
Entities covered by equivalent sector-specific acts are exempt from corresponding NIS2 obligations (Art. 21 and 23)
The entity remains subject to NIS2 for any areas not covered by the sector-specific act
Commission maintains and publishes a list of sector-specific acts

Security Engineer Takeaway: If you're a financial entity subject to DORA, you're generally exempt from NIS2's risk management and incident reporting obligations. However, always check your national transposition — some Member States may layer additional NIS2 requirements beyond what DORA covers.

Art. 5 Minimum Harmonisation Standard ▶

NIS2 sets a floor, not a ceiling. Member States may adopt or maintain provisions ensuring a higher level of cybersecurity.

Art. 6 Definitions Important ▶

Key definitions you'll reference constantly:

Critical Definitions

Network and information system: Electronic communications networks, devices/programs processing digital data, and data stored/processed/retrieved by those elements
Security of network and information systems: The ability to resist events that compromise availability, authenticity, integrity, or confidentiality of data or services
Cybersecurity: Activities necessary to protect network and information systems and their users from cyber threats
Significant incident: An incident with severe operational disruption or financial loss, or affecting persons with considerable damage
Cyber threat: Any potential circumstance, event, or action that could damage, disrupt, or otherwise adversely impact network and information systems
Near miss: An event that could have compromised security but was prevented or did not materialise
ICT product, service, process: Any element or group of elements of network and information systems

Security Engineer Takeaway: The "significant incident" definition is key — it triggers your reporting obligations. Unlike DORA's multi-factor classification, NIS2 uses two simple tests: severe operational/financial disruption OR considerable damage to persons. The "near miss" definition is new and supports voluntary reporting under Art. 30.

Art. 7 National Cybersecurity Strategy Important ▶

Each Member State must adopt a national cybersecurity strategy addressing security of network and information systems.

Must Include

Objectives and priorities covering sectors referred to in Annexes I and II
Governance framework with clear roles and responsibilities
Policy on coordinated vulnerability disclosure
Policies promoting cybersecurity education, skills, and awareness
Policies supporting cybersecurity research and development
Supply chain security policies

Art. 8–10 Competent Authorities, Single Points of Contact, and CSIRTs Standard ▶

Member States must designate competent authorities, single points of contact, and CSIRTs for NIS2 implementation.

Key Points

At least one competent authority responsible for cybersecurity and supervision under NIS2
A single point of contact for cross-border cooperation
One or more CSIRTs covering all sectors in scope
CSIRTs must have adequate resources, technical capabilities, and staff

Art. 11–12 CSIRT Requirements and Coordinated Vulnerability Disclosure Standard ▶

CSIRT Tasks

Monitor and analyse cyber threats, vulnerabilities, and incidents at national level
Provide early warnings, alerts, announcements, and dissemination of information
Respond to incidents and provide assistance
Collect and analyse forensic data
Provide dynamic risk and incident analysis

Coordinated Vulnerability Disclosure

Member States must designate a CSIRT as coordinator for vulnerability disclosure
ENISA develops and maintains a European vulnerability database
Researchers can report vulnerabilities to the designated coordinator

Art. 13 NIS Cooperation Group Important ▶

A strategic cooperation group composed of Member State representatives, the Commission, and ENISA.

Tasks

Provide strategic guidance on NIS2 implementation
Exchange best practices on cybersecurity risk management and incident reporting
Discuss capabilities and preparedness of Member States
Carry out coordinated security risk assessments of critical supply chains (Art. 22)
Conduct peer reviews of Member State cybersecurity policies (Art. 19)

Art. 14–15 CSIRTs Network and EU-CyCLONe Standard ▶

CSIRTs Network

Network of national CSIRTs and CERT-EU for operational cooperation
Exchange information on incidents, cyber threats, and vulnerabilities
Coordinate response to cross-border incidents

EU-CyCLONe (Cyber Crisis Liaison Organisation Network)

Supports coordinated management of large-scale cybersecurity incidents and crises at EU level
Ensures regular exchange of information between Member States and EU institutions
Assesses consequences and impact of large-scale incidents
Coordinates crisis management at political level when needed

Art. 16–19 Reporting, ENISA Role, Peer Reviews, and Mutual Assistance Standard ▶

Key Points

ENISA produces biennial report on the state of cybersecurity in the EU
Peer review system for Member States' cybersecurity policies and capabilities
Framework for mutual assistance between competent authorities
ENISA supports the Cooperation Group, CSIRTs Network, and EU-CyCLONe

Art. 20 Governance Critical ▶

The management body (board, executive committee) bears direct responsibility for cybersecurity. This is personal and non-delegable.

Management Body Must

Approve the cybersecurity risk-management measures taken by the entity under Art. 21
Oversee the implementation of those measures
Can be held liable for infringements of Article 21
Members must follow cybersecurity training to gain sufficient knowledge and skills
Shall encourage the offering of similar training to employees on a regular basis

Security Engineer Takeaway: This is your biggest lever. Board members are personally liable and can be suspended (essential entities). When you need budget or priority, frame it as: "The management body is legally accountable under NIS2 Art. 20 and must demonstrate active oversight." Prepare board-level reporting that shows risk posture, compliance status, and training completion records.

References: EUR-Lex Art. 20

Art. 21 Cybersecurity Risk-Management Measures Critical ▶

The operational core. Ten mandatory cybersecurity measures that all essential and important entities must implement, based on an all-hazards approach.

The 10 Measures

(a) Policies on risk analysis and information system security
(b) Incident handling
(c) Business continuity, backup management, disaster recovery, and crisis management
(d) Supply chain security, including security-related aspects of relationships with direct suppliers and service providers
(e) Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure
(f) Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
(g) Basic cyber hygiene practices and cybersecurity training
(h) Policies and procedures regarding the use of cryptography and, where appropriate, encryption
(i) Human resources security, access control policies, and asset management
(j) Use of multi-factor authentication or continuous authentication solutions, secured voice/video/text communications, and secured emergency communication systems

Security Engineer Takeaway: Map your existing security controls to these 10 measures. If you have ISO 27001, ~70–80% is covered. Key additions: explicit supply chain assessment (d), mandatory effectiveness testing (f), cyber hygiene training for all staff (g), and MFA/secured comms (j). ENISA will publish technical guidance mapping these to recognized standards — use it for your gap analysis.

References: EUR-Lex Art. 21 ENISA NIS2 Guidance

Art. 22 Coordinated Security Risk Assessments of Critical Supply Chains Important ▶

The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT supply chains.

Key Points

Risk assessments consider technical and non-technical risk factors
Takes into account the 5G Toolbox experience
Cooperation Group identifies specific supply chains to assess
Results shared with competent authorities and may inform supervision

Art. 23 Reporting Obligations for Significant Incidents Critical ▶

Three-stage mandatory reporting for significant incidents. Entities must also notify service recipients without undue delay when the incident is likely to adversely affect their services.

Reporting Stages

Early warning (24h): Indicate whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact
Incident notification (72h): Update with initial assessment of severity and impact, and where applicable, indicators of compromise
Final report (1 month): Detailed description including severity, threat type or root cause, mitigation measures, and cross-border impact
Intermediate report: May be requested by CSIRT or competent authority at any time during ongoing incidents

Security Engineer Takeaway: Build three templates (early warning, notification, final report) and test them during tabletop exercises. The 24-hour early warning is simpler than a full notification — you just need to flag malicious/non-malicious and cross-border/local. Automate what you can: tie your SIEM's severity classification to NIS2 significance criteria so the clock starts as soon as the incident qualifies.

References: EUR-Lex Art. 23

Art. 24 Use of European Cybersecurity Certification Schemes Important ▶

Member States may require essential and important entities to use certified ICT products, services, and processes under European cybersecurity certification schemes.

Key Points

Member States may require use of certified products/services for compliance with Art. 21
Promotes EU-wide harmonised certification (Cybersecurity Act framework)
Commission may adopt delegated acts specifying which entities must use certified products

Art. 25 Standardisation Standard ▶

Member States shall promote the use of European and international standards and technical specifications relevant to cybersecurity risk management without imposing or favouring specific technology.

Art. 26 Jurisdiction Important ▶

Entities are considered under the jurisdiction of the Member State in which they are established.

Key Points

DNS providers, TLD registries, cloud services, data centres, CDNs, managed service providers, online marketplaces, search engines, and social networks: jurisdiction where main establishment is located
If not established in the EU but offers services: must designate a representative in the EU
Public administration entities: jurisdiction of the Member State that established them

Art. 27–28 Register of Entities and Database of Domain Name Registration Data Standard ▶

Entity Registration

ENISA creates and maintains a registry of DNS providers, TLD registries, cloud computing, data centres, CDNs, managed services, online marketplaces, search engines, and social networks
Member States notify ENISA of entities and their relevant information

Domain Name Registration Database

TLD registries and DNS registrars must maintain accurate domain name registration data (WHOIS/RDAP)
Must verify accuracy of registration data
Legitimate access seekers must receive responses within 72 hours

Art. 29 Cybersecurity Information-Sharing Arrangements Important ▶

Entities may share cybersecurity information including cyber threat intelligence, indicators of compromise, and vulnerabilities within trusted communities.

Key Points

Entities may exchange cyber threat information on a voluntary basis
Including indicators of compromise (IoCs), TTPs, security alerts, and configuration tools
Must protect personal data, business secrets, and competition law
Competent authorities may facilitate information sharing arrangements
Member States must support the establishment of information sharing arrangements

Security Engineer Takeaway: NIS2 gives you regulatory backing to participate in ISACs and threat intel sharing communities. Set up STIX/TAXII-compatible feeds, use TLP markings when sharing, and document your participation. Competent authorities are required to facilitate these arrangements — leverage this when advocating for budget.

Art. 30 Voluntary Notification Important ▶

Entities may notify voluntarily about significant incidents, cyber threats, and near misses, beyond mandatory reporting.

Key Points

Essential and important entities may voluntarily notify CSIRTs or competent authorities of near misses
Any entity (whether in scope or not) may notify cyber threats and near misses
Voluntary notifications are processed with the same procedures as mandatory ones
Mandatory notifications take priority over voluntary ones in terms of processing resources

Art. 31–32 Supervision of Essential Entities Critical ▶

Essential entities face proactive, ex-ante supervision. Competent authorities have extensive powers including on-site inspections and targeted security audits at any time.

Supervisory Measures for Essential Entities

On-site inspections and off-site supervision
Regular and ad hoc targeted security audits by an independent body or competent authority
Security scans based on objective, non-discriminatory criteria
Requests for information, including documented cybersecurity policies
Requests for evidence of implementation of cybersecurity measures

Enforcement Actions

Issue warnings about non-compliance
Adopt binding instructions with implementation deadlines
Order the entity to remedy deficiencies or comply with requirements
Order entities to inform persons affected by a significant incident
Designate a monitoring officer for a specific period
Temporarily prohibit management body members from exercising management functions

Security Engineer Takeaway: If you're an essential entity, expect proactive supervision — audits and inspections can happen without being triggered by an incident. Keep your documentation audit-ready at all times: policies, risk assessments, asset inventories, incident logs, and training records. The management suspension power (Art. 32(5)(b)) is the nuclear option that gives security teams unprecedented leverage with the board.

Art. 33 Supervision of Important Entities Critical ▶

Important entities face reactive, ex-post supervision triggered by evidence of non-compliance (e.g., from incident reports, audit findings, or complaints).

Supervisory Measures (When Triggered)

On-site inspections and off-site supervision
Targeted security audits by an independent body or competent authority
Security scans based on objective criteria
Requests for information, including cybersecurity policies and evidence of implementation

Enforcement Actions

Issue warnings and binding instructions
Order the entity to remedy deficiencies
Order entities to notify affected persons
No management body suspension power for important entities

Art. 34 General Conditions for Administrative Fines Critical ▶

Establishes the framework for administrative fines, including maximum amounts and criteria for determining fine levels.

Maximum Fines

Essential entities: EUR 10,000,000 or 2% of total worldwide annual turnover (whichever is higher)
Important entities: EUR 7,000,000 or 1.4% of total worldwide annual turnover (whichever is higher)

Criteria for Determining Fines

Gravity and duration of the infringement
Previous infringements by the entity
Material or non-material damage caused
Intentional or negligent character of the infringement
Measures taken to prevent or mitigate damage
Degree of cooperation with competent authorities

Security Engineer Takeaway: The fine criteria reward proactive compliance. "Measures taken to prevent or mitigate" and "degree of cooperation" mean that having a mature security programme and cooperating during investigations can significantly reduce fines. Document everything — your efforts at compliance are a defence even if an incident occurs.

Art. 35–37 Infringements, Penalties, and Mutual Assistance Important ▶

Key Points

When a personal data breach occurs within a significant incident, NIS2 competent authorities cooperate with GDPR supervisory authorities
Member States lay down rules on penalties applicable to NIS2 infringements
Penalties must be effective, proportionate, and dissuasive
Mutual assistance between competent authorities for cross-border supervision

Art. 38–39 Delegated and Implementing Acts Standard ▶

The Commission is empowered to adopt delegated acts and implementing acts to specify technical and methodological requirements for various NIS2 provisions.

Key Points

Commission may specify technical/methodological requirements for Art. 21 measures
Commission may specify cases where a sector-specific incident is considered significant
ENISA provides technical guidance (non-binding) on implementing the 10 cybersecurity measures

Art. 40–46 Transposition, Amendments, Review, and Final Provisions Standard ▶

Key Dates

NIS2 entered into force on 16 January 2023
Member States must transpose by 17 October 2024
Measures apply from 18 October 2024
NIS1 Directive (2016/1148) repealed from 18 October 2024
Commission review by 17 October 2027

What	To Whom	When	Article
Significant incident — early warning	CSIRT or competent authority	Within 24 hours of becoming aware	Art. 23(4)(a)
Significant incident — notification	CSIRT or competent authority	Within 72 hours of becoming aware	Art. 23(4)(b)
Significant incident — final report	CSIRT or competent authority	Within 1 month of notification	Art. 23(4)(d)
Intermediate report (if ongoing)	CSIRT or competent authority	Upon request or status change	Art. 23(4)(c)
Customer notification (significant)	Affected service recipients	Without undue delay	Art. 23(1)
Voluntary near-miss notification	CSIRT or competent authority	Voluntary, without undue delay	Art. 30
Entity registration	Competent authority / ENISA	By 17 April 2025	Art. 3(3)

#	Sector	Examples	Classification	Size Threshold
1	Energy	Electricity, oil, gas, hydrogen, district heating operators	Essential	Medium+
2	Transport	Air carriers, railway operators, waterway, road authorities	Essential	Medium+
3	Banking	Credit institutions (see DORA lex specialis)	Essential*	Medium+
4	Financial Market Infrastructure	Trading venues, CCPs (see DORA lex specialis)	Essential*	Medium+
5	Health	Healthcare providers, EU reference labs, pharma manufacturers, medical device mfrs	Essential	Medium+
6	Drinking Water	Suppliers and distributors of water for human consumption	Essential	Medium+
7	Waste Water	Operators collecting, disposing, or treating urban/industrial waste water	Essential	Medium+
8	Digital Infrastructure	IXPs, DNS providers, TLD registries, cloud computing, data centres, CDNs, trust services	Essential	Any size
9	ICT Service Management (B2B)	Managed service providers (MSPs), managed security service providers (MSSPs)	Essential or Important	Medium+
10	Public Administration	Central government entities (excluding judiciary, parliament, central banks)	Essential	N/A
11	Space	Operators of ground-based infrastructure supporting space-based services	Essential	Medium+

#	Sector	Examples	Classification	Size Threshold
12	Postal & Courier Services	Postal service providers including courier services	Important	Medium+
13	Waste Management	Operators carrying out waste management	Important	Medium+
14	Chemicals	Manufacturers, producers, and distributors of chemicals	Important	Medium+
15	Food	Food businesses engaged in distribution, production, or processing	Important	Medium+
16	Manufacturing	Medical devices, computers/electronics, machinery, motor vehicles, transport equipment	Important	Medium+
17	Digital Providers	Online marketplaces, online search engines, social networking platforms	Important	Medium+
18	Research	Research organisations	Important	Medium+

NIS2 Directive at a Glance

The Five Pillars

Pillar 1: Governance & Accountability

Pillar 2: Cybersecurity Risk Management

Pillar 3: Incident Reporting

Pillar 4: Supply Chain Security

Pillar 5: Supervision & Enforcement

Why Should a Security Engineer Care?

It Covers Nearly Every Sector

It Has Real Teeth

Board-Level Accountability

24-Hour Early Warning

NIS2 vs. Frameworks You Already Know

The Five Pillars — Deep Dive

Pillar 1: Governance & Accountability (Article 20)

Key Governance Requirements

Pillar 2: Cybersecurity Risk Management (Article 21)

The 10 Mandatory Cybersecurity Measures

Pillar 3: Incident Reporting (Articles 23–24)

Significant Incident Criteria (Art. 23(3))

Reporting Timeline

Pillar 4: Supply Chain Security (Articles 21(2)(d) & 22)

Key Supply Chain Obligations

Supplier Risk Assessment (Art. 21(2)(d))

Coordinated Risk Assessments (Art. 22)

Procurement Security (Art. 21(3))

Supply Chain Incident Handling (Art. 23)

Pillar 5: Supervision & Enforcement (Articles 31–37)

Supervisory Powers

Enforcement: Essential vs Important

Article Explorer

Chapter I — General Provisions

Key Points

Key Points

Essential Entities Include

Important Entities

Key Points

Critical Definitions

Chapter II — Coordinated Cybersecurity Frameworks

Must Include

Key Points

CSIRT Tasks

Coordinated Vulnerability Disclosure

Tasks

Chapter III — Cooperation

CSIRTs Network

EU-CyCLONe (Cyber Crisis Liaison Organisation Network)

Key Points

Chapter IV — Cybersecurity Risk-Management Measures and Reporting Obligations

Management Body Must

The 10 Measures

Key Points

Reporting Stages

Key Points

Chapter V — Jurisdiction and Registration

Key Points

Entity Registration

Domain Name Registration Database

Chapter VI — Information Sharing

Key Points

Key Points

Chapter VII — Supervision and Enforcement

Supervisory Measures for Essential Entities

Enforcement Actions

Supervisory Measures (When Triggered)

Enforcement Actions

Maximum Fines

Criteria for Determining Fines

Key Points

Chapter VIII–IX — Delegated Acts, Implementing Acts, and Final Provisions

Key Points

Key Dates

Obligation Matrix

Management Body Obligations

Approve Cybersecurity Measures

Undergo Cybersecurity Training

Designate Responsibilities

Risk Acceptance

Security / ICT Team Obligations

Implement 10 Security Measures