NIS2

NIS2: who is affected and what to do next

By CyberSec42 · Updated 2026

NIS2 applies to medium and large companies across 18 sectors classified as important or essential, and in many cases to their suppliers as well. The EU directive widens the circle of regulated organisations considerably compared with the original NIS directive, and it requires demonstrable risk management, short reporting lines and accountability at management level. Checking now whether you fall within scope saves you time pressure and liability exposure later.

This article sets out the requirements in practical terms and is not legal advice. NIS2 is an EU directive, and the binding rules for any given company follow from the national transposition law, which varies between member states. The authoritative interpretation for your case belongs with your legal counsel.

What NIS2 actually is

NIS2 is the second version of the European directive on network and information security. It replaces the first NIS directive and raises the level of security required across the EU. As a directive, it does not apply directly but through each member state's national transposition law. In practice, what counts for a company is therefore the national law that gives effect to the NIS2 requirements, and the details can differ from one country to the next. The core stays the same everywhere: more sectors in scope, mandatory minimum measures, clear reporting duties and personal accountability at management level.

Who is affected by NIS2?

Scope comes down to two questions: does the company operate in a regulated sector, and does it reach the size threshold? The general rule is a size-based test starting at medium-sized companies, which typically means from 50 employees or from 10 million euro in annual turnover and balance sheet total. In addition, certain providers are treated as in scope regardless of size, for example parts of the digital infrastructure. Because thresholds and exact definitions are set by national law, the precise cut-off can vary between member states.

The regulated sectors

NIS2 distinguishes sectors of high criticality from other critical sectors. These include, among others:

Two categories, similar obligations

NIS2 divides organisations in scope into essential and important entities. Both have to meet the same security requirements. The difference lies mainly in supervision: essential entities are supervised proactively, while important entities are supervised more on a reactive basis, for example after an incident. For your own preparation this means the technical and organisational work is comparable in both cases.

What obligations NIS2 triggers

The requirements fall into three blocks: risk management, reporting duties and governance.

Risk management with concrete measures

Entities in scope must take appropriate technical and organisational measures in line with the state of the art. These include, among others, policies for risk analysis and information security, incident handling, backup and business continuity, supply chain security, access control, vulnerability management, cryptography and multi-factor authentication. What matters is the evidence: the measures must be demonstrably in place and effective, not just written down on paper.

Staged reporting duties

Significant incidents have to be reported in stages. As a rule this means an early notification within 24 hours, a more detailed report within 72 hours and a final report no later than one month afterwards. The exact wording and deadlines are set by national law, so they can differ between member states. All of this depends on an incident being detected and escalated internally in good time, which in turn requires monitoring and clear responsibilities.

Management accountability

NIS2 puts obligations on the management level itself. Management must approve the risk measures, oversee their implementation and undertake training. Breaches can lead to supervisory action and fines, and the responsibility cannot be fully delegated. Cyber security thereby becomes a matter for the top of the organisation in a legal sense.

Timelines and state of transposition

The directive is in force at European level and had to be transposed into national law by 17 October 2024. In Germany, NIS2 is transposed through the BSI Act (BSIG) as amended by the NIS2 Implementation Act, with the BSI acting as the central registration and reporting authority. According to the BSI, the registration deadline for affected entities has already passed, so companies in scope that have not yet registered should do so without delay. You can check whether your organisation is in scope using the BSI's official NIS-2 scope assessment. In some other member states transposition slipped beyond the original deadline, so the exact start of the obligations depends on the relevant national law. The binding start date for your situation is something your legal counsel confirms against the current law.

What to do now, concretely

Preparation follows a clear order, independent of the exact date the national law takes effect.

1. Determine whether you are in scope. Check sector and size, and additionally clarify whether customers are passing the requirements down through the supply chain.
2. Anchor accountability. Name a responsible role, involve the management level and set reporting lines.
3. Gap analysis. Compare the current state against the required measures and prioritise the gaps by risk and effort.
4. Implement measures. Introduce or harden technical and organisational controls, from access control through backup to incident handling.
5. Set up the reporting process. Build detection, escalation and reporting so that the 24 and 72 hour windows are realistically achievable.
6. Collect evidence. Keep a record for every requirement, so the state can be examined at any time.

The most demanding part is rarely the individual measure, but the robust proof that all requirements together are met. This is exactly where a structured readiness comes in, one that maps every obligation to a concrete piece of evidence instead of leaving a list of intentions.

Frequently asked questions about NIS2