NIS2: What it means for your organisation

NIS2 is the EU’s updated directive on network and information security. It replaces the original NIS directive from 2016, widens which organisations are covered, sets a common baseline of security measures, and makes management accountable for cybersecurity. For many organisations it means security moves from “something IT handles” to a board-level responsibility.

Who is covered?

Far more organisations than before. NIS2 spans 18 sectors - from energy, transport, health, drinking water and digital infrastructure to manufacturing, food, chemicals, postal services and digital platforms. As a rule, medium-sized and large organisations in those sectors are in scope, and some, such as DNS and trust service providers, are covered whatever their size.

Organisations are classed as either essential or important entities. Both face the same core obligations; the difference lies in how closely they are supervised and how large the fines can be.

How the directive applies in detail depends on national law, and countries outside the EU follow their own tracks. But the direction is the same almost everywhere - and if you supply organisations that are in scope, their requirements will reach you through contracts and supplier assessments. A good starting point is to assume you might be affected, and find out early.

What does it require in practice?

At its core is risk-based security management: understanding your risk, putting proportionate measures in place, and being able to show it. The directive spells out the areas those measures must cover:

Risk analysis and security policies
Incident handling, business continuity and crisis management
Supply-chain security - including how your suppliers secure their own systems
Secure development and maintenance, including vulnerability handling
Access control, multi-factor authentication and encryption
Basic cyber hygiene and training - for management too

Reporting incidents

Significant incidents must be reported quickly and in stages: an early warning within 24 hours of becoming aware of the incident, a fuller notification within 72 hours, and a final report within a month. That is only realistic if you can detect an incident, understand what happened and document it - with the logs to back it up.

Management is accountable

NIS2 places responsibility squarely with management. The management body must approve the security measures, oversee how they are put into practice, and can be held liable when they fall short. Its members are also expected to take part in training themselves.

Start now

Begin with an honest assessment of where you stand, prioritise the biggest gaps, and build your incident-handling routines while you still have the calm to do it. Then compliance becomes a consequence of good security - not paperwork bolted on top.