NIS2

What it means

NIS2 is the EU's Directive 2022/2555 on measures for a high common level of cybersecurity. It replaces the first NIS Directive and covers many more sectors, split into essential and important entities. Each EU member state turns it into its own national law.

It asks organisations to manage cyber risk and to report significant incidents. It also makes senior management responsible for approving and overseeing those measures, so security is a board-level duty and not only a job for the IT team. Your national authority supervises it, and the details differ by country.

Why it matters

If you supply software or services to an in-scope company in the EU, their obligations flow down to you through contracts and questionnaires. Customers will ask about your vulnerability handling, your incident process and how you check your own suppliers.

The penalties are real. For essential entities the directive allows fines of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. Reporting is tight too: an early warning within 24 hours of becoming aware of a significant incident, then a fuller notice within 72 hours.

How it shows up

Article 21 lists the measures expected. They include risk analysis, incident handling, supply chain security, secure development, vulnerability handling and disclosure, and policies to assess whether the measures work. The directive does not list specific tools. Management bodies must approve these measures and can be held accountable for failing to oversee them.

In practice that means a vulnerability management process with evidence, a tested incident response plan, and supplier checks. Regular penetration testing is a common way to show that the effectiveness assessment is real. Check your national law, because member states differ in detail.