Guide
NIS2 Guide: Scope, Requirements, Reporting and Enforcement
NIS2 (Directive (EU) 2022/2555) sets cybersecurity and incident reporting duties for medium-sized and larger organisations in 18 sectors, through each member state's national law. Start with scope, then work through the measures and the reporting duties.
At a glance
| Legal form | Directive: applies through national law; transposition was due by 17 October 2024 |
| Who | Entities in the 18 sectors of Annexes I and II, generally medium-sized and larger, plus some regardless of size |
| Core duties | Ten minimum risk-management measures (Art. 21), management body duties (Art. 20), incident reporting (Art. 23) |
| Reporting | Early warning within 24 hours, notification within 72 hours, final report within one month |
| Fines | Maximum of at least €10 million or 2% (essential) and €7 million or 1.4% (important) of worldwide turnover |
Each point is explained, with its legal source, in the guides below.
Start here
NIS2 Directive Explained: What It Is, Who Must Comply and What It Requires (2026)
NIS2 in plain English: who is in scope, the 10 Article 21 measures, the 24h/72h/1-month reporting deadlines, fines and management liability.
15 min read
Does NIS2 Apply to My Company? Sectors, Size Rules and Examples
The 18 sectors, the medium-size rule and how group companies count, the cases that apply regardless of size, essential versus important, and worked examples.
11 min read
The requirements
NIS2 Compliance Checklist for SMBs: Article 21 Measure by Measure
Scope and registration, management duties, the ten Article 21 security measures and incident reporting readiness, each with what to have in place and the article behind it.
13 min read
NIS2 and the Board: Management Liability and Training Under Article 20
What Article 20 requires from directors, how personal liability and temporary management bans work under Articles 32 and 33, and a practical board routine.
8 min read
NIS2 Supply Chain Security: What to Ask Your Suppliers
What Article 21(2)(d) and 21(3) require, the detailed supplier rules of Implementing Regulation 2024/2690, and the questions and contract clauses to use.
10 min read
Incidents
NIS2 Incident Reporting: How to Meet the 24-Hour Deadline
Exactly what to report, to whom, and how to build a process that meets NIS2's 24-hour early warning requirement every time.
11 min read
When Is an Incident Significant Under NIS2? The Thresholds in Implementing Regulation 2024/2690
The general test in Article 23(3), the general criteria that apply to digital providers, and the specific thresholds for cloud, data centre, CDN, DNS, TLD, managed services, marketplaces, search engines, social networks and trust services.
9 min read
Enforcement
By country
NIS2 Transposition Status by Country: All 27 EU Member States
24 of 27 Member States have a NIS2 law in force; France, Ireland, Spain do not. The national law, start date and authority for each country, checked monthly.
9 min read
NIS2 Registration: How and When to Register in Each EU Country
Where to register under NIS2 in each Member State, the deadline, and the information the directive requires. Many deadlines have passed; Austria's runs to the end of 2026.
9 min read
Specific situations
NIS2 for Managed Service Providers (MSPs and MSSPs)
Whether you are an MSP under NIS2, which country supervises you, the detailed security requirements of Implementing Regulation 2024/2690, and when an incident is significant.
10 min read
NIS2 vs ISO 27001: How Much Does Certification Cover?
Where an ISO 27001 management system gives you a head start on NIS2, and the legal duties it does not cover: management liability, 24-hour reporting, registration and supervision.
8 min read
NIS2 vs GDPR: What Is the Difference and How They Overlap
Understanding the relationship between NIS2 and GDPR — scope, incident reporting, security measures, governance, penalties, and how to comply with both.
11 min read
Related articles
Cyber Resilience Act vs NIS2: Products vs Organisations
One law secures products, the other secures organisations. Who each covers, what it requires, how reporting and fines compare, and why many software companies face both.
8 min read
Security Awareness Training: What NIS2 and DORA Expect
Awareness for everyone, role-based training for technical staff, board training, suppliers, and how to show it works, under NIS2, Implementing Regulation 2024/2690 and DORA.
8 min read
Backup and Recovery Requirements Under NIS2 and DORA
Backup plans, storage away from the main network, access control, integrity checks, restore testing, recovery objectives and redundancy, side by side for NIS2 and DORA.
8 min read
Free tools
Templates
NIS2 Compliance Starter Kit · $29.00+
Gap-assessment workbook, incident response plan, supply chain policy, board deck.
Get the templates →NIS2 Board Pack · $49.00
Board briefing deck, resolution template, liability summary, quarterly report.
Get the templates →Other guides: DORA · GDPR · Cyber Resilience Act · AI Act and AI agents · Security for startups and SMEs
This guide is for informational purposes only and does not constitute legal advice. Last updated: November 2026.