NIS-2 is Directive (EU) 2022/2555 on measures to ensure a high common level of cybersecurity within the Union. NIS-2 requires organisations in 18 sectors to implement risk management, report significant security incidents and establish a governance framework for which senior management is personally accountable. The Directive replaces the 2016 NIS Directive and significantly expands the scope of organisations covered.
What is NIS-2?
NIS-2 is the key European legal framework for cybersecurity in the private sector and public administration. The abbreviation stands for Network and Information Security; the ‘2’ denotes the second generation of this regulatory framework, which replaces the 2016 Directive.
The revision followed the realisation that the first NIS Directive was too weak and inconsistent. Member States had considerable discretion over who was covered, which led to a patchwork of very different national regimes. NIS-2 largely removes this discretion: the scope of application is defined uniformly across Europe in terms of sectors and company sizes, the minimum measures are specified in detail, and the reporting deadlines have been standardised.
Two key shifts characterise the content of the Directive. Firstly, the expansion: rather than covering a small number of large operators of critical infrastructure, NIS-2 now covers a broad range of medium-sized and large enterprises across the economy, including the manufacturing sector, the food industry, waste management and research. Second, NIS-2 allocates responsibility: it explicitly addresses governing bodies and links personal consequences to their duties. Cyber security thus becomes a management responsibility and can no longer be delegated to the IT department.
Since when has NIS-2 been in force, and what is the current status of its implementation?
NIS-2 came into force at the start of 2023. Member States were required to transpose the Directive into national law by 17 October 2024; the provisions were due to take effect from the following day.
As a Directive, NIS-2 has no direct effect on businesses – it is always the national transposition legislation that applies. In Germany, transposition is effected through the NIS-2 Transposition and Cybersecurity Strengthening Act, which essentially revises the BSI Act. Germany, like numerous other Member States, has missed the transposition deadline; the European Commission has therefore initiated infringement proceedings.
In practice, this means that the content of the obligations has been fixed since the directive was adopted and has not changed since then – preparation was and remains possible regardless of the legislative status. However, deadlines, responsibilities, registration procedures and the framework for sanctions are determined by national law. The current status regarding entry into force, transitional provisions and registration deadlines should therefore be checked before any decisions are made.
Who does NIS-2 apply to?
NIS-2 applies to organisations that meet both of the following conditions: they belong to one of the 18 sectors listed, and they exceed certain size thresholds.
| Annex | Sector |
| Annex I – Sectors of high criticality | Energy · Transport · Banking · Financial market infrastructures · Healthcare · Drinking water · Wastewater · Digital infrastructure · ICT service management · Public administration · Space |
| Annex II – Other critical sectors | Postal and courier services · Waste management · Chemicals · Food · Manufacturing · Digital service providers · Research |
Classification under Annex I or II does not determine the scope of the obligations, but rather the classification and, consequently, the level of supervision. Furthermore, both annexes are broader in scope than their short titles might suggest: ‘Manufacturing’ covers, for example, medical devices, data processing equipment, electronics, mechanical engineering, and motor vehicle and vehicle manufacturing, whilst ‘Digital Infrastructure’ also includes data centre services, trust services and cloud providers. Organisations should therefore assess whether they are affected on the basis of the detailed sector descriptions and the underlying classification of economic activities, rather than on the basis of the headings.
As a general rule, the size threshold is defined as classification as a medium-sized enterprise: 50 or more employees, or an annual turnover or balance sheet total of more than 10 million euros. Below this threshold, the Directive does not generally apply – with exceptions for entities whose failure would have particularly far-reaching consequences, such as providers of public telecommunications networks, trust service providers, domain name registries and parts of the public administration. These are covered regardless of their size.
The most significant practical consequence is the scope of the extension. Whilst the previous KRITIS regulation in Germany covered a group of just under 1,000 facilities via thresholds, NIS-2 is estimated to affect many times that number – predominantly small and medium-sized enterprises with no previous experience of IT supervision. Another distinctive feature is that there is no official determination: organisations must check for themselves whether they are covered and register accordingly.
What distinguishes ‘particularly important’ organisations from ‘important’ ones?
NIS-2 divides the covered organisations into two categories, which differ only slightly in terms of substantive obligations but significantly in terms of supervision and the framework for sanctions.
| Characteristic | Particularly important facilities | Important facilities |
| Classification | Large enterprises in Annex I sectors, as well as certain organisations, regardless of their size | Medium-sized enterprises in Annex I sectors and medium-sized and large enterprises in Annex II sectors |
| Supervision | Proactive: On-site inspections, security scans and audits, even without a specific reason | Reactive: Audit carried out primarily where there are indications of non-compliance |
| Bußgeldrahmen | Up to 10 million euros or 2% of global annual turnover | Up to 7 million euros or 1.4% of global annual turnover |
A company is considered large if it has 250 or more employees, or if it has an annual turnover of more than 50 million euros and a balance sheet total of more than 43 million euros. The risk management obligations are identical for both categories, so anyone relying on the lower level of regulatory scrutiny fails to recognise that the substantive requirements remain the same.
When calculating the size criteria, it should also be noted that affiliated and partner companies may need to be taken into account. A subsidiary that is small in its own right may therefore fall within the scope of application because the group’s key figures are decisive. Conversely, the classification generally applies on a legal entity basis, meaning that different companies within a group may be classified differently. This assessment should be carried out at the start of every implementation project and should be documented – even if it concludes that the company is not affected.
What risk management obligations does NIS-2 impose?
Article 21 of the Directive sets out ten minimum measures to be implemented in accordance with a cross-threat approach and in a manner proportionate to the risk:
- Risk analysis and information system security policies
- Security incident management, including detection, response and follow-up
- Business continuity, including backup management, recovery and crisis management
- Supply chain security, including relationships with direct suppliers and service providers
- Security in the procurement, development and maintenance of ICT systems, including vulnerability management and disclosure procedures
- Assessment of the effectiveness of the risk management measures taken
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption in accordance with a documented policy
- Staff security, access control and asset management
- Multi-factor authentication, secure voice, video and text communications, and secure emergency communication systems
The fourth measure deserves particular attention as it extends beyond the organisation itself: organisations must assess the security of their suppliers and service providers and reflect this in contracts. As a result, NIS-2 also has an indirect impact on companies that do not themselves fall within its scope but supply customers who do. A management system in accordance with ISO 27001 methodically covers a significant proportion of these measures, but does not replace the legal obligations.
What responsibilities does the C-level management have under NIS-2?
NIS-2 explicitly assigns responsibility to senior management. Management bodies must approve risk management measures, monitor their implementation and may be held accountable for breaches. In addition, they are obliged to attend training on cyber security risks and should offer similar training to their employees.
This provision represents the most significant departure from previous practice. In many organisations, cybersecurity had effectively been delegated to the IT department; NIS-2 makes approval and monitoring a management task that cannot be delegated. In the case of particularly important entities, the supervisory powers also provide for the possibility of temporarily prohibiting senior managers from exercising their management functions – a measure that goes well beyond financial sanctions.
What reporting obligations does NIS-2 set out?
NIS-2 requires covered organisations to report significant security incidents in accordance with a three-stage procedure. An incident is considered significant if it causes, or is likely to cause, serious operational disruption or financial loss, or if it causes significant harm to other natural or legal persons.
| Stage | Deadline | Content |
| Early warning | within 24 hours of becoming aware | Initial assessment, suspicion of unlawful conduct, possible cross-border implications |
| Reporting the incident | within 72 hours of becoming aware | Updated assessment, severity, impact, initial findings regarding indicators of compromise |
| Final Report | within one month of the notification | Root cause analysis, corrective actions taken, cross-border implications |
Interim reports must be submitted at the request of the authority; if the resolution takes longer, a progress report shall initially take the place of the final report. In addition, organisations must inform recipients of their services of any incidents that might affect them.
It should be noted that this reporting obligation exists alongside others. Where personal data is affected, the 72-hour deadline under the GDPR applies in parallel; for financial institutions, the different deadlines under DORA apply; and for product manufacturers, the reporting obligations under the Cyber Resilience Act will apply in future. Twenty-four hours is not sufficient to clarify responsibilities, assessment criteria and portal access only once an incident has occurred.
What requirements does NIS-2 impose on communications?
NIS-2 explicitly identifies communication as a component of the minimum measures. Article 21(2)(j) expressly requires, in addition to multi-factor authentication, secure voice, video and text communication, as well as secure emergency communication systems within the organisation. This means that securing internal communication is not merely a consequence of general security principles, but a requirement specified in its own right.
In addition, there are references to this in two further measures: the maintenance of operations explicitly includes crisis management, and the management of security incidents requires functioning reporting and coordination channels. Together with the short reporting deadlines, this results in a practical requirement that goes beyond mere encryption: the communication channel must remain operational even if the organisation’s own infrastructure is the subject of the incident.
This is precisely where the common shortcoming lies. In the event of a ransomware attack, directory services, email and collaboration platforms are deemed to be compromised or are taken offline as a precaution – and with them, the contact lists, escalation plans and emergency documents stored there are lost. Organisations therefore maintain pre-approved channels that function independently of the affected infrastructure, document decisions in a traceable manner, and are tested as part of emergency communication drills. If no such channel is available, those involved resort to private consumer messaging apps – with consequences for confidentiality, auditability and subsequent reporting to the supervisory authority.
Teamwire demonstrates how secure text, voice and emergency communications, as defined in Article 21, can be implemented in a demo or via a free trial.
How does NIS-2 relate to critical infrastructure, DORA and the Cyber Resilience Act?
NIS-2 is the overarching framework for organisational cybersecurity; alongside this, there are more specific and complementary sets of regulations.
| Regulatory framework | Intended audience | Relationship to NIS-2 |
| Existing regulations for critical infrastructure (KRITIS) | Operators of critical installations exceeding threshold values | This is incorporated into the NIS 2 implementation; the scope covered is significantly broader |
| DORA | Financial institutions and their ICT service providers | More specific provision; supersedes NIS-2 in the areas covered |
| CER Directive / KRITIS Framework Act | Critical infrastructure | Complements the IT focus with physical resilience |
| Cyber Resilience Act | Manufacturers of products containing digital elements | Tracks products; makes it easier to trace them within the supply chain |
| GDPR | Data controllers and data processors | Separate reporting obligation; runs in parallel |
When it comes to implementation, integration with the supply chain is the most relevant practical consideration. Some of the requirements under NIS-2 can be demonstrated through evidence provided under the Cyber Resilience Act; conversely, service providers’ security commitments must be included in the contractual documentation, for example in a data processing agreement.
How can organisations prepare for NIS-2?
Preparation for NIS-2 follows a straightforward sequence that can be started regardless of the status of national legislation:
- Assess impact – sector classification, size criteria, category, for each company within the group individually
- Conduct a gap analysis against the ten minimum measures, ideally using an existing framework
- Involve the management body, document approval, schedule training sessions
- Map the supply chain – register of ICT service providers, assessment, amendment of contracts
- Establish a reporting process – roles, deputies, assessment criteria for ‘significant’, templates, rehearsed procedures
- Ensure robust business continuity and recovery through a Business Continuity Management system, including independent communication channels
- Establish traceability – documentation, effectiveness testing, recurring cycles rather than a one-off project
Experience shows that the greatest effort lies not in the technology, but in steps 4 and 7: the comprehensive mapping of ICT service providers and the ongoing maintenance of evidence require processes that do not yet exist in many organisations.
Summary: Key points on NIS-2
- NIS-2 is Directive (EU) 2022/2555 and the key European legal framework for cyber security in the private sector and public administration.
- As a directive, NIS-2 does not have direct effect; the relevant legislation is the national implementing act, which in Germany is the revised version of the BSI Act.
- The scope covers 18 sectors listed in two annexes, combined with size criteria starting from medium-sized enterprises – the scope is many times greater than under the previous KRITIS regulation.
- There is no official determination: organisations must assess for themselves whether they are affected and register accordingly.
- ‘Particularly important’ and ‘important’ organisations differ in terms of the intensity of supervision and the scale of fines, but not in the substantive obligations.
- Article 21 sets out ten minimum measures, including supply chain security, cyber hygiene, encryption and multi-factor authentication.
- Secure voice, video and text communications, as well as secure emergency communication systems, are expressly required.
- Senior management bears personal responsibility: approval, supervision, training obligations – right up to a possible ban on carrying out duties.
- Significant incidents must be reported in three stages: early warning within 24 hours, notification within 72 hours, and a final report within one month.
- DORA supersedes NIS-2 for financial firms; the Cyber Resilience Act complements the product level and facilitates evidence-gathering within the supply chain.