NIS2: Directive, Requirements and Compliance Guide

What does NIS2 apply to?

NIS2, formally Directive (EU) 2022/2555, replaced the original NIS Directive. Member states were required to transpose it into national law by 17 October 2024, and the measures have applied since 18 October 2024, so the exact rules depend on the country in which you operate, and the state of national transposition should be checked for each country. The directive applies to medium and large entities in sectors listed in Annex I (sectors of high criticality) and Annex II (other critical sectors).

Annex I includes energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management and public administration, as well as space. Annex II includes postal services, waste management, chemicals, food, manufacturing of certain products, digital providers and research. Some entities fall in scope regardless of size, for example providers of public electronic communications networks, DNS and top-level domain services, and trust service providers. Read the directive text and your national law to confirm scope.

Essential entities and important entities

NIS2 splits covered organisations into two categories. Essential entities are generally large entities in Annex I sectors, plus certain others designated by member states. Important entities are other covered medium and large entities, including those in Annex II. Both must meet the same core security obligations.

The difference lies mainly in supervision and penalties. Essential entities face proactive supervision, including audits and on-site inspections, while important entities are supervised mainly after evidence of non-compliance emerges. Maximum fines also differ, as explained below. Because categorisation depends on size thresholds and national designation, document how you reached your classification.

What risk management measures does Article 21 require?

Article 21 requires appropriate and proportionate technical, operational and organisational measures to manage risks to network and information systems, based on an all-hazards approach. The minimum measures include:

• policies on risk analysis and information system security;
• incident handling;
• business continuity, backup management and crisis management;
• supply chain security, including relationships with direct suppliers and service providers;
• security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
• policies to assess the effectiveness of cybersecurity risk management measures;
• basic cyber hygiene practices and cybersecurity training;
• policies on cryptography and, where appropriate, encryption;
• human resources security, access control policies and asset management;
• multi-factor authentication or continuous authentication, secured communications and secured emergency communication where appropriate.

Entities must take into account the state of the art, relevant European and international standards, the cost of implementation and the exposure of the entity to risk. Frameworks such as ISO 27001 are a common way to organise these measures, although using one does not by itself prove compliance.

What does Article 23 require for incident reporting?

Entities must report significant incidents to their national CSIRT or competent authority. The directive sets a staged process: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. An intermediate report may be requested, and a progress report applies if the incident is still ongoing at the time of the final report.

An incident is significant if it has caused or can cause severe operational disruption or financial loss, or has affected others by causing considerable material or non-material damage. Build the reporting path before you need it: decide who declares an incident, who contacts the authority and how evidence is preserved. Where an incident involves personal data, separate obligations under data protection law may also apply.

How does NIS2 hold management accountable?

Article 20 makes the management body responsible. Management bodies must approve the cybersecurity risk management measures, oversee their implementation and can be held liable for infringements. Members of the management body are also required to follow training so that they can assess cybersecurity risks and practices.

In practice, boards should receive regular reporting on risk, incidents and supplier exposure, minute their decisions, and be able to show that approvals were informed. Cybersecurity can no longer be delegated entirely to the IT function.

Is NIS2 relevant outside the EU?

Yes, in two ways. First, certain entities that offer services in the EU without being established there, for example DNS providers, cloud and data centre providers, managed service providers, online marketplaces, search engines and social networking platforms, must designate a representative in an EU member state. Second, NIS2 reaches suppliers indirectly. Covered entities must manage supply chain risk, so they pass requirements to vendors through contracts, questionnaires and audits.

A UAE or GCC company that provides software, hosting, managed security or other ICT services to EU customers should therefore expect NIS2-driven security clauses, incident notification duties and evidence requests. The ENISA overview is a useful starting point for the European context.

What are the fines under NIS2?

Article 34 sets maximum administrative fines. For essential entities the maximum is at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities it is at least EUR 7 million or 1.4%. Member states set the actual regime, and supervisory authorities may also order corrective measures, issue binding instructions and, in some cases, temporarily prohibit individuals from exercising management functions in an essential entity.

How does NIS2 treat supply chain security?

Entities remain responsible for risks that come from suppliers. Article 21 requires them to consider the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, and the results of coordinated risk assessments of critical supply chains where these exist.

In practice this means keeping a register of ICT suppliers, ranking them by criticality, adding security and incident notification clauses to contracts, and asking for evidence such as audit reports or certifications. Suppliers should expect these requests to become routine and should prepare a clear, consistent answer pack.

How Krasper helps

Krasper Technologies is a cybersecurity and AI governance firm based in Meydan, Dubai, serving regulated organisations in the UAE, the GCC and the EU. Our cyber security consulting helps you determine scope, run a gap assessment against Article 21, design incident reporting and prepare board reporting. An independent information security audit tests whether the measures work in practice.

Where AI systems are part of your environment, Krasper Raigate, a self-hosted AI governance firewall, can log governed AI requests as evidence. It supports evidence gathering only and does not make an organisation compliant with NIS2.

Sources

• Directive (EU) 2022/2555, Official Journal text
• ENISA, NIS Directive
• European Commission, NIS2 Directive
• ISO/IEC 27001, Information security management systems