Governance
Management approves the measures, oversees their implementation and is accountable for them.
NIS2 · Directive (EU) 2022/2555
NIS2 Directive: cybersecurity for essential and important sectors
We determine whether it applies to you, measure your gap and help you meet the risk management and incident reporting obligations.
What is NIS2?
Europe’s common cybersecurity baseline
NIS2 replaces the 2016 NIS directive: it expands the scope to 18 sectors, tightens obligations and raises penalties.
Each Member State adopts it through its own law. Most already have, and some, such as Spain, are still completing transposition.
It requires managing supply chain security: if you supply a regulated entity in Europe, you will be asked for evidence.
Key obligations
What the directive requires
Risk management
Policies, incident handling, continuity, encryption, access control and multi-factor authentication.
Supply chain
Security assessment of suppliers and service providers.
Incident reporting
Early warning within 24 hours, notification within 72 hours and a final report within one month.
Phases
How we get you to compliance
- 1Applicability analysis: sector, size and entity type.
- 2Gap assessment against the directive’s measures and the applicable national law.
- 3Risk-prioritized remediation plan with owners and deadlines.
- 4Implementation of policies, technical controls and supplier management.
- 5Incident reporting procedure and drills.
- 6Management training and internal compliance audit.
Entity types
Essential and important
Essential entities
Generally large companies in highly critical sectors such as energy, transport, banking, health, water or digital infrastructure. Proactive supervision.
Important entities
Medium and large companies in other critical sectors such as postal services, waste, chemicals, food, manufacturing or digital providers. Reactive supervision.
Fines of up to 10 million euros or 2% of worldwide turnover for essential entities, and up to 7 million or 1.4% for important ones.
Why NIS2
More than avoiding fines
Resilience
You reduce the impact of incidents that stop the business.
Trusted supplier
You meet the demands of your regulated clients in Europe.
Informed leadership
The board understands and governs cyber risk.
One single effort
We integrate NIS2 with ISO 27001, ISO 22301 and IEC 62443.
Who it applies to
18 critical sectors and their suppliers
- Energy
- Transport
- Banking and financial market infrastructure
- Healthcare
- Drinking water and wastewater
- Digital and cloud infrastructure
- Managed ICT services
- Public administration
- Manufacturing of critical products
- Suppliers to European entities
FAQ
What clients ask us most
What is NIS2?
It is Directive (EU) 2022/2555, which sets a common level of cybersecurity across the European Union for essential and important entities in 18 critical sectors.
Does it apply to companies outside the European Union?
It can apply if you provide services in the EU in the covered sectors. In addition, your regulated European clients will require security measures from you as a supplier.
What reporting deadlines does it set?
An early warning within 24 hours of detecting a significant incident, a notification within 72 hours and a final report within one month.
What are the penalties?
Up to 10 million euros or 2% of worldwide turnover for essential entities, and up to 7 million or 1.4% for important ones. Management can also be held liable.
Does NIS2 apply to you?
In an initial assessment we tell you whether it applies, what type of entity you are and where to start.