Compliance · NIS2
NIS2
The EU directive expanding baseline cybersecurity and incident-reporting duties to far more “essential” and “important” organisations.
What it is
Baseline duties, broader reach, real accountability.
NIS2 raises baseline security expectations and adds management accountability, risk-management measures, incident-reporting timelines and supply-chain security duties.
It is transposed into each member state’s law, and UK organisations with EU operations can inherit obligations through their counterparties.
Who needs it
Essential and important entities, and their suppliers.
Organisations in the directive’s covered sectors, plus suppliers pulled in through supply-chain security requirements.
The covered sectors are broad: energy, transport, banking and financial market infrastructure, health, water, digital infrastructure, managed ICT services, public administration and space, plus postal services, waste management, chemicals, food, manufacturing, digital providers and research. In general, medium and large organisations in those sectors are in scope, with some types caught regardless of size.
Entities are classed as essential or important. Both carry the same core duties; essential entities face proactive supervision and higher maximum fines, while important entities are supervised mainly after the event.
Risk-management measures
The ten measures Article 21 expects.
- Risk analysis and information system security policies
- Incident handling
- Business continuity, backup management, disaster recovery and crisis management
- Supply chain security, including your relationships with direct suppliers
- Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
- Policies and procedures to assess whether the measures are effective
- Basic cyber hygiene practices and cybersecurity training
- Policies on cryptography and, where appropriate, encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communications where appropriate
Incident reporting
Three deadlines, starting at 24 hours.
Significant incidents must be reported to the national CSIRT or competent authority in stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that notification. Meeting the first deadline needs the triage, decision rights and contacts in place before anything happens.
Accountability
The board is accountable.
Management bodies must approve the risk-management measures, oversee how they are implemented, and take cybersecurity training, and they can be held liable for failures. Maximum fines reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.
The UK position
NIS2 is EU law. The UK has its own route.
NIS2 does not apply in UK law. The UK still runs the NIS Regulations 2018, and the Cyber Security and Resilience Bill, the UK’s NIS2-equivalent, is going through Parliament and is not yet law.
UK organisations meet NIS2 directly where they have an in-scope establishment in an EU member state, or where they offer certain digital services in the EU, such as cloud, data centre, managed and managed security services, in which case they must appoint an EU representative. They meet it indirectly where EU customers pass supply-chain security duties down to them. Because each member state has transposed the directive separately, and several were late, the exact requirements and dates still vary by country.
How we help
Scope it, govern it, evidence it.
- Determine whether and how you are in scope
- Put governance and risk-management measures in place
- Build incident-reporting readiness against the required timelines
- Strengthen supply-chain security and keep the evidence current
FAQ
Questions buyers actually ask
- Not as UK law. It applies directly to UK organisations with an in-scope establishment in an EU member state, and to those offering certain digital services such as cloud, data centre or managed services in the EU, under each country’s national law. It reaches others indirectly when EU customers pass supply-chain security requirements down to their suppliers. In the UK itself, the NIS Regulations 2018 apply, and the Cyber Security and Resilience Bill is going through Parliament.
- Both must meet the same risk-management and reporting duties. Essential entities, typically larger organisations in the most critical sectors, are supervised proactively and face higher maximum fines. Important entities are supervised mainly after an incident or evidence of non-compliance.
- For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of that notification.
- Yes, if they meet the size threshold. Medium and large managed service providers and managed security service providers are covered under the ICT service management sector, which is why NIS2 obligations often reach organisations through their IT and security suppliers as well as directly.
- Up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher. Member states can also hold members of the management body accountable.
- No. As a directive, it had to be transposed into each member state’s national law, with a deadline of 17 October 2024. Most countries have now done so, but several were late, so the detailed requirements and start dates still vary by country.
Unsure if NIS2 applies to you?
We’ll help you determine scope first, then map the shortest route to meeting it.
Book a call