FindIntegrator — Research & Guides
What Is NIS2?
The NIS2 Directive (Directive (EU) 2022/2555) is the EU-wide cybersecurity law that requires essential and important entities to apply risk-management measures and report significant incidents to national authorities.
Quick answer
The NIS2 Directive (Directive (EU) 2022/2555) is the EU-wide cybersecurity law that requires essential and important entities to apply risk-management measures and report significant incidents to national authorities.
What this means
NIS2 replaced the original NIS Directive and broadened the scope to more sectors and more organisations. It sets out a risk-based approach, explicit management accountability, and notification obligations that are implemented through national law in each member state.
Key considerations
Scope: Essential and important entities across energy, transport, health, digital infrastructure, ICT service management and more.
Obligations: Risk-management measures, supply-chain security, incident notification and management accountability.
Implementation: NIS2 is an EU directive; each member state transposes it into national law, so requirements and penalties vary by country.
Compare providers
- Browse cybersecurity providers
- Managed Security Providers
- Compare MDR providers
- European Cloud and Data Residency
Frequently asked questions
When does NIS2 apply?
The transposition deadline was 17 October 2024; national implementation and enforcement vary, so check the rules that apply in your member state.
How is NIS2 different from NIS1?
NIS2 extends the scope to more sectors and entities, adds management accountability and harmonises incident-reporting timelines.