Network & Information Security Directive 2

Directive (EU) 2022/2555

NIS2 raises the cybersecurity baseline for essential and important entities across the EU — risk-management measures, management accountability and strict incident reporting, backed by real supervision and penalties.

In practice that means the ten baseline risk-management measures — policies, incident handling, business continuity, supply-chain security, encryption and access control — approved and overseen by the management body, registering with your national authority, and reporting significant incidents on a 24-hour / 72-hour / one-month clock.

Who must comply: Medium and large entities in the NIS2 sectors — energy, transport, banking, health, water, digital infrastructure, public administration and more — plus the suppliers they depend on. Senior management can be held personally liable, and entities must self-register — being in scope isn’t optional.

• Ten baseline risk-management measures
• Management-body approval, oversight & accountability
• Incident reporting — 24h early warning, 72h, 1-month
• Supply-chain security & registration with your authority