Meet NIS2 risk management and reporting duties with less effort

The NIS2 Directive is EU cybersecurity legislation, Directive (EU) 2022/2555, that sets minimum security and incident reporting rules for organisations in critical sectors. It replaced the 2016 NIS Directive, widened the sectors and entities covered, and introduced management accountability and higher fines. Member states had to transpose it into national law by 17 October 2024, so organisations comply with their national implementing law.

NIS2 applies to medium and large organisations operating in the sectors listed in Annex I and Annex II of the Directive, such as energy, transport, banking, health, digital infrastructure, manufacturing and food. Certain entities, including DNS service providers, top-level domain registries, trust service providers and public communications providers, are covered regardless of size. Entities are classed as essential or important, which affects supervision and fines.

Under Article 34, essential entities face maximum fines of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities face at least EUR 7 million or 1.4% of turnover. Authorities also have supervisory powers such as audits, binding instructions and, for essential entities, temporarily suspending certifications or managers. Exact amounts depend on each member state's law.

Article 23 requires entities to report significant incidents in stages. An early warning is due within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. Authorities can request intermediate reports, and a progress report is needed if the incident is still ongoing when the final report is due.

Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. They include risk analysis policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, effectiveness assessments, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication with secured communications.

ISO 27001 certification does not automatically mean NIS2 compliance, but it covers much of the same ground. An ISO 27001 information security management system addresses risk assessment, access control, supplier security, incident management and business continuity, which map closely to Article 21. NIS2 adds legal duties ISO 27001 does not, such as fixed incident reporting deadlines, registration and management body accountability.

NIS2 does not apply in the UK itself, which has its own NIS Regulations 2018. However, a UK organisation that provides in-scope services within the EU can fall under NIS2 through the law of the member state where it operates or provides services. Some digital providers not established in the EU must designate a representative in a member state where they offer services.

Yes. NIS2 is supported in OneClickComply today. Its Article 21 and Article 23 requirements are linked to controls shared with frameworks such as ISO 27001, so evidence collected once counts towards both. OneClickComply helps you prepare and evidence your measures, while compliance is assessed by your national competent authority.