A broader standard for European cyber resilience
NIS2 establishes a common level of cybersecurity across the Union. It expands the organisations in scope, strengthens risk-management duties, accelerates incident reporting, and places accountability with management bodies.
NIS2 moves cybersecurity from a technical concern to an enterprise-wide governance obligation. Leaders must approve controls, oversee implementation, and complete relevant training.
Five core pillars
01 Risk Management & Information Security +
Adopt proportionate technical, operational, and organisational measures based on an all-hazards approach.
- Documented risk assessment methodology
- Security policies and control ownership
- Effectiveness reviews and evidence retention
02 Incident Handling - 24h / 72h SLA +
Deliver an early warning within 24 hours and a detailed notification within 72 hours after becoming aware of a significant incident.
03 Business Continuity & Disaster Recovery +
Plan, test, and improve backup management, crisis response, disaster recovery, and continuity arrangements.
04 Supply Chain Risk Controls +
Assess supplier security, contractual controls, vulnerabilities, and the quality of each provider's security practices.
05 Multi-Factor Authentication & Zero-Trust +
Apply appropriate access controls, MFA or continuous authentication, secured communications, and least privilege.
NIS1 and NIS2 compared
| Area | NIS1 | NIS2 |
|---|---|---|
| Coverage | Limited critical sectors | 18+ critical and important sectors |
| Entity selection | Member-state identification | Size-cap rule with defined exceptions |
| Leadership | Limited explicit duties | Approval, oversight, training, liability |
| Reporting | Varied by jurisdiction | 24h warning, 72h notification, final report |
| Penalties | National variation | Up to €10m or 2% global turnover |