Loading...
Network and Information Security Directive (EU 2022/2555)
The NIS2 Directive significantly expands the scope of EU cybersecurity requirements, covering essential and important entities across 18 sectors. Member States must transpose it into national law, establishing risk management obligations, incident reporting duties, and enforcement mechanisms.
18
Sectors Covered
10
Risk Measures
€10M / 2%
Max Penalty
Oct 2024
Transposition Deadline
10 minimum measures: risk analysis and policies, incident handling, business continuity, supply chain security, network security, vulnerability management, assessment practices, cryptography, HR security, and access control with MFA.
Three-stage reporting: early warning within 24 hours, incident notification within 72 hours, and final report within 1 month of the incident notification.
Management bodies must approve cybersecurity measures, oversee implementation, and undergo cybersecurity training. Personal liability for non-compliance.
Essential entities: proactive supervision (audits, inspections). Important entities: reactive supervision (post-incident). Penalties up to EUR 10M or 2% of global turnover.
Determine whether your organisation qualifies as essential or important under NIS2, based on sector, size, and criticality criteria.
Evaluate your cybersecurity posture against NIS2’s 10 minimum risk management measures (Art. 21).
Assess and manage cybersecurity risks in your supply chain, including contractual requirements for ICT suppliers.
Establish a three-stage incident reporting process meeting the 24-hour, 72-hour, and 1-month deadlines.
Ensure management body accountability, cybersecurity training for leadership, and documented policies for all 10 measures.
For enforcement timelines, penalties, and detailed regulatory analysis, see our NIS2 Netherlands (Cbw) Intelligence page.