Scope: Who NIS2 Applies To
The NIS2 Directive (EU 2022/2555) came into force on 16 January 2023 and was required to be transposed into national law by EU member states by 17 October 2024. It replaces the original NIS Directive (EU 2016/1148) and substantially expands both the range of organisations covered and the stringency of requirements placed on them.
NIS2 uses a two-tier classification. Essential entities are large organisations operating in the eleven sectors listed in Annex I: energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure (internet exchange points, DNS service providers, top-level domain registries, cloud computing service providers, data centre services, content delivery networks, trust service providers, electronic communications networks), ICT service management (managed service providers and managed security service providers), public administration, and space. Important entities are medium and large organisations in the eight sectors listed in Annex II: postal and courier, waste management, chemicals manufacturing and distribution, food production and processing, manufacturing of medical devices, computers and electronics, machinery, motor vehicles, and other transport equipment; digital providers (online marketplaces, online search engines, social networking platforms); and research organisations.
The size thresholds that define who falls within scope are: medium entities (50+ employees or €10M+ annual turnover/balance sheet) qualify at minimum as important entities; large entities (250+ employees or €50M+ annual turnover or €43M+ balance sheet) qualify as essential entities in Annex I sectors. Member states may choose to extend scope to smaller organisations in specific circumstances — particularly where an organisation is the only provider of a service in that member state, or where disruption would have a significant impact on public safety, security, or health.
For organisations operating across multiple EU member states, NIS2 requires registration in the member state of establishment, with reporting obligations to national competent authorities in each jurisdiction where services are provided. The interaction between member-state implementations varies: while the Directive sets minimum standards, member states have discretion in several areas including exact penalty structures, the scope of their supervised entity list, and sector-specific guidance.
The Ten Minimum Security Measures (Article 21)
Article 21 of NIS2 requires essential and important entities to implement "appropriate and proportionate technical, operational and organisational measures" to manage cybersecurity risks. The Directive specifies ten minimum categories that these measures must address.
Policies on risk analysis and information system security require organisations to have documented, regularly reviewed security policies that cover asset management, access control, cryptography, operational security, communications security, acquisition and development of systems, supplier relationships, incident management, business continuity, and compliance. This is a governance-first requirement: the controls that follow must be grounded in a documented policy framework approved at management body level.
Incident handling requires entities to have documented procedures for detecting, classifying, and responding to incidents, and to be capable of meeting the three-stage incident reporting timelines (24-hour early warning, 72-hour notification, one-month final report). Entities must also have procedures for post-incident review and lessons-learned integration.
Business continuity, backup management, and disaster recovery require documented and tested plans for maintaining or restoring essential services following a significant incident. NIS2 is explicit that backup procedures must be tested — documentation of an untested BCP does not satisfy this requirement.
Supply chain security requires entities to assess and address cybersecurity risks in their relationships with direct suppliers and service providers, taking into account the overall quality of their suppliers' security practices and the security of the products and services they provide. Organisations must include security provisions in supplier contracts and establish procedures for managing supplier security incidents.
Security in network and information systems acquisition, development, and maintenance covers secure development practices, patch and vulnerability management, and security testing. This requirement explicitly includes the security of systems developed by third parties.
Policies and procedures to assess the effectiveness of cybersecurity risk management measures require organisations to regularly review and test their controls. This can include security audits, penetration tests, red team exercises, and continuous monitoring programmes.
Basic cyber hygiene practices and cybersecurity training require entities to implement fundamental security practices — software updates, password policies, access management, phishing awareness — and to provide regular, role-appropriate security training to all staff.
Policies and procedures regarding the use of cryptography and, where appropriate, encryption require documented standards for cryptographic implementations, key management procedures, and where appropriate, end-to-end encryption.
Human resources security, access control policies, and asset management address personnel screening, role-based access control, privileged access management, and maintaining an accurate, current inventory of all in-scope assets.
The use of multi-factor authentication (MFA) or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems is explicitly mandated — MFA is no longer optional for in-scope systems under NIS2.
Incident Reporting Obligations
NIS2 Article 23 replaces the original Directive's incident notification requirement with a more structured, faster, and more demanding three-stage process.
The 24-hour early warning is a rapid first notification intended to give national authorities and CSIRTs situational awareness of a significant incident. "Significant" is defined as an incident that has caused or is capable of causing severe operational disruption or financial loss to the entity concerned, or affecting other natural or legal persons — in practice, any incident that materially impairs service delivery or involves a breach of sensitive data qualifies. The early warning does not require a complete investigation to be submitted; it requires confirmation that an incident meeting the significance threshold has occurred, whether malicious activity is suspected, and whether cross-border impact is possible.
The 72-hour incident notification requires an updated report including an initial assessment of severity and impact, and, where available, indicators of compromise. The 72-hour clock runs from when the entity became aware of the significant incident — not from when the incident began, but from when the organisation first had knowledge of it. The distinction is operationally significant: an entity that discovers a three-week-old intrusion on a Monday has until Thursday to submit the 72-hour notification.
The one-month final report requires a comprehensive account of the incident: a detailed description, the type of threat or root cause, applied and ongoing mitigation measures, cross-border impact if applicable, and — for ongoing incidents at the one-month mark — an interim report with a timeline for the final report. This final report is the document that regulators and insurance underwriters will scrutinise most closely in any subsequent investigation or claim.
Supply Chain Security and Management Accountability
Two of NIS2's most significant departures from the original Directive are its explicit supply chain security provisions and the introduction of personal liability for senior management.
Supply chain security under NIS2 goes beyond requiring a vendor risk assessment questionnaire. The Directive requires entities to consider the overall security practices of their suppliers, the security of products and services those suppliers provide, and the cybersecurity of the supply chain for those products and services. In practice, this means understanding not just whether your cloud provider has ISO 27001 certification, but whether the software components they use, the infrastructure vendors they depend on, and the personnel they employ represent acceptable risk. Entities are expected to include cybersecurity requirements in supplier contracts, maintain visibility into their suppliers' significant incidents, and have escalation procedures for when a critical supplier is compromised.
The management accountability provisions of Article 20 create a governance obligation that sits above the technical requirements. Management bodies must approve the cybersecurity risk management measures their organisations implement, must oversee their implementation, and can be required to undergo NIS2-specific training. Member states are required to establish mechanisms for holding management bodies liable for infringements of their Article 20 obligations — including the ability to temporarily prohibit senior managers from performing management functions in the event of serious or repeated infringements. This provision has generated significant legal and boardroom attention: for the first time, EU cybersecurity law creates a direct, personal compliance obligation for individual executives.
Penalties and Enforcement
Penalties for essential entities can reach €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. For important entities: €7,000,000 or 1.4% of total worldwide annual turnover. These are maximum figures — actual penalties will be calibrated to the severity of the infringement, the degree of negligence or intent, any prior infringements, and the damage caused. The GDPR penalty regime provides a useful comparator for how regulators are likely to apply these provisions in practice.
Enforcement powers under NIS2 include the ability to order security audits, conduct on-site inspections, require entities to provide access to information and documentation, and issue binding instructions to remedy infringements. For essential entities, supervisory authorities can also — as a last resort — temporarily prohibit a natural person from exercising managerial responsibilities.
Mapping AmonSul Services to NIS2 Controls
AmonSul's service portfolio covers the majority of Article 21's minimum security measures directly, and addresses the incident reporting obligation through the operational procedures built into its MDR and IR services.
MDR → Incident handling (Article 21(2)(b)) + Effectiveness assessment (21(2)(f)). AmonSul's Managed Detection and Response service provides the continuous monitoring, detection, and initial response capability that NIS2's incident handling requirement demands. The service produces the documentation trail — detection timestamps, alert classifications, initial assessments — that is the foundation of a compliant 24-hour early warning. The custom detection logic, built from live actor TTPs rather than generic rules, addresses the effectiveness assessment requirement by ensuring the monitoring programme is calibrated to the actual threat environment rather than the average one.
Incident Response retainer → Incident handling (21(2)(b)) + Business continuity (21(2)(c)). The AmonSul IR retainer provides pre-contractual access to incident response capability that can be activated within hours, meeting the operational demands of the 72-hour notification window. Pre-engagement documentation — agreed escalation procedures, authorised investigator credentials, contact trees — means response begins without the contracting delays that routinely cause organisations to miss notification windows.
Penetration Testing → Effectiveness assessment (21(2)(f)) + Acquisition/development security (21(2)(e)). An annual penetration test conducted against in-scope systems by AmonSul provides the documented evidence of control effectiveness that regulators expect and that cyber insurance underwriters require. MITRE ATT&CK-mapped reports provide the risk register input needed for management body reporting obligations under Article 20.
VATRA + OneGuard → Supply chain security (21(2)(d)) + Risk analysis (21(2)(a)). VATRA's threat intelligence provides the threat-landscape context required for a credible NIS2 risk analysis: if your organisation's sector is being actively targeted by a specific actor exploiting a specific CVE class, that information belongs in your risk register and informs your prioritisation of controls. OneGuard's continuous monitoring of your external attack surface and supplier exposure addresses the supply chain security requirement's demand for ongoing visibility into the security posture of critical vendors.
Security Awareness Training → Basic hygiene and training (21(2)(g)). AmonSul's Security Awareness Training programme, delivered with VATRA-powered simulations based on actual phishing infrastructure used against your sector, satisfies the regular, role-appropriate training requirement of Article 21(2)(g) with documentation suitable for NCA review.