NIS2 Directive — Network and Information Security
The EU's updated cybersecurity directive, widening the scope of the original NIS Directive to cover more sectors and imposing direct supply chain risk management duties on “essential” and “important” entities across the Union.
Who it applies to
- Essential and important entities across energy, transport, health, digital infrastructure and more
- Medium and large organisations in the newly expanded sector list
- Supply chain partners of in-scope organisations, indirectly
Key requirements
- Board-level accountability for cybersecurity risk management
- Supply chain risk management covering suppliers and service providers
- 24-hour early warning and 72-hour incident notification to authorities
- Business continuity and crisis management planning
- Regular security testing and vulnerability management
Maximum penaltyUp to €10 million or 2% of global annual turnover for essential entities, whichever is higher
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
NIS2 applies to: Essential and important entities across energy, transport, health, digital infrastructure and more; Medium and large organisations in the newly expanded sector list; Supply chain partners of in-scope organisations, indirectly.
The core obligations are: Board-level accountability for cybersecurity risk management; Supply chain risk management covering suppliers and service providers; 24-hour early warning and 72-hour incident notification to authorities; Business continuity and crisis management planning; Regular security testing and vulnerability management. Each is summarised in plain English above, with a link to the official text.
Effective: Entered into force January 2023; transposed into national law from October 2024. Regulator: ENISA & national competent authorities.
Up to €10 million or 2% of global annual turnover for essential entities, whichever is higher.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under NIS2, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, supplier and processor obligations run through Third-Party Risk Management.
See how Praeferre automates NIS2 compliance
Continuous monitoring, evidence and reporting for NIS2 — alongside every other framework you need to satisfy.