NIS2 compliance

The NIS2 Directive applies to medium-sized and larger organizations in the sectors listed in its Annexes I and II, such as energy, transport, health, digital infrastructure, ICT service management, manufacturing and postal services, and to some providers whatever their size. Each EU country sets it into its national law.

  • NIS2 Directive
  • 2022/2555
  • Requirements in the catalogue: 26
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Art. 3, Art. 27

    Determine whether you are an essential or an important entity, and register with the competent authority.

  • Art. 20

    The management body approves the cybersecurity risk-management measures, oversees them and takes training.

  • Art. 21

    Take ten groups of measures, among them risk analysis, incident handling, business continuity, supply-chain security, cryptography, access control and multi-factor authentication.

  • Art. 23

    Report a significant incident: an early warning within 24 hours, a notification within 72 hours and a final report within one month.

  • Art. 34

    Fines reach at least EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and EUR 7 million or 1.4 percent for important ones.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The incident register shows the early warning, notification and final report deadlines of each significant incident, with reminders to the owner.

  • Each Art. 21 measure is a requirement you link to policies, controls and evidence.

  • Already working on ISO 27001? The crosswalk shows which of that work also counts for NIS2.

  • Fasttrack checks your sector against Annexes I and II and your size, and says whether NIS2 likely applies and why.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • Scope, sectors, and entity classification3
  • Governance and management body accountability2
  • Cybersecurity risk-management measures (Art. 21)10
  • Incident reporting obligations6
  • Use of European cybersecurity certification schemes and standards2
  • Supervision, enforcement and administrative fines3

Related frameworks: ISO 27001 DORA EU Cyber Resilience Act

Free self-check

Answer a short questionnaire and get an indicative readiness score and the gaps that matter most, by email.

Take the self-check

Common questions

Are small companies covered by NIS2?

Usually not: NIS2 covers medium-sized and larger organizations in its sectors. Some are covered whatever their size, such as DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications, and a country can designate others. Customers in scope will also ask their suppliers for NIS2-level security.

What is the difference between an essential and an important entity?

Both take the same measures and report incidents the same way. Essential entities are supervised before anything goes wrong and face higher fines; important entities are supervised after the fact, when there are signs of a problem.

Does NIS2 apply to banks?

Banks and financial market infrastructures are listed in NIS2, but for financial entities DORA's rules on ICT risk management and incident reporting take the place of NIS2's.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt NIS2 in a free trial, link the evidence you already have and see what is still missing.

Start a free trial