NIS2 Directive – EU’s response to growing cyber threats
Find out how to prepare your company for new requirements and increase IT resilience
Table of contents
What is the NIS2 Directive all about?
The Network and Information Security 2 (NIS2) Directive, formally Directive (EU) 2022/2555, is an EU piece of legislation aimed at raising the level of cyber security across the European Union. It replaces the earlier 2016 NIS Directive and introduces more stringent requirements for risk management, incident response and IT security reporting.
Basic facts:
- It went into effect on January 16, 2023.
- It should be implemented by October 17, 2024. – however, many countries are still finalizing implementation.
Whom does the NIS2 Directive apply to?
NIS2 applies to a wide range of organizations – both public and private, that affect the operation of key sectors in the EU (e.g., energy, transportation, health, digital services).
The new regulations also have a cascading effect – even smaller companies can be subject to the requirements if they are part of supply chains or work with larger regulated entities.
Key responsibilities in NIS2
Governance and accountability
Boards of directors must proactively approve security policies, manage risks and train staff on cyber security.
Risk management measures
Organizations are required to implement a systemic approach to risks, with technical and organizational safeguards and security monitoring of IT/OT systems.
Incident reporting
NIS2 makes it mandatory to Prompt reporting of cyber security incidents to relevant national response teams (e.g., CSIRTs) and supervisory authorities – in accordance with specified deadlines.
Certification and standards
Companies may be required to use ICT products, services and processes that comply with European cybersecurity certification programs (Article 24).
Latest News
Delays in implementation in EU countries:
Many EU countries have missed the deadline for implementing NIS2 into national law, which means that legislative work is still underway (e.g., in Poland).
ENISA Guidelines:
The European Cyber Security Agency (ENISA) has published detailed technical guidelines to help practically implement NIS2 requirements. enisa.europa.eu
Latest security practices:
Organizations subject to NIS2 must particularly focus on Strong authentication (MFA) and password management – are now a key component of cybersecurity compliance.
Requirements for IT infrastructure in 2025/2026
To be NIS2 compliant, a company should, among other things:
- Determine whether it is within the scope of the directive and which systems are key.
- Maintain an inventory of IT resources and continuously monitor systems.
- Implement risk management procedures and an incident response plan.
- Provide staff and management training.
- Consider continuous auditing and reporting tools – such as eAuditor.
The role of eAuditor in meeting NIS2 requirements
Software eAuditor is a system that supports organizations in the following areas:
- Automatic inventory of IT resources
- Security monitoring and reporting
- Risk management and evidence of compliance
- Automation of security processes
With eAuditor, IT departments can reduce the time to prepare for NIS2 compliance and focus on key operational and strategic requirements.
NIS2 in a nutshell
Since when has NIS2 been in effect in the EU?
The directive is effective as of October 17, 2024, although national implementation may vary among member states.
Does my company need to be NIS2 compliant?
If you operate in critical sectors or are linked to their supply chain – yes. Even small companies can be covered.
What are the sanctions for failure to implement the NIS2 directive?
Non-compliance can result in financial penalties of up to €10 million or 2% of global turnover.
What is most important to implement the NIS2 directive?
Risk management, incident reporting, staff training, and technical protection measures (e.g., MFA).
