CyphrQ
Menu

NIS2 Requirements: Who Is in Scope and the 24-Hour Reporting Clock

Who NIS2 covers, the ten Article 21 security measures, the 24-hour, 72-hour and one-month incident reporting clock, fines, and a readiness checklist.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

13 min read

What does NIS2 require? NIS2 is the EU's cybersecurity law for medium and large organisations in listed sectors. The core NIS2 requirements are a set of security measures, board-level accountability, and a three-step incident report: an early warning within 24 hours, a notification within 72 hours, and a final report within one month.

Updated 25 October 2026.

This is not legal advice. CyphrQ.ai wrote this summary of the directive in everyday English, and no lawyer has reviewed it. Each point links to its source so your legal adviser can test it.

What is the NIS2 Directive?

NIS2 is Directive (EU) 2022/2555, the second EU directive on network and information security. A directive is not applied directly to companies. Each Member State has to write it into national law, and your obligations come from that national law.

The Commission says Member States had until 17 October 2024 to do so, and that NIS2 repealed the original NIS directive as from 18 October 2024 (European Commission). The official text is on EUR-Lex.

Three ideas carry most of it:

  • Scope: a list of sectors, plus a size test.
  • Duties: security measures, management accountability and incident reporting.
  • Enforcement: national authorities with powers to fine.

Who is in scope of NIS2?

Medium and large organisations in the sectors the Directive lists. The scope rules are in Articles 2 and 3 of the Directive. I have not re-read them for this post, so the wording below is the Commission's. Its FAQ (last updated 29 June 2023) puts it this way: "all medium and large-sized companies in selected sectors will be included in the scope". Member States may also bring in smaller entities with a high security risk profile (European Commission FAQ).

The sectors sit in two annexes. The FAQ gives examples of each:

Annex I: sectors of high criticality Annex II: other critical sectors
Examples Energy, transport, banking, health, digital infrastructure, ICT service management, public administration, space Postal and courier, waste management, chemicals, food, manufacturing, digital providers, research

The FAQ page is a summary, not the legal text. The full lists of sub-sectors and entity types are in Annexes I and II of the Directive. Check the exact entity type, because a sector heading alone does not settle it.

In practice, three questions decide whether NIS2 reaches you:

  1. Is any of our activity in an Annex I or Annex II sector?
  2. Are we medium-sized or larger under the EU definition of a small and medium-sized enterprise?
  3. Where are we established? The FAQ says the default is the Member State of establishment, and that an entity established in several Member States falls under each of them. For cloud, data centre, DNS and similar providers, it is the Member State of main establishment in the Union.

If you are a supplier to an in-scope company, you may not be covered yourself, but your customer will ask you for evidence. Supply chain security is one of the required measures, as the next sections show.

How NIS2 sits with the finance rules: for banks and similar firms, the Commission says DORA applies to cybersecurity risk management and reporting. That is the Commission's description. I have not checked it against the DORA text. The detail is in DORA: the ICT risk rules for financial firms.

What is the difference between essential and important entities under NIS2?

NIS2 replaced the older split between operators of essential services and digital service providers. Every in-scope entity is now either "essential" or "important", and the two groups are supervised differently (European Commission FAQ). The security duties are the same for both. The difference lies in how authorities supervise and in the fine ceilings, covered below.

What are the NIS2 requirements for security measures?

Article 21 requires "appropriate and proportionate" technical, operational and organisational measures to manage the risks to your network and information systems and to limit the impact of incidents (Directive, Article 21). The Commission describes it as a list of ten key elements (European Commission FAQ). Article 21(2) names them:

  1. Risk analysis and information system security policies
  2. Incident handling
  3. Business continuity, including backup management, disaster recovery and crisis management
  4. Supply chain security
  5. Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
  6. Policies to assess whether your measures work
  7. Basic cyber hygiene and cybersecurity training
  8. Cryptography and, where appropriate, encryption
  9. Human resources security, access control and asset management
  10. Multi-factor or continuous authentication, secured communications and emergency communications, where appropriate

Two points matter for non-specialists. First, "proportionate" means a 300-person manufacturer is not expected to run like a bank, but it must be able to show it assessed its risks and chose measures to match. Second, none of the ten is exotic. Most are things a mature IT team already does. The new part is having to prove it.

How does the NIS2 incident-reporting clock work?

Article 23 sets a staged report for any significant incident, sent to your national computer security incident response team (CSIRT) or competent authority. The Commission summarises it as an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after that (European Commission FAQ).

Step Deadline What it holds
Early warning Within 24 hours of becoming aware Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have cross-border impact
Incident notification Within 72 hours of becoming aware Updates to the early warning, plus an initial assessment: severity, impact and, where available, indicators of compromise
Final report Not later than one month after the incident notification Description of the incident, likely root cause, mitigation applied and ongoing, and cross-border impact where relevant

Source for the table: Directive, Article 23(4). The three deadlines are checked against the Directive text. The "what it holds" column is my summary, so check it against Article 23(4) and your national template. The Directive also provides for further reports, such as an intermediate report on request, which I have left out.

One detail trips people up. The Commission's FAQ says the final report comes "no later than one month after that". The statute is more precise: the one month counts from the submission of the incident notification, not from the moment you became aware. Plan from the Directive's wording and confirm your national law, since each country sets its own reporting channel.

What counts as a significant incident under NIS2?

Article 23(3) treats an incident as significant if it has caused or is capable of causing "severe operational disruption" or financial loss, or has affected or is capable of affecting others by causing considerable material or non-material damage. For some digital providers, the Commission has set finer criteria in Implementing Regulation (EU) 2024/2690, covered below.

The early warning is deliberately thin. It exists to alert the authority and let you ask for help, not to explain the incident. The practical consequence is that the 24-hour clock is a process problem, not a forensics problem. You need to know who decides that something is significant, who can submit, and how, at 3 a.m. on a Sunday.

What are the NIS2 fines, and are managers personally liable?

Fines depend on the entity class. According to the Commission, essential entities face a maximum of at least EUR 10 million or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Important entities face a maximum of at least EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher (European Commission FAQ; the legal basis is Article 34). Those are ceilings that Member States must provide for, not predicted fines. The figures are the Commission's; I have not re-read Article 34 for this post. Authorities can also issue binding instructions and orders to bring measures into line.

On people: the Commission states that the Directive introduces liability for natural persons in senior management positions of in-scope entities. Article 20 puts the duty on the management body, the people who approve the cybersecurity measures and oversee them. The technical section covers what that means in practice.

Has every EU country transposed NIS2?

Not as of 1 July 2025, according to the Commission's own page, and I found nothing newer on it when I re-opened it on 25 October 2026. It reports no referral to the Court of Justice.

The Commission's "NIS2 Directive transposition in EU countries" page says that on 7 May 2025 the Commission sent a reasoned opinion to 19 Member States for failing to notify full transposition.

The page lists them: Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden. It says they had two months to respond and that the Commission may then refer cases to the Court of Justice of the EU (European Commission).

Three cautions about that:

  • That page shows "last updated 1 July 2025". I read it on 25 October 2026. It is the latest official statement I could find on that page, not necessarily the current position.
  • The page says it is a "state-of-play based on information provided by Member States" and does not prejudge the formal compliance assessment. Country-by-country status sits on linked national pages.
  • Other legislative change is in motion. The Commission's NIS2 page, updated 2 July 2026, says the Commission proposed targeted amendments to NIS2 on 20 January 2026 (European Commission). I have not analysed that proposal, and it is not law.

Practical answer: find your national authority and read the national act, not the Directive. The Directive sets a floor. National law decides your registration steps, your reporting channel and your penalties.

How do I prepare for NIS2?

  1. Decide whether you are in scope: sector, size, and which country or countries you are established in. Write the reasoning down.
  2. Name one board member or director who owns NIS2, and put cyber risk on the board agenda.
  3. List your suppliers that touch your systems or data, ranked by how bad their failure would be for you.
  4. Write a one-page incident plan: who declares an incident significant, who reports, to which authority, in which format.
  5. Run a drill with a clock: start from "we have just found ransomware" and see what you can send in 24 hours.
  6. Check backups by restoring from them, not by reading the dashboard.
  7. Turn on multi-factor authentication for every admin and remote-access account.
  8. Ask your key suppliers how they would notify you of an incident, and how fast.

Going deeper: for security and IT teams

How does NIS2 map to ISO 27001?

If you already run ISO/IEC 27001, you hold much of the evidence. The table is my indicative mapping to the 2022 edition of ISO/IEC 27001 and its Annex A, not an official one. ISO's text is paywalled, so I could not check the clause and control numbers against it. Treat them as pointers and confirm each one.

ENISA's June 2025 technical implementation guidance for Implementing Regulation 2024/2690 includes mappings to ISO/IEC 27001:2022 and 27002:2022 and is the better reference for control-level detail (ENISA). The guidance is non-binding.

Article 21(2) measure Indicative ISO/IEC 27001:2022 anchor
Risk analysis and security policies (a) Clause 6.1.2 risk assessment, clause 6.1.3 risk treatment, A.5.1 policies
Incident handling (b) A.5.24 to A.5.28
Business continuity and backup (c) A.5.29, A.5.30, A.8.13
Supply chain security (d) A.5.19 to A.5.22, A.5.23 for cloud services
Acquisition, development, vulnerability handling (e) A.8.8, A.8.25
Assessing effectiveness (f) Clauses 9.1 to 9.3
Cyber hygiene and training (g) A.6.3
Cryptography (h) A.8.24
HR security, access, assets (i) A.6.1, A.5.15, A.5.9
MFA and secured communications (j) A.8.5, A.5.14

An ISO 27001 certificate does not equal NIS2 compliance. Certification covers a scope you define. NIS2 duties attach to the legal entity and its services, so check that your scope statement covers the systems that deliver the in-scope service.

Use the Implementing Regulation as a worked example. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets technical and methodological requirements for certain digital infrastructure, ICT service management and digital providers, and criteria for significant incidents (EUR-Lex; ENISA). If you are not one of those entity types, it does not bind you, but it shows how the Commission reads Article 21. For example, it calls for a risk management framework with documented risk assessments and a risk treatment plan, a business continuity and disaster recovery plan, and a supply chain security policy covering direct suppliers and service providers. Confirm which entity types Article 1 lists before applying it.

Supply chain security in practice. Article 21(2)(d) covers the relationship with direct suppliers and service providers. In my reading, Article 21(3) adds that entities should take into account each supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development procedures. Turn that into evidence:

  • a supplier register with criticality, data access and the contract owner;
  • security clauses in the contract: incident notification time, audit or evidence rights, sub-processor changes, exit;
  • a notification period from critical suppliers shorter than your own 24-hour deadline, otherwise you cannot meet it;
  • a sample of supplier evidence reviewed each year, such as an ISO 27001 certificate with its scope statement, or a penetration test summary.

Shadow IT is a supplier risk too: an AI tool nobody approved is a supplier nobody assessed. See Shadow AI at Work.

Management accountability (Article 20). In my reading, Article 20 requires the management body to approve the cybersecurity risk-management measures, oversee their implementation, and be able to be held liable for infringements. It also requires management body members to follow training and encourages the same for staff. Evidence an auditor can ask for: board or committee minutes showing approval of the risk-management policy, a dated record of who attended training, and a risk register that the board actually reviews. A signature on a policy no one discussed is weak evidence.

Build the 24-hour path before you need it.

  • Define the "significant incident" test in your incident procedure, using the Article 23(3) wording, with a named decision-maker and a deputy.
  • Record the "time of becoming aware" in the ticket. Your own timestamps are what you will be judged against.
  • Keep a pre-filled template for the early warning (suspected malicious cause, cross-border impact) and one for the 72-hour notification (severity, impact, indicators of compromise).
  • Check which log sources prove the timeline: identity provider sign-in logs, EDR alerts, firewall and VPN logs, and email gateway logs.
  • Test the channel itself. A national portal that needs credentials nobody has is a common failure.

What to ask your auditor, regulator or vendor.

  • Which national law and which authority apply to each of our entities?
  • Is our entity classed as essential or important, and does registration apply?
  • Which reporting channel and format does the CSIRT accept?
  • How quickly will you notify us of an incident that affects our data?

Key takeaways

  • NIS2 (Directive (EU) 2022/2555) covers medium and large organisations in the sectors in Annexes I and II. Your duties come from the national law that transposes it.
  • Article 21 requires ten kinds of security measure, from risk analysis and incident handling to supply chain security and multi-factor authentication.
  • Incident reporting runs in three steps: early warning within 24 hours, notification within 72 hours, and a final report within one month. The one month counts from the notification.
  • The Commission gives fine ceilings of at least EUR 10 million or 2% of turnover for essential entities and EUR 7 million or 1.4% for important ones. It also states that senior managers can be personally liable.
  • On the Commission's transposition page (last updated 1 July 2025), 19 Member States had received a reasoned opinion on 7 May 2025. Check your own country's current position.
  • Start with scope, a board owner, a supplier list and a timed incident drill.

Sources