Personalized View ActiveShowing content relevant to:
Important Legal Notice: This website does not replace official EU publications
We are not responsible for discrepancies with official sources. Always consult the official publications for legal compliance and authoritative information.
Menu
Directive (EU) 2022/2555
NIS2
NIS2 Directive obligations
What essential and important entities, their management bodies and the Member States must do under NIS2, chapter by chapter and article by article. As a directive, NIS2 reaches entities through the national laws that transpose it; the articles here are the Union text those laws implement.
48 articles carry obligations; 255 obligations listed, summarised from the article text. The article is one click away every time.
At a glance
Every obligation, in the order of the law
Chapter by chapter, each article that puts an obligation on someone, with who it addresses and what it asks. The wording here is a summary; the article text is the law, and it is one click away.
Who. Medium and large enterprises in Annex I/II sectors, all providers of public electronic communications, trust services, domain name services, entities critical for public safety/security/health, entities causing systemic risk, critical regional/national entities, certain public administrations, and optionally local governments and educational institutions
Medium-sized and larger entities in Annex I or II sectors must comply with NIS2 requirements
All public electronic communications providers and trust service providers must comply regardless of size
Entities identified as critical under the Critical Entities Resilience Directive must comply
Domain name registration service providers must comply regardless of size
Entities must respect confidentiality rules when exchanging information with authorities
Personal data processing must comply with GDPR and relevant privacy laws
Who. Large companies in critical sectors (energy, transport, health, digital infrastructure, etc.), qualified trust service providers, DNS providers, telecom providers above medium-size thresholds, certain public administrations, and any entities previously designated as critical infrastructure operators
Submit registration information to competent authorities including name, contact details, IP ranges, sectors, and countries of operation
Notify authorities of any changes to registration details within two weeks
Participate in Member State entity listing process by April 17, 2025
Provide updated information for regular reviews every two years
Who. Essential and important entities that are subject to sector-specific EU laws with cybersecurity requirements (e.g., financial services, aviation, energy sectors with their own regulations)
Entities must determine if they are covered by sector-specific EU laws with equivalent cybersecurity requirements
If covered by equivalent sector-specific laws, they follow those instead of NIS2
Entities not covered by sector-specific laws must comply with NIS2
Risk management measures must be at least as strong as NIS2 Article 21(1) and (2)
Incident notification requirements must be at least as strong as NIS2 Article 23(1) to (6)
Incident notifications must provide CSIRTs/authorities with immediate access (automatic and direct where appropriate)
Who. All entities covered by NIS2 including: DNS service providers, TLD registries, cloud computing services, data centers, content delivery networks, online marketplaces, search engines, social networks, public administration entities, managed service providers, and any organization needing to understand NIS2 terminology
Understanding and applying these definitions to determine if your organization falls under NIS2 scope
Using these definitions to properly classify incidents, risks, and cyber threats
Identifying which category of entity your organization belongs to (DNS provider, cloud service, data center, etc.)
Appointing a representative in the EU if you're a non-EU provider of covered services
Who. EU Member States (national governments) - this is a state-level obligation that sets the framework for how each country will implement NIS2 requirements
Adopt a national cybersecurity strategy with defined objectives and resources
Establish governance frameworks clarifying roles and responsibilities
Identify and assess cybersecurity risks for relevant national assets
Develop incident response and recovery measures
Create policies for supply chain security and vulnerability management
Implement cybersecurity requirements in public procurement
Who. EU Member States (government level requirement for national cyber crisis management frameworks)
Designate or establish one or more cyber crisis management authorities with adequate resources
Appoint a coordinator if multiple authorities are established
Identify capabilities, assets and procedures deployable during cyber crises
Adopt a national large-scale cybersecurity incident and crisis response plan
Include specific elements in the plan: objectives, responsibilities, procedures, preparedness measures, stakeholder involvement, and EU coordination arrangements
Notify the Commission of designated authorities within 3 months
Who. EU Member States (government level requirement) - not directly applicable to businesses but affects essential and important entities who must interact with CSIRTs
Designate or establish one or more CSIRTs covering all essential and important entities
Ensure CSIRTs have adequate resources to perform their tasks effectively
Provide CSIRTs with secure and resilient communication infrastructure
Deploy secure information-sharing tools for CSIRT operations
Who. Member States (mandatory designation of CSIRT coordinator), ENISA (database maintenance), all entities and ICT suppliers (voluntary participation in database), natural/legal persons reporting vulnerabilities
Each Member State must designate one CSIRT as vulnerability disclosure coordinator
Designated CSIRT must act as trusted intermediary between vulnerability reporters and affected vendors
CSIRT must enable anonymous vulnerability reporting when requested
CSIRT must ensure diligent follow-up on reported vulnerabilities
CSIRTs must cooperate across Member States for multi-country impacts
ENISA must develop and maintain a European vulnerability database
Who. Member States and their designated national competent authorities, CSIRTs (Computer Security Incident Response Teams), and single points of contact responsible for NIS2 implementation
Competent authorities, single points of contact, and CSIRTs must cooperate within each Member State
CSIRTs must receive all significant incident notifications from Articles 23 and 30
CSIRTs must inform single points of contact about all incident notifications
Member States must ensure cooperation between cybersecurity bodies and other regulatory authorities (law enforcement, data protection, aviation, telecom, etc.)
Regular information exchange required between NIS2 authorities and critical infrastructure authorities
Member States must simplify incident reporting through technical means
EU-CyCLONe shall be composed of the representatives of Member States’ cyber crisis management authorities as well as, in cases where a potential or ongoing large-scale cybersecurity incident has or is likely to have a significant impact on services and activities falling within the scope of this Directive, the Commission
In other cases, the Commission shall participate in the activities of EU-CyCLONe as an observer
ENISA shall provide the secretariat of EU-CyCLONe and support the secure exchange of information as well as provide necessary tools to support cooperation between Member States ensuring secure exchange of information
EU-CyCLONe shall have the following tasks (5 specific requirements - see full details)
Who. EU Member States (participation is voluntary), the Cooperation Group, ENISA, CSIRTs network, and designated cybersecurity experts conducting the reviews
The Cooperation Group must establish peer review methodology by January 17, 2025
Participating Member States must designate qualified cybersecurity experts from at least two different countries
Member States must provide necessary information for assessment during reviews
Member States must ensure no conflicts of interest with designated experts
Peer review reports must be submitted to the Cooperation Group and CSIRTs network
Same aspects cannot be reviewed again for 2 years after a peer review concludes
Who. Essential and important entities as defined by NIS2, including critical infrastructure operators, digital service providers, and entities in sectors like energy, transport, banking, health, and digital infrastructure
Implement risk-based technical, operational and organizational security measures
Establish policies for risk analysis and information system security
Set up incident handling procedures
Ensure business continuity through backup management and disaster recovery plans
Secure supply chains by assessing suppliers and service providers
Manage security in system development and maintenance including vulnerability handling
Who. EU Cooperation Group members, national cybersecurity authorities, organizations using critical ICT services/systems/products identified by the Commission, and relevant supply chain stakeholders
Member states must participate in EU-level coordinated supply chain risk assessments when requested
Organizations may need to provide information about their critical ICT supply chains for assessment
Stakeholders must cooperate with Commission and ENISA during supply chain evaluations
Who. Essential and important entities under NIS2, with specific categories to be determined by Commission delegated acts based on identified cybersecurity risks
Use EU-certified ICT products, services, and processes when required by Member States
Demonstrate compliance with Article 21 requirements through certification
Consider using qualified trust services as encouraged by Member States
Comply with future Commission-mandated certification requirements for specific entity categories
Who. EU Member States (as regulators) and ENISA (as guidance provider); indirectly affects all NIS2-covered entities who will follow the promoted standards
Member States must encourage use of European and international cybersecurity standards
Member States cannot impose or favor specific technology types
ENISA must develop advice and guidelines on relevant technical areas
ENISA must identify existing standards (including national ones) that cover required security areas
Who. DNS providers, cloud computing providers, data centers, CDN providers, managed service/security providers, online marketplaces, search engines, social networks, public electronic communications providers, and public administration entities
Digital service providers must establish which Member State has jurisdiction over them based on their main establishment
Main establishment is determined by where cybersecurity risk-management decisions are made, or where cybersecurity operations occur, or where most EU employees work
Non-EU entities offering services in the EU must designate a representative in one Member State where they provide services
Entities must accept the jurisdiction of the Member State where they fall under based on these rules
Public electronic communications providers fall under jurisdiction where they provide services, not where established
Who. DNS service providers, TLD name registries, domain registration services, cloud computing providers, data centre providers, CDN providers, managed service providers, managed security providers, online marketplaces, search engines, and social networking platforms
Submit registration information to national authorities by January 17, 2025
Provide company name, address, contact details, service locations, and IP ranges
Notify authorities of any changes within 3 months of the change occurring
Designate a representative if not established in the EU
Article 28: Database of domain name registration data
Who. Essential and important entities (for incidents beyond mandatory requirements), and any other organization regardless of whether they fall under NIS2 scope
No new obligations - this article creates voluntary reporting options, not requirements
Member States must accept and process voluntary notifications from both in-scope and out-of-scope entities
Authorities must maintain confidentiality and protect information from voluntary reports
Voluntary reporting cannot be used to impose additional obligations on the reporting entity
Chapter VII · Art. 31 to 37
Supervision and Enforcement
Article 31: General aspects concerning supervision and enforcement
Who. Essential entities as defined under NIS2, their management (CEOs, legal representatives, and those with decision-making authority), and partially applicable to public administration entities (with some exceptions)
Submit to on-site inspections and off-site supervision including random checks
Undergo regular and targeted security audits
Provide requested information about cybersecurity measures and policies
Grant access to data, documents and evidence of policy implementation
Implement recommendations from security audits within specified deadlines
Inform affected parties about significant cyber threats
Who. Essential and important entities that violate NIS2 Directive requirements, particularly Articles 21 (cybersecurity risk management measures) and 23 (incident reporting obligations). Also applies to Member States who must implement these fine structures.
Member States must establish administrative fines that are effective, proportionate and dissuasive
Fines must be imposed in addition to other enforcement measures, not instead of them
Essential entities face maximum fines of at least €10 million or 2% of worldwide annual turnover (whichever is higher) for violations of Articles 21 or 23
Important entities face maximum fines of at least €7 million or 1.4% of worldwide annual turnover (whichever is higher) for violations of Articles 21 or 23
Member States must consider specific criteria when determining fine amounts for each case
Member States may impose periodic penalty payments to compel compliance
Article 35: Infringements entailing a personal data breach
Who. Essential and important entities under NIS2 when their violations of Articles 21 (risk management) and 23 (incident reporting) result in personal data breaches
Competent authorities must inform GDPR supervisory authorities without undue delay when they discover infringements involving personal data breaches
Authorities must avoid double penalties - if GDPR fine is imposed, no NIS2 fine for the same conduct
Cross-border notification required when GDPR authority is in different Member State
Who. Entities that provide services in multiple EU Member States or provide services in one Member State while their network and information systems are located in other Member States
Competent authorities must inform and consult other Member States' authorities before taking supervisory or enforcement measures against multi-national entities
Authorities must provide mutual assistance including information sharing and joint inspections when requested
Authorities can only refuse assistance requests if they lack competence, the request is disproportionate, or it would harm national security
Must consult with other authorities, Commission, and ENISA before refusing assistance requests
May conduct joint supervisory actions across Member States when appropriate
Who. Qualified trust service providers who previously reported security breaches under eIDAS Regulation Article 19
Qualified trust service providers must follow NIS2 incident reporting rules instead of the old eIDAS Article 19 requirements from October 18, 2024 onwards
Who. Reference material for all entities subject to NIS2
Use this correlation table to identify changes from NIS1 to NIS2 requirements
Review corresponding articles when updating compliance programs from NIS1
Reference table for legal and regulatory alignment purposes
Article 21
The measures the obligations point to
Essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems (Art. 21(1)). Article 21(2) lists the ten measures those must at least include, from policies on risk analysis to the use of multi-factor authentication.
EU cybersecurity laws can be complex. Our free tools and guides work great for most people, but if you're dealing with something particularly challenging or have tight deadlines, we're here to help.
