NIS2 requirements: A complete guide to compliance & implementation

Struggling to navigate the new NIS2 requirements? This guide breaks down everything you need to know—who needs to comply, key cybersecurity measures, reporting obligations, and how to avoid penalties. Get clear, actionable insights to ensure your organization meets the latest EU cybersecurity standards.

Understanding NIS2 requirements

The NIS2 Directive sets new, stricter cybersecurity rules for organizations across the EU. Whether you're an essential service provider or part of the supply chain, compliance will be a legal requirement.

But what exactly are the NIS2 requirements, and why do they matter? In short, NIS2 mandates stronger risk management, stricter reporting rules, and clearer accountability for cybersecurity. It applies to a wide range of industries, from energy and healthcare to cloud services and software providers. If your organization is in scope, failing to comply could mean heavy fines and personal liability for executives.

This guide will break down who needs to comply with the NIS2 framework, what’s required, and how to get ready—so you can stay ahead of the risks and avoid penalties.

NIS2 requirements: implementation deadline

NIS2 was set to be transposed into national law by October 17, 2024, but Germany and other EU countries missed the deadline to fully implement the directive. While governments have finalized key details, some countries like Germany are still pending parliamentary approval. Despite this, organizations operating in the EU shouldn’t wait—they should proactively ensure their cyber security measures align with NIS2..

The directive’s impact is big: 30,000 organizations in Germany alone will fall under its scope, up from fewer than 2,000 today.

With enforcement expected to kick in as soon as national laws are passed, companies need to act now. Delaying compliance isn’t an option—waiting could mean operational risks, financial penalties, and pressure from partners to meet security standards.

Scope of NIS2 requirements: Who does it apply to?

NIS2 isn’t just for critical infrastructure anymore—it widens the net, covering more industries and organizations than before. If your organization provides essential digital or physical services in the EU —or plays a key role in the supply chain—, chances are you’re now in scope.

The directive divides organizations into two categories:

Essential entities (e.g., energy, healthcare, banking, transport) face stricter oversight and enforcement.

Important entities (e.g., IT services, digital infrastructure, manufacturing) must still comply but with slightly less regulatory scrutiny.

Essential entities

These organizations face the strictest compliance requirements due to their critical role in the economy and public safety:

Energy: Electricity, gas, oil, heating/cooling, hydrogen supply, EV charging infrastructure

Transport & Logistics: Air, rail, road, and maritime transport, including shipping companies and port operators

Financial Services: Banking, trading, market infrastructure, and insurance providers

Healthcare: Hospitals, medical research labs, pharmaceutical companies, and medical device manufacturers

Water Supply: Drinking water and wastewater management

Digital Infrastructure: DNS providers and top-level domain registries
Public Administration: Government institutions and other public entities
Space Industry: Operators of ground-based infrastructure

Important entities

While not considered critical, these businesses, depending on their size and sector, still have compliance obligations under NIS2:

Food Production

Postal and Courier Services

Chemical Industry

Manufacturing

Digital Services

Research Institutions

Waste Management

If your business falls into any of these categories —or provides key services to essential entities—, you must implement cybersecurity risk management measures, report incidents, and ensure compliance.

Not sure if NIS2 applies to you? Company size, sector, impact on society, and role in supply chains determine your status. If you handle critical data, provide key services, or rely on networked systems, it’s time to check your obligations—because non-compliance comes at a cost.

Key NIS2 requirements organizations must meet

The new NIS2 cybersecurity regulation raises the bar for organizations across the EU. The directive sets strict rules within with four key areas of obligation: risk management, corporate accountability, reporting obligations, and business continuity, with steep penalties for non-compliance. If your organization falls under NIS2, it’s time to act—because compliance isn’t a quick fix, and enforcement is just around the corner.

1. Risk management requirements: strengthening cyber resilience

NIS2 requires organizations to implement robust security measures to minimize cyber risks. This includes:

Stronger access control – multi-factor authentication (MFA) is mandatory, with alternative authentication measures required where MFA is not feasible

Data encryption and secure backups – Sensitive data must be encrypted in storage and transit, with regularly tested backups ensuring quick recovery in case of a breach

Enhanced network security – Firewalls and intrusion detection/prevention systems (IDS/IPS) must monitor and protect networks against unauthorized access

Incident management – Organizations must develop clear incident response procedures and conduct tabletop exercises to test their effectiveness

Supply chain security – Businesses must evaluate the cybersecurity posture of third-party vendors and suppliers, ensuring compliance with NIS2 standards

2. Corporate accountability requirements: cybersecurity is a leadership responsibility

Under NIS2, senior management is directly accountable for cybersecurity compliance. Leadership teams must:

Oversee and approve cybersecurity strategies to ensure alignment with NIS2 requirements

Undergo cybersecurity training to stay informed about threats and compliance obligations

Be held personally liable for cybersecurity failures, including potential temporary bans from management roles in severe cases of non-compliance

3. Reporting obligations: strict deadlines for incident reporting

Organizations must report cybersecurity incidents promptly to national authorities:

24-hour early warning notification for significant incidents

72-hour full incident report detailing the breach and mitigation measures

Final report within one month, outlining recovery efforts and long-term improvements

Failure to report incidents within the required timeframe can lead to fines and increased regulatory scrutiny.

4. Business continuity requirements: ensuring resilience during cyber incidents

Organizations must prepare for major cyber incidents with a structured business continuity plan that includes:

System recovery and emergency procedures to minimize downtime

Crisis response teams trained to manage cybersecurity incidents

Up-to-date backups to ensure data integrity and operational continuity

Want to know more about NIS2 requirements? Check out our on-demand webinar and find out how you can best prepare for NIS2.

NIS2 requirements checklist: 10 essential measures for compliance

Achieving NIS2 requirements requires a structured approach to cybersecurity. Implementing these 10 essential security measures will help organizations strengthen their defenses, minimize cyber risks, and align with regulatory expectations. While not an exhaustive list, these actions provide a strong foundation for meeting NIS2 requirements.

NIS2 security measures checklist

1. Risk assessments and security policies – Organizations must regularly evaluate cyber risks and implement security controls to mitigate threats

2. Procedures for measuring security effectiveness – Security audits, penetration testing, and ongoing evaluations are required to ensure continuous compliance

3. Encryption and cryptographic policies – Sensitive data must be encrypted in both storage and transmission to prevent unauthorized access

4. Incident handling framework – A structured incident response plan must be in place to detect, manage, and recover from security breaches

5. Secure procurement and system operation policies – Organizations must apply security best practices in system development, procurement, and IT maintenance

6. Cybersecurity training and computer hygiene – Employees must receive regular security awareness training to minimize risks related to human error

7. Access control and asset management – Strong access control policies must be implemented, along with continuous authentication measures and a clear overview of all critical assets

8. Business continuity planning – Organizations must maintain up-to-date backups and ensure IT system recovery strategies are in place to minimize downtime after incidents

9. Advanced authentication and secure communication – Multi-factor authentication (MFA), encrypted internal communication, and continuous authentication solutions must be adopted where appropriate

10. Supply chain security policies – Organizations must assess the cybersecurity posture of direct suppliers and implement appropriate security measures to protect the broader supply chain.

By putting these measures into action, organizations enhance their cybersecurity and also take a big step toward NIS2 compliance—reducing risks, strengthening resilience, and staying ahead of regulatory demands.

NIS2 requirements: A step-by-step guide to compliance

Navigating NIS2 requirements can seem overwhelming, but breaking it down into clear, actionable steps makes the process manageable. This checklist outlines key actions organizations should take to meet NIS2 requirements, from assessing risks to preparing for audits.

1. Determine if your organization is in scope

Start by confirming whether NIS2 applies to your organization. The directive covers essential and important entities across various sectors, including energy, healthcare, finance, digital services, and manufacturing. If you're part of the supply chain for these industries, you may also need to comply.

2. Conduct a NIS2 gap analysis

To achieve NIS2 compliance, start with a gap analysis to identify weaknesses in your cybersecurity framework.

Check your risk management and incident response readiness—do you have a clear process for detecting and reporting cyber threats? Review access controls and encryption to ensure sensitive data is protected and MFA is in place.

Assess supply chain security—are your vendors meeting cybersecurity standards? Strengthen business continuity plans to ensure fast recovery from disruptions. Finally, ensure compliance documentation and reporting are up to date to meet NIS2’s strict deadlines.

Closing these gaps will bring you one step closer to compliance.

3. Develop a cybersecurity risk management strategy

A strong cybersecurity risk management strategy is key to NIS2 compliance.

Conduct regular risk assessments to spot vulnerabilities before attackers do. Strengthen access controls and if you haven’t implemented strong access controls, this is the time: use multi-factor authentication (MFA) to prevent unauthorized access.

Implement encryption policies to protect sensitive data in storage and transit. Stay ahead of threats with vulnerability management, including frequent patching and penetration testing.

Proactive security measures will reduce risks and keep your organization compliant.

4. Strengthen governance and corporate accountability

Under NIS2, cybersecurity is a leadership responsibility. Senior management must oversee and approve security policies, ensuring compliance isn’t just an IT issue.

Executives need cybersecurity training to understand risks and decision-making responsibilities. A designated security officer should drive compliance efforts, while regular reviews of security frameworks and incident response plans keep defenses up to date.

Strong governance ensures accountability—and reduces the risk of penalties.

5. Establish an incident response and reporting process

NIS2 enforces strict reporting deadlines for major cyber incidents. Organizations must send an initial warning within 24 hours, submit a detailed report within 72 hours, and provide a final remediation report within one month.

A clear, well-documented incident response plan ensures swift action, minimizing damage and regulatory risks. Being prepared means faster containment, compliance, and recovery.

6. Secure your supply chain

Under NIS2, third-party risks can’t be ignored. Organizations must evaluate supplier security, ensuring vendors meet compliance standards.

Update contracts to include cybersecurity obligations, making security a shared responsibility. Implement monitoring systems to track risks and detect vulnerabilities before they become threats.

A secure supply chain strengthens overall resilience and reduces regulatory exposure.

7. Prepare for audits and regulatory assessments

NIS2 mandates that you prove your compliance with the requirements. Regulators will conduct audits, so organizations must be ready to demonstrate cybersecurity measures.

Maintain comprehensive documentation of risk assessments, policies, and security controls. Conduct regular internal audits to spot weaknesses before regulators do. Ensure ongoing cybersecurity training at all levels to keep teams prepared.

A structured approach reduces risks, strengthens resilience, and keeps your organization audit-ready.

Simplifying compliance: Check NIS2 requirements with automation and security platforms

Keeping up with NIS2 requirements can feel overwhelming—tracking risks, managing compliance documentation, and ensuring every security measure is in place takes time and resources. But compliance doesn’t have to be complicated. With the right automation and security platform, organizations can streamline the process, reduce manual effort, and stay ahead of regulatory requirements with ease.

With a platform that offers best in class features, you can:

Cut down complexity – Track NIS2 requirements in one place with clear dashboards and automated workflows

Stay audit-ready – Centralize policies, security controls, and risk assessments to simplify audits and reporting

Automate risk assessments – Detect vulnerabilities in real time and prioritize security improvements effortlessly

Speed up incident reporting – Ensure compliance with automated detection, response, and reporting tools

Empower your team – Provide built-in cybersecurity training to boost awareness and reduce human error

NIS2 compliance isn’t just about avoiding penalties—it’s about building a strong security foundation without the headache. Automating key processes means less time spent on admin and more time focusing on what really matters: protecting your organization.

What happens if you don’t comply with NIS2 requirements?

Failing to meet NIS2 requirements is a regulatory issue – it puts your organization at risk of heavy fines. With enforcement tightening in 2025, non-compliance can lead to serious financial and operational setbacks.

Fines and penalties are severe. Essential entities can be fined up to €10 million or 2% of global revenue, while important entities face penalties of up to €7 million or 1.4% of global revenue. Regulators also have the power to increase oversight, impose additional security requirements, and conduct audits to ensure compliance.

Executives are personally liable. NIS2 requirements place direct responsibility on senior management. If an organization fails to implement proper cybersecurity measures, executives can face fines, legal action, or even temporary bans from management roles.

Cybersecurity failures have real-world consequences. Organizations that neglect security have suffered crippling ransomware attacks, supply chain breaches, and massive data leaks, leading to financial losses, operational downtime, and lasting reputational damage.

NIS2 requirements are designed to prevent these risks by enforcing stronger security measures and accountability. Non-compliance isn’t just about penalties—it can threaten business continuity, erode customer trust, and leave your organization vulnerable to cyber threats.

How NIS2 requirements compare to other cybersecurity regulations

NIS2 vs. GDPR, DORA, and ISO 27001—what’s the difference? While all these regulations focus on cybersecurity and risk management, NIS2 requirements set legal obligations with strict enforcement, while others provide frameworks or industry-specific rules.

GDPR protects personal data, while NIS2 secures critical infrastructure and essential services against cyber threats.

DORA applies to the financial sector, aligning closely with NIS2 but with sector-specific ICT risk management rules.

ISO 27001 is a voluntary security framework, covering about 70% of NIS2 requirements but missing key obligations like mandatory and time-sensitive incident reporting, and expanded risk management.

Where do they overlap? Organizations already following ISO 27001 or DORA have a head start in meeting NIS2 requirements but must address additional compliance needs. Aligning these frameworks helps organizations streamline security efforts, reduce regulatory complexity, and stay ahead of evolving threats.

Ensuring compliance with NIS2 requirements

Thousands of organizations across Europe must meet stricter security requirements, mandatory incident reporting obligations, and increased accountability. With enforcement already in motion, companies that delay risk regulatory pressure, financial penalties, and security vulnerabilities.

Some EU countries, including Belgium and Italy, have already implemented NIS2, while others, like Germany, are finalizing national legislation. The European Commission has even taken legal action against member states that missed the transposition deadline—signaling that compliance will be strictly enforced. The time to act is now.

Achieving NIS2 requirements efficiently

Meeting NIS2 requirements doesn’t have to be complex or resource-heavy. Organizations that take a structured, digital-first approach can automate security processes, reduce risks, and integrate compliance into daily operations—without unnecessary overhead.

A security and compliance platform can help organizations:

Assess cybersecurity measures and identify compliance gaps

Automate risk management, audits, and reporting

Ensure seamless incident detection and response
Train employees on security best practices