NIS2

The Network and Information Security Directive 2 (NIS2, Directive (EU) 2022/2555) entered into force on 16 January 2023, replacing the original NIS Directive (2016) with a substantially expanded scope. Member states faced a transposition deadline of 17 October 2024. The Directive covers essential entities (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space) and important entities (postal services, waste management, chemicals, food, manufacturing, digital providers, and research), targeting organisations above 50 employees or €10m turnover in those sectors.

Key obligations include: 24-hour early warning and 72-hour full notification of significant incidents to the national competent authority; board-level accountability for cybersecurity risk management with individual liability for executives; supply-chain risk management requirements; minimum technical controls including MFA, encryption, and access management; and registration of domain-name registrars. Fine ceilings are €10m or 2% of global annual turnover (whichever is higher) for essential entities, and €7m or 1.4% for important entities — materially above NIS1 maxima.

By mid-2025, only 14 of 27 member states had fully transposed NIS2. The European Commission opened infringement proceedings against the remaining 13 in autumn 2025, escalating to reasoned opinions against 19 member states by April 2026. Germany, the Netherlands, Croatia, and Hungary transposed early or on time; France, Poland, and Spain were among the late cohort. The Directive's reach into supply chains, its board-accountability clause, and its fine ceiling at global revenue have made it the dominant compliance frame for European cybersecurity programmes.

NIS2's enforcement trajectory sharpened in April 2026 when ENISA released National Capabilities Assessment Framework 2.0 (NCAF 2.0) on 22 April — a structured maturity-scoring tool that lets member states benchmark their compliance position against NIS2 requirements . With 19 member states still under European Commission reasoned opinions for partial transposition, NCAF 2.0 signals a shift from political pressure to measurement-and-accountability. NCSC guidance on Incident Response and access management has been cited by regulators as the practical baseline that boards must now achieve. For CISOs operating in EU markets, NIS2 compliance is no longer a 2024 deadline story — it is an active enforcement and capability-benchmarking cycle.