NIS360

NIS360 is ENISA's annual benchmark report assessing the cybersecurity maturity of sectors covered by the EU's NIS2 Directive. The report scores each sector against a standard maturity model, then cross-references those scores against each sector's assessed criticality to identify where the gap between how important a sector is and how secure it actually is has grown large enough to warrant regulatory focus. Sectors that cross into the risk zone have a maturity score that no longer adequately reflects their criticality.

The 2026 edition, published 28 May, placed three sectors in the risk zone for the first time: railway, drinking water and waste water. ENISA's data showed that one in three water-sector entities has never carried out a risk assessment, meaning EU regulators now have a documented maturity gap they can point enforcement at under NIS2. The same edition noted that 63 per cent of all hacktivist attacks target public administrations, and approximately half of public bodies provide management with no cybersecurity training. Three sectors simultaneously reached high maturity for the first time: trust services, aviation and financial market infrastructures. NIS360 2026 is the direct sector-level companion to the NCAF 2.0 member-state maturity benchmark ENISA published in April 2026.

NIS360's significance is structural: it converts qualitative EU regulatory language into comparable sector scores that give national supervisory authorities, vendors and insurers a named basis for enforcement priorities. The water finding in the 2026 edition is particularly significant because the April 2026 CISA/NCSC advisory on Iranian-affiliated actors probing exposed water and energy programmable logic controllers had already named water as a live threat surface, giving the NIS360 risk-zone designation immediate enforcement weight.