NIS2 Is in Force. Most Organizations Still Do Not Know If They Are In Scope.

NIS2 is in force. The EU's revised Network and Information Security Directive became applicable in member states as of October 17, 2024. One year in, the picture is predictable: member state implementation is uneven, affected organizations are at various stages of figuring out what is required of them, and many companies have not determined with confidence whether they are in scope at all.

That last point is worth addressing directly, because scope confusion is doing real work here. NIS2 expanded coverage dramatically compared to its predecessor, and the expansion is not obvious from the directive's name.

What NIS2 Actually Covers

NIS1 covered seven sectors: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure. NIS2 covers eighteen, adding postal services, waste management, manufacturing of critical products (pharmaceuticals, medical devices, certain chemicals), food production, digital providers, and space.

The directive divides entities into two tiers: essential entities and important entities. The classification affects the supervisory approach and penalty ceilings but not the substantive requirements, which are largely the same for both.

Size thresholds govern whether an organization is in scope. Medium and large enterprises (generally 50 or more employees and over 10 million EUR in annual revenue) in covered sectors are automatically subject to NIS2. Some entities are in scope regardless of size: providers of electronic communications networks, TLD registries, DNS service providers, and entities a member state has designated as critical.

The practical implication: if you are a mid-sized manufacturing company, a cloud provider serving EU customers, a managed security services provider, or a pharmaceutical company, NIS2 probably applies to you whether or not you have had that conversation internally.

The Requirements in Practice

NIS2 requires covered entities to implement risk management measures appropriate to their risk profile. The directive specifies minimum areas: policies on security risk analysis and information system security, incident handling, business continuity and crisis management, supply chain security, secure acquisition and development of network systems, staff security training, and basic cyber hygiene.

These requirements are not novel concepts. Most are things a mature security program does already. The compliance challenge is documentation, evidence, and the incident reporting requirements, which are more demanding than most organizations have built.

The Reporting Timeline Is Not What You Expect

NIS2 imposes a three-stage incident reporting structure. A significant incident requires an early warning to the relevant national authority within 24 hours of the entity becoming aware of it. An incident notification follows within 72 hours with more detail on the nature, severity, and impact. A final report is due within one month.

The 24-hour early warning is where most organizations discover their playbooks do not fit. Most incident response programs are built around a contain-first, notify-when-ready posture. Under NIS2, notification to regulators starts within a day of awareness - which means you are reporting before you understand the full scope, before you have confirmed whether the incident is actually significant under the directive's definitions, and while your team is simultaneously trying to contain the situation.

The definition of "significant incident" matters here. NIS2 specifies criteria including the number of affected users, duration of service disruption, geographic scope, and extent of financial loss. Organizations that have not built specific NIS2 classification criteria into their incident response procedures will be improvising during an active incident, which is when improvisation is most expensive.

Supply Chain Security Is Explicit

NIS2 explicitly requires covered entities to address security in their supply chains. This is not a soft recommendation. Member state authorities can require entities to demonstrate that their supplier risk management practices meet minimum standards, and significant incidents at critical third parties may need to be reported.

The supply chain requirement catches organizations that have treated NIS2 as a purely internal security compliance exercise. If you have vendors with access to your systems or data, or if your products integrate third-party components, the directive has requirements for how you manage that. The vendor security questionnaire sitting unanswered in a shared folder does not satisfy them.

Management Liability

NIS2 introduced personal liability for management of covered entities. Senior management can be held liable for infringements if the entity fails to implement adequate cybersecurity measures. For essential entities, penalties can reach 10 million EUR or 2 percent of global annual turnover. For important entities, the ceiling is 7 million EUR or 1.4 percent of global turnover.

The personal liability provision is what tends to get board attention in ways that previous cybersecurity regulation did not. When executive exposure is a clause in the directive rather than a theoretical downstream consequence of a breach, the governance conversation changes. Security budget requests that were previously deferred become more interesting.

Where Most Organizations Are

The pattern emerging from the first year of NIS2 enforcement is familiar. Organizations with mature security programs are largely compliant because the requirements are reasonable and align with good practice. Organizations running minimal security programs are discovering that the gap to compliance is significant.

The most common gaps are procedural rather than technical. Organizations have the security tooling but lack the documented policies, incident classification criteria, and reporting processes that would satisfy a regulatory examination. The technical foundation is often present. The governance layer is not.

The other gap showing up in early examinations is scope misclassification. Companies that concluded they were not in scope based on a quick read of the directive - without accounting for how member states have implemented it, without considering their subsidiary structures, without checking whether their services fall under a category that bypasses the size thresholds - are revisiting that analysis under less comfortable circumstances.

If your organization operates in EU member states and has not done a formal NIS2 gap assessment, doing one before your national authority initiates contact is substantially cheaper than doing one after.