NIS2 compliance: what it requires and who can help

Who NIS2 applies to

NIS2 covers medium and large organisations in the sectors listed in its annexes. Annex I lists sectors of high criticality, including energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, managed ICT services (B2B), public administration and space. Annex II adds other critical sectors such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

Some entities are in scope regardless of size, including providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers. Member states can also bring in smaller entities that are critical nationally, for example the sole provider of an essential service in the country.

In-scope organisations are classed as essential or important entities. Essential entities face proactive supervision, such as audits and on-site inspections; important entities are supervised mainly after the fact.

What NIS2 requires

Article 21 asks for "appropriate and proportionate" technical, operational and organisational measures based on an all-hazards approach. At a minimum, these cover:

• Risk analysis and information system security policies
• Incident handling
• Business continuity, including backup management, disaster recovery and crisis management
• Supply chain security, including your relationships with direct suppliers
• Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
• Policies and procedures to assess whether these measures work
• Basic cyber hygiene and cybersecurity training
• Cryptography and, where appropriate, encryption
• Human resources security, access control and asset management
• Multi-factor or continuous authentication and secured communications where appropriate

Extra detail for digital providers

For digital providers such as cloud, data centre, managed service and managed security service providers, DNS providers and online marketplaces, Commission Implementing Regulation (EU) 2024/2690 spells out the Article 21 measures in detail and sets when an incident counts as significant.

Management is accountable

Under Article 20, management bodies must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for failures. Members of management bodies must also follow training. For many mid-sized companies this is the first time the board has a direct, personal stake in security, and many of them have no CISO to brief it. That is one reason companies bring in a vCISO.

Incident reporting deadlines

Article 23 sets a staged process for significant incidents: an early warning to the national CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the incident notification.

Fines

Member states must be able to fine essential entities up to at least €10 million or 2% of total worldwide annual turnover, whichever is higher, and important entities up to at least €7 million or 1.4%.

Where NIS2 stands in 2026

Not every member state wrote NIS2 into national law on time. In May 2025 the European Commission sent reasoned opinions to 19 member states that had not fully transposed it, so check the status of the law in your country before you plan.

On 20 January 2026 the Commission proposed targeted amendments to NIS2, alongside a revised Cybersecurity Act. It says the changes would ease compliance for 28,700 companies, including 6,200 micro and small enterprises. They are a proposal: until the European Parliament and the Council adopt them, the current rules apply.

What good NIS2 help looks like

Most organisations need three things: someone to own the programme (a CISO, or a vCISO for smaller teams), a readiness assessment against Article 21 and the national law, and specialists for specific gaps such as incident response planning, supplier risk or penetration testing.

When you compare providers, ask for experience in your sector and country, a named lead rather than a pool, and a clear list of deliverables: gap assessment, risk register, policies, incident reporting procedure and board briefing.

How CISO Talents helps

At launch you can post a NIS2 readiness request through a guided brief: sector, country, size, current state and timeline. Verified vCISOs and consultants who list NIS2 work see it with a note on why it matched them, and reply in the same format, so price, deliverables and timeline are easy to compare.