NIS2 Directive: Scope, Security Measures and Reporting for IT Providers

The NIS2 Directive is the EU's main cybersecurity law for organisations that society depends on, and it reaches deep into the IT sector. Managed service providers, managed security service providers, cloud and data centre operators, DNS and content delivery providers, online marketplaces, search engines and social networks are all named sectors. Medium and large companies in those sectors must take specific security measures, report significant incidents within 24 hours, and have their management bodies approve and oversee cybersecurity, with personal accountability.

NIS2 also travels down supply chains. Entities in scope must address security in their relationships with suppliers, so software vendors and IT service companies outside the EU, including in India, receive NIS2-driven security clauses and questionnaires even if they are not in scope themselves. This guide explains the scope tests, essential and important entities, the ten Article 21 measures, reporting timelines, governance duties, penalties, the status of national laws, and what IT suppliers should prepare.

What is NIS2?

NIS2 is Directive (EU) 2022/2555. As a directive, it does not apply directly to companies; each member state must transpose it into national law, and companies comply with that national law. NIS2 sets minimum rules and allows member states to go further, so details such as the competent authority, registration process and some thresholds differ by country.

The directive covers:

• Scope: which entities are covered, and the distinction between essential and important entities.
• Governance: duties of management bodies (Article 20).
• Cybersecurity risk-management measures (Article 21).
• Reporting obligations (Article 23).
• Registration of certain entities (Articles 3 and 27).
• Supervision and enforcement, including fines and management liability (Articles 31 to 37).
• National strategies, CSIRTs, crisis management and EU cooperation.

For digital infrastructure and ICT service providers, Commission Implementing Regulation (EU) 2024/2690 sets detailed technical and methodological requirements for the Article 21 measures and defines when an incident is significant.

History and why NIS2 was introduced

The first NIS Directive (Directive (EU) 2016/1148) was the EU's first cybersecurity law. Member states identified "operators of essential services" very differently, enforcement was uneven, and important sectors were left out. Meanwhile ransomware, supply chain attacks such as the compromise of widely used IT management software, and the pandemic-driven shift to digital services showed how interconnected and exposed organisations had become.

NIS2 was adopted in December 2022, entered into force on 16 January 2023, and had to be transposed by 17 October 2024, with national measures applying from 18 October 2024. Most member states missed the deadline; the Commission opened infringement procedures against 23 member states in November 2024 and issued reasoned opinions in 2025. A majority had transposed by early 2026, and others followed during 2026. Check the national law in each country where you operate or serve customers.

Who is in scope?

Sectors

Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure (internet exchange points, DNS service providers, top-level domain registries, cloud computing service providers, data centre service providers, content delivery networks, trust service providers, public electronic communications networks and services), ICT service management (business-to-business), meaning managed service providers and managed security service providers, public administration and space.

Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including computers, electronics and machinery), digital providers (online marketplaces, online search engines, social networking platforms) and research organisations.

Size

The general rule is a size cap: entities that are at least medium-sized under the EU SME definition (50 or more employees, or annual turnover and balance sheet above 10 million euros) in a listed sector are in scope. Some entities are in scope regardless of size, including trust service providers, top-level domain registries, DNS service providers and providers of public electronic communications networks or services, and entities that member states identify as critical.

Essential and important entities

Large entities in Annex I sectors are generally essential entities; most other entities in scope are important entities. Both must meet the same security and reporting duties. The difference is supervision: essential entities are subject to proactive supervision (inspections and audits), while important entities face reactive supervision, typically after evidence of non-compliance. Maximum fines also differ.

Where you are regulated

Entities are generally under the jurisdiction of the member state where they are established. For DNS providers, TLD registries, domain registration services, cloud, data centre and content delivery providers, managed service and managed security service providers, and online marketplaces, search engines and social networks, jurisdiction is the member state of their main establishment in the EU (Article 26). Such providers that are not established in the EU but offer services there must designate a representative in a member state where they offer services.

Governance: management bodies are accountable (Article 20)

Member states must ensure that management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. Members of management bodies must follow training, and entities are encouraged to offer similar training to employees regularly. For essential entities, authorities can, in serious cases, temporarily prohibit a person from exercising managerial functions (Article 32). This is a major shift: cybersecurity is a board responsibility, not just an IT task.

The ten cybersecurity risk-management measures (Article 21)

Entities must take appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. At a minimum they must include:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security, including security-related aspects of relationships with direct suppliers or service providers.
5. Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies and procedures on the use of cryptography and, where appropriate, encryption.
9. Human resources security, access control policies and asset management.
10. The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems, where appropriate.

Measures must be proportionate to the entity's exposure, size, the likelihood and severity of incidents, and their societal and economic impact. When assessing supply chain security, entities must take into account the vulnerabilities of each supplier, the overall quality of suppliers' products and cybersecurity practices, including secure development procedures. For digital infrastructure and ICT service providers, Implementing Regulation (EU) 2024/2690 spells these measures out in detail in its annex.

Incident reporting (Article 23)

Entities must notify their CSIRT or competent authority of any significant incident, meaning one that has caused or can cause severe operational disruption or financial loss, or has affected or can affect others by causing considerable damage. The stages are:

Stage	Deadline	Content
Early warning	Without undue delay and within 24 hours of becoming aware	Whether the incident is suspected to be caused by unlawful or malicious acts or could have cross-border impact
Incident notification	Without undue delay and within 72 hours of becoming aware (24 hours for trust service providers)	Update of the early warning, initial assessment of severity and impact, indicators of compromise where available
Intermediate report	On request	Relevant status updates
Final report	Within one month of the incident notification	Detailed description, type of threat or root cause, mitigation measures, cross-border impact

Where appropriate, entities must also inform recipients of their services of significant incidents likely to affect them and of measures they can take. Personal data breaches may separately need notification under the GDPR within 72 hours. The Commission's Digital Omnibus proposals include simplifying incident reporting through a single entry point; check whether they have been adopted.

How to comply, step by step

1. Determine applicability in each member state: sector, size, special cases and main establishment.
2. Register with the competent authority where national law requires it.
3. Brief and train the management body, and have it approve the cybersecurity risk-management measures.
4. Run a gap assessment against Article 21 and, if you are a digital infrastructure or ICT service provider, against Implementing Regulation 2024/2690.
5. Close gaps: MFA, access control, asset inventory, vulnerability handling and disclosure, secure development, encryption, backups and disaster recovery, logging and detection.
6. Manage suppliers: inventory, risk assessment, contractual security requirements, and monitoring.
7. Build the reporting process for 24-hour, 72-hour and one-month deadlines, aligned with GDPR and sector reporting.
8. Measure effectiveness: audits, tests, metrics and management reporting.
9. Use a recognised framework, such as ISO/IEC 27001, to organise and evidence the measures.

Documentation required

• Applicability assessment and registration records.
• Management body approvals, oversight records and training records.
• Risk analysis and information system security policies.
• Incident handling procedures and incident reports.
• Business continuity, backup, disaster recovery and crisis management plans with tests.
• Supply chain security policy, supplier inventory and assessments.
• Secure development and vulnerability handling and disclosure policies.
• Cryptography, access control, HR security and asset management policies.
• Effectiveness assessment results (audits, tests, metrics).

Supervision, audits and certification

NIS2 has no certification of its own. Competent authorities supervise compliance: for essential entities through on-site inspections, off-site supervision, regular and targeted security audits, scans and information requests; for important entities mainly after evidence of non-compliance. Member states may require entities to use particular ICT products, services and processes certified under EU cybersecurity certification schemes. Certifications such as ISO/IEC 27001 are commonly used as evidence but do not replace national requirements.

Timeline and cost considerations

NIS2 applies now in member states that have transposed it, and national laws continue to come into force. Some national laws give grace periods for registration or initial audits. Cost drivers include gap assessments, security tooling (MFA, logging and detection, vulnerability management, backup), supplier risk management, incident response capability, management training, audits required by authorities, and staff time. Organisations already certified to ISO/IEC 27001 usually have a head start, with gaps commonly in supply chain security, management accountability and reporting timelines.

Benefits and consequences of non-compliance

Compliance reduces the likelihood and impact of serious incidents, satisfies customers who are themselves in scope, and protects management from personal liability.

Under Article 34, member states must provide for administrative fines of at least up to 10 million euros or 2 percent of total worldwide annual turnover, whichever is higher, for essential entities, and at least up to 7 million euros or 1.4 percent for important entities. Authorities can also issue binding instructions, order audits, require public disclosure of non-compliance, and, for essential entities, suspend certifications or authorisations and temporarily ban managers from managerial functions.

What NIS2 means for IT suppliers outside scope

Even if your company is too small or outside the listed sectors, NIS2 affects you if your customers are in scope. Expect:

• Security questionnaires and audits aligned with Article 21.
• Contract clauses on vulnerability handling, secure development, incident notification to the customer within hours, access to logs, and right to audit.
• Requests for evidence such as ISO/IEC 27001 certification, SOC 2 reports, penetration test results and SBOMs.
• Requirements for MFA and secured access when your staff connect to customer systems.

Preparing these answers once, with evidence, shortens every EU sales cycle.

Common mistakes and challenges for IT companies

• Assuming non-EU companies are unaffected. Digital providers offering services in the EU may need a representative; suppliers face contractual flow-down.
• Waiting for every national law. The core measures are the same everywhere; start with Article 21.
• Treating it as an IT project only. Management body approval, oversight and training are legal requirements.
• No 24-hour process. Early warnings require fast triage and decision-making authority.
• Ignoring supply chain security, one of the most emphasised measures.
• Not checking managed service status. Many IT service companies are managed service providers under NIS2 definitions.

Best practices, tools and technologies

• Map Article 21 measures to ISO/IEC 27001 Annex A controls and ENISA guidance.
• Deploy MFA everywhere, privileged access management and central logging.
• Publish a vulnerability disclosure policy and run a coordinated disclosure process.
• Maintain SBOMs and dependency scanning for software you supply.
• Test backups and disaster recovery; rehearse major incidents with management.
• Keep a supplier register with risk ratings and contractual security terms.

We help EU-facing clients with the application side: MFA, audit logging, secure development and maintained, patched systems under our support plans.

How NIS2 relates to other frameworks

Framework	Relationship
DORA	Sector-specific EU regulation for financial entities; where DORA applies, it takes precedence as lex specialis.
Cyber Resilience Act	Security requirements for products with digital elements; complements NIS2's focus on entities.
GDPR	Personal data breach notification and security duties apply in parallel.
ISO/IEC 27001	Widely used to implement and evidence Article 21 measures.
NIST CSF	Alternative framework for structuring measures; CIS publishes NIS2 mappings for its Controls.
ISO 22301	Supports the business continuity and crisis management measure.

Real-world implementation examples

National authorities have launched registration portals and published guidance; Germany, Belgium, Italy and others have set up registration for entities under their NIS2 laws, and ENISA publishes technical implementation guidance for the measures in Implementing Regulation 2024/2690. The Commission's infringement procedures against late member states show how seriously transposition is being pursued.

An illustrative case for an Indian IT services firm providing managed services to a German manufacturer: the client is an important entity under NIS2. The firm receives a new contract annex requiring notification of incidents affecting the client within a few hours, MFA for all remote access, a vulnerability disclosure contact, annual penetration tests and evidence of ISO/IEC 27001 certification. Because the firm also has EU customers for managed services and more than 50 employees, it checks whether it is itself a managed service provider in scope, and, finding that it offers services in the EU without an establishment there, takes advice on designating a representative.

Next steps

1. Check whether you are in scope in each member state where you operate or serve customers.
2. Brief your management body and assign accountability.
3. Assess against Article 21 and, if relevant, Implementing Regulation 2024/2690.
4. Build the 24-hour, 72-hour and one-month reporting process.
5. Prepare a supplier-facing evidence pack for NIS2 customer requests.

Frequently asked questions

When did NIS2 start to apply?

Member states had to apply their national NIS2 laws from 18 October 2024. Many were late, and national laws have been coming into force since then.

Does NIS2 apply to managed service providers?

Yes. Managed service providers and managed security service providers are listed in Annex I under ICT service management, subject to the size rules.

Does NIS2 apply to companies outside the EU?

Certain digital providers not established in the EU but offering services there must designate a representative and are covered. Other non-EU companies are affected through contracts with in-scope customers.

What is the difference between essential and important entities?

Both have the same security and reporting duties. Essential entities face proactive supervision and higher maximum fines; important entities face mainly reactive supervision.

How fast must incidents be reported under NIS2?

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.

What are the NIS2 fines?

At least up to 10 million euros or 2 percent of worldwide turnover for essential entities, and at least up to 7 million euros or 1.4 percent for important entities, whichever is higher in each case.

Are managers personally liable under NIS2?

Management bodies must approve and oversee cybersecurity measures and can be held liable. For essential entities, authorities can temporarily ban individuals from managerial functions in serious cases.

Is ISO 27001 enough for NIS2?

It is a strong foundation and good evidence, but NIS2 adds legal duties such as management accountability, specific reporting deadlines and registration, and national laws may add requirements.

Are small companies exempt from NIS2?

Generally, micro and small enterprises are outside scope, except for listed entities covered regardless of size, such as DNS providers and trust service providers, or entities designated by member states.

What is Implementing Regulation 2024/2690?

A Commission regulation setting detailed technical and methodological requirements for the security measures, and significant incident criteria, for digital infrastructure and ICT service providers such as cloud, data centre and managed service providers.

How does NIS2 relate to DORA?

DORA is the specific law for EU financial entities' ICT risk. Where DORA applies, its requirements take precedence over the corresponding NIS2 provisions.

Does NIS2 require supply chain security?

Yes. Article 21 requires measures on supply chain security, considering suppliers' vulnerabilities, product quality and secure development practices.