NIS2: the EU cyber-security directive and what it means for your company
The NIS2 directive sets binding cyber-security and incident-reporting duties for essential and important entities in 18 sectors — and obliges them to control the security of their suppliers. Whether you are in scope directly or serve customers who are, we bring you into compliance within one management system.
Who NIS2 applies to
The directive covers 18 sectors: energy, transport, banking, health, digital infrastructure, cloud and managed services, data centres, digital providers and more. If you operate in one of these sectors in the EU and exceed the medium-enterprise threshold, you are in scope directly. Even if you are not, Article 21(2)(d) requires NIS2 entities to manage supply-chain risk — so your customers must assess you and put requirements into the contract.
Member states have transposed NIS2 into national law with supervisory authorities and fines of up to 10 million EUR or 2 % of global turnover for essential entities.
The 10 measures of Article 21
- Risk analysis and information-system security policies
- Incident handling
- Business continuity, backups, disaster recovery, crisis management
- Supply-chain security
- Security in acquisition, development and maintenance, vulnerability handling
- Assessing the effectiveness of measures
- Cyber hygiene and training
- Cryptography and encryption
- HR security, access control, asset management
- Multi-factor authentication and secured communications
All ten map directly to ISO 27001:2022 controls and the SOC 2 criteria. If you already hold one of them, the NIS2 dossier comes together quickly.
Incident reporting
NIS2 introduces three-stage reporting: an early warning within 24 hours, an incident notification within 72 hours, a final report within one month. Your NIS2-entity customers will pass these deadlines on to you as a supplier. We build a procedure that can meet them and test it with exercises.
What you get
- NIS2 applicability and supply-chain role assessment
- Gap analysis against the 10 Art. 21 measures
- Mapping to ISO 27001 / SOC 2 (no duplication)
- 24/72-hour incident-notification procedures
- Supply-chain security and vendor-assessment programme
- Leadership training on NIS2 accountability
- Compliance dossier for customer questionnaires