NIS2 - Network information security Directive 2

Overview

The NIS2 Directive (Directive (EU) 2022/2555) is the European Union's core cybersecurity law for critical sectors. It replaces the original 2016 NIS Directive, widening the scope to 18 sectors, tightening risk-management and incident-reporting obligations, and strengthening supervision and enforcement across the single market. It applies to medium-sized and large organisations providing essential or important services, and to certain non-EU entities offering those services within the EU.

NIS2 entered into force on 16 January 2023, with Member States required to transpose it into national law by 17 October 2024; it has applied since 18 October 2024, when the original NIS Directive was repealed. Because it is a directive, its precise obligations and penalties take effect through each country's national implementing law, so scope and enforcement can vary by Member State. In January 2026 the Commission proposed targeted amendments to simplify compliance.

Who must comply

Medium-sized and large entities operating in the EU's 18 critical sectors
Essential entities: energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, and space
Important entities: postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research organisations
Non-EU entities that offer in-scope services within the EU

Key obligations

Cyber risk-management measures (Article 21)

High

Implement technical, operational and organisational measures covering risk analysis, incident handling, business continuity and backups, supply chain security, secure acquisition and development, cryptography, access control and multi-factor authentication.

Incident reporting (Article 23)

High

For significant incidents, submit an early warning within 24 hours, a full incident notification within 72 hours, and a final report within one month.

Management accountability (Article 20)

Critical

Management bodies must approve and oversee cybersecurity risk-management measures and undergo training; senior managers can be held personally liable for non-compliance.

Supply chain security

Medium

Assess and address cybersecurity risks across suppliers and service providers, including the security of vendor relationships and the wider supply chain.

Timeline

27 December 2022
Directive (EU) 2022/2555 published in the Official Journal of the EU
16 January 2023
NIS2 enters into force
17 October 2024
Deadline for Member States to transpose NIS2 into national law
18 October 2024
NIS2 applies; the original NIS Directive (2016/1148) is repealed
20 January 2026
European Commission proposes targeted amendments to simplify NIS2 compliance

How Anove helps

✓Control mapping — map your controls once and reuse the evidence across every overlapping framework you fall under.
✓Gap assessment — see exactly where you stand against each requirement, with a prioritised list of what to fix first.
✓Deadline tracking — track readiness against key dates and assign owners so nothing slips.
✓Continuous monitoring — get alerted the moment a tool, vendor or control drifts out of compliance.

Platform

Data

About Anove

Learn

Discover

Services

About Us

Terms

Network information security Directive 2

Overview

Who must comply

Key obligations

Cyber risk-management measures (Article 21)

Incident reporting (Article 23)

Management accountability (Article 20)

Supply chain security

Timeline

How Anove helps

From the Anove resource hub

Not sure if your tools are compliant?

Registration, supervision and enforcement

Europe Wrote the Rules. America Bought the Market.

NIST SP 800-18 Rev. 2: Supply Chain Risk Moves to the Heart of System Planning

The ECB Gives Banks Until October 31 to Close AI Security Gaps, and the Work Starts in the Supply Chain