Best for: All entities which qualify as medium-sized enterprises, or exceed the ceilings for medium-sized enterprises, and which operate within the sectors and provide the types of service or carry out the activities covered by the Directive fall within its scope. Member States must also bring in certain small enterprises and microenterprises with a key role for society, the economy or particular sectors.
Mandatory?
Mandatory for essential/important entities in 18 EU sectors
Who validates?
National competent authority (EU member state). No self-assessment.
Renewal
Ongoing; no fixed audit cycle
Scope
Essential and important entities in energy, transport, health, digital infrastructure, etc.
Governing body
European Parliament and Council of the European Union, NIS2 Directive (EU 2022/2555, Oct 2024). Official source
Controls by category
59 controls are Mapped to NIS2 Directive (EU 2022/2555).
1.1.1.a set out the relevant entities approach to managing the security of their network and information systems;
1.1.2 The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.
1.2.1 As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities...
1.2.4 Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.
11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network...
11.2.2.d ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;
11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.
11.3.2.a establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;
11.3.2.b set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;
11.5.4 The relevant entities shall regularly review the identities for network and information systems and their users and, if no longer needed, deactivate them without delay.
11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.
12.1.2.c align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.
2.1.2.e analyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and risk level, taking into account cyber threat intelligence and vulnerabilities;
2.2.1 The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the...
2.3.1 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.
3.1.2.d documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.
3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.
3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.
3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically....
3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.
3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.
4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.
4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons...
5.1.4.f an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;
5.1.7.d analyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers and, where appropriate, take mitigating measures in a timely manner.
6.1.2.b requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;
6.2.1 Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of...
6.2.2.b apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
6.4.1 The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management.
6.7.2.i establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from...
6.7.2.l apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.
6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response...
9.2.a in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit;
9.2.c.xii setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.
It is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022. The Directive was published in the Official Journal of the European Union on 27.12.2022. It repeals Directive (EU) 2016/1148.
How does NIS 2 decide which entities fall within its scope?
It uses a uniform size-cap rule.
Why was the original NIS Directive replaced?
The review of Directive (EU) 2016/1148 found inherent shortcomings. It also found wide divergences in how Member States implemented scope. NIS 2 aims to remove those divergences.
Are public administration entities covered by NIS 2?
Public administration entities whose activities are predominantly in national security, public security, defence or law enforcement are excluded. Public administration entities whose activities are only marginally related to those areas are not excluded.
