NIS2 Directive

The NIS2 Directive, formally Directive (EU) 2022/2555, is the European Union’s main cybersecurity law for organizations that run important services. It requires medium-sized and large companies and public bodies in the 18 sectors listed in its two annexes (11 in Annex I and 7 in Annex II) to manage their cybersecurity risks, report serious incidents within fixed deadlines and make their top management answerable for the risk-management measures. NIS stands for network and information systems. The directive replaced the first NIS Directive of 2016 with effect from 18 October 2024 (Article 44). Because it is a directive and not a regulation, each EU country turns it into its own national law, so the exact rules a company follows are in that national text.

Who does NIS2 apply to?

It applies to organizations in the listed sectors that are at least medium-sized, plus some of any size. Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business IT service management, public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Manufacturing covers, among others, makers of medical devices, electronics, electrical equipment, machinery and vehicles.

The size threshold uses the EU definition of small and medium-sized enterprises in Commission Recommendation 2003/361/EC, where a small enterprise has fewer than 50 staff and an annual turnover and/or balance sheet total of no more than €10 million. Small and micro enterprises are therefore normally outside NIS2 (Article 2(1)). Some are covered whatever their size, such as telecom network providers, trust service providers, domain name system (DNS) service providers and the sole provider of an essential service in a country (Article 2(2)).

Article 3 sorts the organizations in scope into two groups:

• Essential entities are mainly the large organizations in Annex I sectors, meaning those above the ceilings for medium-sized enterprises (in short, 250 or more staff, or both turnover above €50 million and balance sheet above €43 million), plus named categories such as qualified trust service providers, DNS service providers and central government bodies.
• Important entities are all the other organizations in scope.

Both groups have the same core duties. The difference is in supervision and fines: essential entities can face on-site inspections and random checks (Article 32), while important entities are mainly checked when there is evidence that they may not comply (Article 33).

What does NIS2 require?

Risk-management measures (Article 21). Organizations must take appropriate and proportionate technical, operational and organizational measures, based on an “all-hazards” approach that also protects the physical environment of their systems. The minimum list includes risk analysis and security policies, incident handling, business continuity and backups, supply chain security, vulnerability handling, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.

Incident reporting (Article 23). A significant incident, one that causes or can cause severe disruption, financial loss or considerable damage to others, must be reported to the national computer security incident response team (CSIRT) or the competent authority in stages:

• an early warning within 24 hours of becoming aware of it;
• an incident notification within 72 hours, with a first assessment of its severity and impact;
• a final report no later than one month after the incident notification.

Management responsibility (Article 20). The management body must approve the risk-management measures, oversee how they are put into practice and can be held liable when the organization breaks those rules. Its members must also follow cybersecurity training.

What are the fines under NIS2?

Article 34 sets how high national maximum fines must at least go for breaches of the risk-management or reporting rules. For essential entities, the maximum fine must be at least €10 million or 2% of total worldwide annual turnover in the previous financial year, whichever is higher. For important entities, it must be at least €7 million or 1.4% of worldwide annual turnover, whichever is higher. Countries may set higher limits, so the actual figures are in each national law.

How has NIS2 been transposed, for example in Italy?

EU countries had to adopt their national laws by 17 October 2024 and apply them from 18 October 2024 (Article 41). The details, such as which authority supervises and how organizations register, differ from country to country.

Italy transposed NIS2 with Legislative Decree no. 138 of 4 September 2024, published in the Gazzetta Ufficiale (general series no. 230) on 1 October 2024 and in force since 16 October 2024. The National Cybersecurity Agency (ACN) is the competent authority and single point of contact; organizations in scope register on its platform in a window that runs from 1 January to 28 February each year.

The directive may still change: in January 2026 the European Commission proposed targeted amendments to NIS2 to simplify it and align it with a revised Cybersecurity Act. At the end of October 2026 the European Parliament’s procedure file showed the proposal still awaiting a committee decision, so the 2022 text described here remains the one in force.

What is the difference between NIS2 and the Cyber Resilience Act?

NIS2 regulates organizations and the services they run; the Cyber Resilience Act regulates the products they buy. A water utility falls under NIS2 for how it protects its plants and networks; the maker of the smart meters or controllers it installs falls under the CRA for how those products are designed, updated and supported. Both laws use 24-hour and 72-hour reporting steps, but NIS2 is about significant incidents affecting a service, while Article 14 of the CRA, Regulation (EU) 2024/2847, is about actively exploited vulnerabilities and severe incidents affecting the security of a product.

Why does NIS2 matter for IoT?

Many organizations in scope run fleets of connected devices, such as sensors in a water network or controllers in a factory, and those devices, often operational technology, are part of the systems NIS2 asks them to protect. The supply chain duty (Article 21(2)(d) and 21(3)) asks organizations to weigh the quality of their suppliers’ products and their secure development practices, so device makers selling to energy, health, water or manufacturing customers can expect security questions in tenders and contracts even when they are not in scope themselves. Some IoT companies are in scope directly when they are at least medium-sized, for example cloud, data center and managed service providers, or makers of electronics, electrical equipment or machinery. IoT security regulation compares the EU rules with those of the UK and the United States.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.