NIS2 Directive (Directive (EU) 2022/2555)
Directive (EU) 2022/2555 (NIS2) is the EU's second-generation cybersecurity directive. It requires medium-sized and large entities across critical sectors — energy, transport, healthcare, finance, water, digital infrastructure, digital service providers, waste, critical manufacturing, postal services, public administration, and space — to implement cybersecurity risk management measures and notify national authorities of significant incidents. Member States were required to transpose NIS2 into national law by 17 October 2024.
Jurisdiction
European Union
Enforcement
October 17, 2024
Maximum penalty
For essential entities, administrative fines up to €10 million or 2% of total worldwide annual turnover (whichever is higher); for important entities, up to €7 million or 1.4% of worldwide annual turnover (Directive (EU) 2022/2555 Article 34).
Key obligations
- 01Adopt cybersecurity risk-management measures appropriate to the risks posed to network and information systems
- 02Notify the relevant competent authority or CSIRT of significant incidents without undue delay
- 03Provide an early warning within 24 hours and a detailed incident notification within 72 hours of becoming aware
- 04Address supply chain security in risk-management measures
- 05Implement vulnerability handling and disclosure policies
- 06Ensure top-management accountability for cybersecurity risk-management measure approval and oversight
- 07Provide cybersecurity training to management and staff
- 08Register with national authorities where required (essential and important entities)
- 09Cooperate with authorities across Member States for cross-border incident response and enforcement
Vendors that support NIS2
Sorted by coverage level. Full coverage shown first.
0 vendors
Compare across industries
See which vendors support NIS2 in your sector.
Last verified September 21, 2026. Informational summary only — not legal advice. Consult qualified counsel for specific obligations.