EU NIS2 Directive Expert

EU NIS2 Directive Expert

Reference-depth expertise for the EU NIS2 Directive — Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union. NIS2 repealed the original NIS Directive (Directive (EU) 2016/1148) and entered into force on 16 January 2023, with a transposition deadline of 17 October 2024.

This plugin bundles the SCF crosswalk (68 SCF controls → 30 NIS2 directive-level controls) with directive-specific scoping, governance, evidence, and incident-reporting context. Detailed technical and organisational measures from Article 21 are elaborated in the NIS2 implementing acts (Commission Implementing Regulation (EU) 2024/2690 for digital infrastructure / DNS / TLD / cloud / data centre / CDN / managed service / managed security / online marketplace / search engine / social networking entities — known here as "the Annex"); a parallel SCF mapping emea-eu-nis2-annex-2024 covers the 351-control breakdown of those technical measures.

Framework identity

• Instrument: Directive (EU) 2022/2555 (NIS2). A Directive, not a Regulation — Member States transpose it into national law.
• Predecessor: NIS1 (Directive (EU) 2016/1148), repealed by Article 44 of NIS2.
• Entry into force: 16 January 2023.
• Transposition deadline: 17 October 2024. As of late 2025–early 2026, transposition status varies sharply by Member State; some states (Germany's NIS2UmsuCG, Belgium's NIS2 law, Italy's Decreto Legislativo n. 138/2024) had national laws in force on or near time, several others were delayed and ran (or are still running) Commission infringement procedures.
• SCF framework ID: emea-eu-nis2-2022 (directive). Companion: emea-eu-nis2-annex-2024 (Implementing Regulation 2024/2690 technical measures).
• Region: EMEA (EU + EEA where applicable through joint committee decisions).
• Direct enforcement: No. NIS2 is enforced by each Member State's national competent authority via that state's transposition law. ENISA coordinates EU-wide and runs the CSIRTs Network and EU-CyCLONe.
• Affected sectors: 18 categories grouped into Annex I (essential) and Annex II (important) — see "Sectoral scope" below.
• Penalty exposure: Administrative fines whose national maximums must be at least €10 million or 2% of total worldwide annual turnover (essential entities) and at least €7 million or 1.4% of total worldwide annual turnover (important entities), whichever is higher, per Article 34. Member States may set higher national maximums.

Framework in plain language

NIS2 is the EU's baseline cybersecurity law for organisations that run critical or important services. It does four things at once:

1. Expands NIS1's scope from a small list of "operators of essential services" and "digital service providers" to roughly 18 sectors covering most medium and large organisations in critical supply chains (energy, transport, healthcare, drinking water, wastewater, banking, financial market infrastructure, digital infrastructure, ICT service management, postal services, manufacturing of medical devices and machinery, digital providers, food, chemicals, waste, public administration, research, space).
2. Imposes a harmonised baseline of cybersecurity risk-management measures on in-scope entities (the ten Article 21 domains).
3. Imposes a harmonised incident-reporting regime with a 24-hour early warning, a 72-hour incident notification, and a 1-month final report (Article 23).
4. Introduces management-body accountability (Article 20): the management body of an in-scope entity must approve cybersecurity risk-management measures, oversee their implementation, and undergo regular cybersecurity training. National laws may attach personal liability to management-body members for serious failures.

NIS2 is jurisdictionally uneven. Because it is a Directive, the substantive rules a regulator can enforce against you are in your Member State's transposition law, not in NIS2 itself. The directive defines a floor; many Member States layer additional national requirements on top (mandatory CISO appointments, registration deadlines, sectoral rules, sector-specific reporting portals). This plugin focuses on the directive-level baseline that all Member State laws must implement; national specifics are downstream.

Sectoral scope and entity classification

NIS2 applies a size-based threshold combined with a sector list, with carve-outs that pull smaller organisations in.

Step 1: Sector check (Annex I or Annex II?)

Annex I — high-criticality sectors (default classification: essential):

• Energy — electricity, district heating and cooling, oil, gas, hydrogen
• Transport — air, rail, water, road
• Banking — credit institutions