What it asks for. NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. It widens the scope of the original NIS Directive to many more sectors, classifies organisations as essential or important entities, and sets duties for risk management, incident reporting, management accountability and supervision. Member States had to transpose it by October 2024.
In practice. Organisations should first confirm whether and where they are in scope under national transposition laws, register with the competent authority where required, and map Article 21 measures to their control framework. Management must approve and oversee measures, and incident reporting processes must meet Article 23 timelines. Evidence includes scope analysis, risk management documentation, board approvals and reporting procedures.
Common gaps. Many organisations misjudge their scope, particularly groups operating across several Member States with differing national laws. Management body training and accountability are often treated as formalities.