NIS2 moves cybersecurity from a technical question to a duty of the management body.<\/p>\n
It requires documented risk management, measures to secure the supply chain, defined reporting paths with short deadlines, and trained management bodies. National transposition determines the detail.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29161","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"EU directive on cybersecurity for companies in critical sectors.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"NIS2 is an EU directive that sets binding requirements for risk management, reporting and management accountability at entities in critical and important sectors. It widens the circle of affected organisations considerably compared with its predecessor.","at_a_glance":[{"bullet":"
NIS2 covers considerably more organisations<\/b> than the old NIS directive.<\/p>\n"},{"bullet":"
Management is accountable \u2013 cybersecurity is no longer an IT-only task.<\/p>\n"},{"bullet":"
Reporting deadlines are short: a first report within 24 hours.<\/p>\n"}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"A supplier in scope must demonstrate the security of its own suppliers."},{"example":"A reportable incident requires an initial report within 24 hours and a full report within a month."}],"misconception":[{"myth":"\u201cNIS2 only affects operators of critical infrastructure.\u201d","reality":"The scope also covers many mid-sized companies in important sectors \u2013 and through the supply chain it reaches further still."}],"faq":[{"q":"When does NIS2 apply?","a":"The directive had to be transposed into national law; the applicable national act governs. The text is on EUR-Lex<\/a>."},{"q":"How does it differ from ISO 27001?","a":"ISO 27001 is a voluntary standard for a management system; NIS2 is a legal obligation. An existing ISO 27001<\/a> system makes compliance easier but does not replace it."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"NIS2 Directive (EUR-Lex)","url":"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj","doc_type":"","group":"used"},{"publisher":"","name":"ENISA","url":"https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2024","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t