Classify your entity, track Article 21 cybersecurity risk-management measures, and meet NIS2's 24-hour, 72-hour and one-month incident-reporting deadlines — in one workspace.
Who must comply
Medium & large entities in Annex I/II sectors (50+ staff or €10M+ turnover)
In force since
Applies from 18 October 2024 (Art. 41(1))
Maximum fines
Maximum of at least €10M or 2% of turnover (essential), €7M or 1.4% (important)
Scope follows Article 2 read with Annexes I and II. Some entities — such as DNS and TLD name registries and qualified trust service providers — are covered regardless of size. This is guidance, not legal advice; confirm your status with counsel.
NIS2 raises the bar on cyber risk management and incident reporting for in-scope organisations across the EU. The core duties:
Put in place appropriate technical, operational and organisational measures, proportionate to the risks you face. These include risk analysis, incident handling, business continuity, encryption, access control and more.
Notify your CSIRT or competent authority of a significant incident on a strict clock. Send an early warning within 24 hours, a full notification within 72 hours, and a final report within one month.
Management bodies must approve the risk-management measures, oversee their implementation and follow training — and can be held liable for non-compliance.
Assess and address cybersecurity risks across your supply chain and supplier relationships, including the security practices of your direct ICT providers.
Turn the directive into a tracked, evidence-backed programme — without spreadsheets.
Track each baseline risk-management measure against your current posture, with evidence and clear gap visibility.
Log significant incidents and get the 24h / 72h / one-month clocks computed automatically, with pre-filled authority notifications routed to your CSIRT contact.
Set your entity tier so the right reminders, notification routing and obligations apply to your organisation.
Reuse NIS2 controls across GDPR, DORA and the EU AI Act through the framework-mapping engine — evidence once, satisfy many.
NIS2 applies to medium and large entities (broadly, 50+ employees or more than €10M turnover). They are in scope when they operate in the high-criticality sectors of Annex I or the other critical sectors of Annex II. Some entity types — such as DNS service providers, TLD name registries and qualified trust service providers — are in scope regardless of size.
Member States were required to transpose Directive (EU) 2022/2555 into national law by 17 October 2024, replacing the original NIS Directive. Obligations apply through each country's implementing legislation.
Essential entities are mainly large companies in the Annex I sectors, above the EU ceilings for medium-sized enterprises. Some are essential whatever their size: qualified trust service providers, top-level domain name registries and DNS service providers. Medium-sized public telecom providers, central-government bodies and critical entities are essential too. So is any entity that its country identifies as essential. Every other entity in scope, in Annex I or Annex II, is important. A medium-sized company in an Annex I sector is therefore usually important, not essential. Essential entities face proactive supervision; important entities are supervised reactively. Both must meet the risk-management and reporting obligations, and the maximum fines differ.
For a significant incident, report to the national CSIRT or competent authority on three deadlines. Send an early warning within 24 hours, a full notification within 72 hours, and a final report within one month.
Each country sets the highest fine. For essential entities it must be at least €10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities: at least €7 million or 1.4%. Management bodies can also be held personally accountable.
Take the free self-assessment to estimate your NIS2 scope and obligations in a few minutes — no account required.