Does NIS-2 apply to your company?
Answer four short questions and find out straight away whether and how the NIS-2 Directive applies to your company. No contact details, free of charge.
Does NIS-2 apply to your company?
NIS-2 is EU Directive (EU) 2022/2555 on cybersecurity. It extends its predecessor NIS-1 considerably: far more sectors are covered, the requirements are more concrete, and the management body is personally liable. Whether you are in scope depends on two things — your sector and your company size. That is exactly what the check above tests.
Who is affected?
NIS-2 distinguishes two categories, which follow from sector and size. Both have to implement the same security measures — what differs is mainly the supervision: essential entities are supervised proactively, important entities only when there is cause.
| Category | Typical threshold | Supervision |
|---|---|---|
| Essential entity | Sectors of high criticality, as a rule from 250 employees or > €50 million turnover | proactive |
| Important entity | Covered sectors, as a rule from 50 employees or > €10 million turnover | when there is cause |
The sectors
The directive lists sectors of high criticality (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space, among others) and other critical sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital services and research, among others).
Important: The size thresholds are not the only door in. Regardless of size, an entity can be covered if it is the sole provider of a critical service, for instance, or if a disruption would have significant effects. And even if you do not fall under NIS-2 yourself, you will often feel the requirements through your customers, as their supplier.
Which duties will reach you?
1. Risk management measures
The directive requires an all-hazards approach with a minimum catalogue of measures — risk analysis and security policies, handling security incidents, business continuity and backup management, supply chain security, security in procurement and development, assessing effectiveness, cyber hygiene and training, cryptography, personnel security, access control and multi-factor authentication.
2. Reporting duties
For significant incidents there is a staged procedure:
- 24 hours — early warning
- 72 hours — notification with an initial assessment
- 1 month — final report
3. Responsibility of the management body
This is perhaps the most important change: the management body has to approve the risk management measures and oversee their implementation, be trained regularly — and is liable for infringements. Cybersecurity has finally stopped being a purely IT matter.
How to read your result
From your sector, headcount and turnover the check above places you in one of three situations:
- Essential entity — you are very likely fully in scope and under proactive supervision. Registration and implementation should take priority.
- Important entity — you are in scope but supervised only when there is cause. The substantive duties are the same.
- Probably not in scope — watch the supply chain requirement all the same: your customers will ask for evidence.
The check is no substitute for legal advice. It gives you a dependable first assessment and shows where to start.
The pragmatic route to implementation
Most of the NIS-2 measures coincide with what an ISMS to ISO 27001 requires anyway: risk management, supplier management, incident handling, access control, training. If you already run an ISMS, most of it is done and what you mainly have to add are the NIS-2 specifics — registration, reporting processes, and the evidence you put before your management body.
Common questions about NIS-2
From when does NIS-2 apply to my company?
The EU deadline for national transposition expired on 17 October 2024. Germany is transposing the directive through its NIS2 implementation act, which has been delayed. The duties arise when the national law comes into force — but anyone in scope should not make their own implementation depend on that, since building it up typically takes several months.
Do I have to register actively?
Yes. Entities in scope have to register with the competent national authority — in Germany, the BSI. Registration is a duty in its own right and does not replace implementing the security measures.
Do I need ISO 27001 certification for NIS-2?
No, NIS-2 does not require certification. An ISMS to ISO 27001 is the most established way of implementing and evidencing the required measures in a structured form, though — and it covers most of the requirements.
What happens in the event of an infringement?
The directive provides for substantial fines — for essential entities up to €10 million or 2 % of worldwide annual turnover, for important entities up to €7 million or 1.4 %. On top of that comes the personal responsibility of the management body.
We are a supplier and not in scope ourselves — do we still have to do anything?
In practice yes. NIS-2 obliges companies in scope to manage the security of their supply chain. They pass that on to you through questionnaires and contract clauses. Demonstrable information security becomes a competitive factor.
How long does implementation take?
Four to nine months is realistic, depending on where you start, the size of the company and what documentation exists. If you already run an ISMS you will be considerably faster.
