Under NIS2, cyber accountability reaches the management board.

A wider net, and a named owner at the top.

NIS2 (Directive (EU) 2022/2555) replaced the original 2016 NIS Directive. It pulls far more organisations into scope, classifying them as essential or important entities, generally where they cross a size threshold. If you sit in one of the covered sectors and clear that bar, the directive applies to you.

The shift that catches people out is governance. Management bodies must approve and oversee the entity’s cyber risk-management measures, and can be held liable for failures. Senior management can face sanctions. Cyber is no longer something the board receives; it is something the board owns.

The Article 21 baseline

1. Risk analysis and information-system security policiesThe documented foundation everything else is measured against.
2. Incident handlingDetection, response and recovery, run as a repeatable process rather than an improvisation.
3. Business continuity and backupsBackup management, disaster recovery and crisis management that have been tested, not just written down.
4. Supply-chain securityThe security of relationships with direct suppliers and service providers, assessed and managed.
5. Security in acquisition, development and maintenanceIncluding vulnerability handling and disclosure across the systems you build and buy.
6. Policies to assess effectivenessWays to judge whether the risk-management measures are actually working.
7. Basic cyber hygiene and trainingThe everyday practices and awareness that stop routine incidents becoming serious ones.
8. Cryptography and, where appropriate, encryptionApplied to protect information at rest and in transit.
9. Access control, asset management and multi-factor authenticationHuman-resources security, access policies and MFA underpinning who can reach what.

The 24-hour clock starts whether or not you’re ready for it.

The reporting timeline

Within	Step	What it means
24 hours	Early warning	An initial early warning to the relevant authority within 24 hours of becoming aware of a significant incident.
72 hours	Incident notification	A fuller notification within 72 hours, updating and assessing the incident as understanding develops.
One month	Final report	A final report within one month, setting out the incident, its cause, and the measures taken.

Where firms trip

• Assuming a NIS1-era posture still passes, when the bar and the scope have both moved.
• Supply-chain blind spots: suppliers and providers that were never mapped or assessed.
• Management engaged on paper but not genuinely in the room where the risk decisions get made.
• The 24-hour, 72-hour and one-month reporting flow that has never once been rehearsed.