REGULATION — NIS2

Under NIS2, cyber accountability reaches the management board.

NIS2 widens the EU cyber baseline to essential and important entities across energy, transport, water, health, digital infrastructure, public administration, manufacturing and more — and member states were required to transpose it into national law by 17 October 2024.

WHAT IT DEMANDS

A wider net, and a named owner at the top.

NIS2 — Directive (EU) 2022/2555 — replaced the original 2016 NIS Directive. It pulls far more organisations into scope, classifying them as essential or important entities, generally where they cross a size threshold. If you sit in one of the covered sectors and clear that bar, the directive applies to you.

The shift that catches people out is governance. Management bodies must approve and oversee the entity's cyber risk-management measures, and can be held liable for failures. Senior management can face sanctions. Cyber is no longer something the board receives — it is something the board owns.

THE ARTICLE 21 BASELINE

Risk analysis and information-system security policiesThe documented foundation everything else is measured against.
Incident handlingDetection, response and recovery, run as a repeatable process rather than an improvisation.
Business continuity and backupsBackup management, disaster recovery and crisis management that have been tested, not just written down.
Supply-chain securityThe security of relationships with direct suppliers and service providers, assessed and managed.
Security in acquisition, development and maintenanceIncluding vulnerability handling and disclosure across the systems you build and buy.
Policies to assess effectivenessWays to judge whether the risk-management measures are actually working.
Basic cyber hygiene and trainingThe everyday practices and awareness that stop routine incidents becoming serious ones.
Cryptography and, where appropriate, encryptionApplied to protect information at rest and in transit.
Access control, asset management and multi-factor authenticationHuman-resources security, access policies and MFA underpinning who can reach what.

The 24-hour clock starts whether or not you're ready for it.

THE REPORTING TIMELINE

24h

Early warning

An initial early warning to the relevant authority within 24 hours of becoming aware of a significant incident.

72h

Incident notification

A fuller notification within 72 hours, updating and assessing the incident as understanding develops.

1mo

Final report

A final report within one month, setting out the incident, its cause, and the measures taken.

WHERE FIRMS TRIP

Assuming a NIS1-era posture still passes, when the bar and the scope have both moved.
Supply-chain blind spots — suppliers and providers that were never mapped or assessed.
Management engaged on paper but not genuinely in the room where the risk decisions get made.
The 24-hour, 72-hour and one-month reporting flow that has never once been rehearsed.

HOW WE HELP

Start a conversation

Under NIS2, cyber accountability reaches the management board.

A wider net, and a named owner at the top.

The 24-hour clock starts whether or not you're ready for it.

Early warning

Incident notification

Final report

Transformation

Board & NED advisory

Security architecture