NIS2 compliance: who must comply, requirements and how to start
Consultant Manager
Six Sigma White Belt (AIGPE), Internal Auditor - Integrated Management System (ISO), Gold Medalist MBA, 8+ years in cloud and cybersecurity content
NIS2 compliance means meeting the EU NIS2 Directive as written into your national law: management approves and oversees cybersecurity measures, you implement the ten minimum measures of Article 21, and you report significant incidents within 24 hours, 72 hours and one month. Maximum fines are at least €10 million or 2% of turnover.
Key takeaways
- NIS2 covers 18 sectors (11 in Annex I, 7 in Annex II) and generally applies to medium-sized and large organisations in them, plus some entities regardless of size.
- The directive applies through national law. In Sweden that is the Cybersecurity Act (Cybersäkerhetslag 2025:1506), in force since 15 January 2026.
- Management bodies must approve the measures, oversee them, take training and can be held liable for infringements.
- Article 21 lists ten minimum measures, from risk analysis and incident handling to supply chain security, encryption and multi-factor authentication.
- A gap analysis against Article 21, a prioritised roadmap and evidence you can show a supervisor are the practical core of compliance.
Who has to comply with NIS2?
NIS2 applies to public and private entities in the sectors listed in its two annexes that are at least medium-sized and operate in the EU. Directive (EU) 2022/2555 lists 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II.
| Annex I: sectors of high criticality | Annex II: other critical sectors |
|---|---|
| Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space | Postal and courier services, waste management, chemicals, food production and distribution, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers, research |
"Medium-sized" uses the EU SME definition. Under the European Commission's SME definition, a company is small if it has fewer than 50 staff and turnover or balance sheet of no more than €10 million, so in practice you are in scope from 50 employees or above those financial ceilings. Some entities are covered regardless of size, such as DNS service providers, top-level domain registries, trust service providers and the sole provider of an essential service in a member state.
Essential and important entities face the same measures but different supervision and fines. For a sector-by-sector walk-through, see who must comply with NIS2.
Does NIS2 apply to companies outside the EU?
Yes, for some digital services. Cloud, data centre, content delivery, managed service and managed security service providers, among others, that are not established in the EU but offer services there must designate a representative in a member state where they offer services (Article 26). Suppliers to in-scope companies are also affected indirectly, because their customers must manage supply chain security.
What does NIS2 require?
Four groups of obligations make up the core of the directive.
1. Governance and management accountability
Under Article 20, management bodies must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Members of management bodies must also follow training. This is the biggest change from the first NIS Directive: cybersecurity becomes a board-level duty, not only an IT task.
2. The ten minimum security measures (Article 21)
Measures must be appropriate and proportionate, based on an all-hazards approach, and include at least:
| Art. 21(2) | Measure | What it looks like in practice |
|---|---|---|
| (a) | Policies on risk analysis and information system security | A documented risk assessment, reviewed regularly and after major changes |
| (b) | Incident handling | Detection, triage, escalation and a reporting procedure that meets the 24 h / 72 h deadlines |
| (c) | Business continuity, backup, disaster recovery and crisis management | Tested restores, recovery objectives per system, a crisis team |
| (d) | Supply chain security | Supplier risk ratings, security clauses in contracts, follow-up of critical suppliers |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | Secure development, patch management, a vulnerability disclosure route |
| (f) | Assessing the effectiveness of measures | Internal audits, penetration tests, KPIs reported to management |
| (g) | Basic cyber hygiene and cybersecurity training | Awareness training, phishing exercises, secure configuration baselines |
| (h) | Cryptography and, where appropriate, encryption | An encryption policy for data in transit and at rest, key management |
| (i) | Human resources security, access control and asset management | Joiner-mover-leaver process, least privilege, an up-to-date asset inventory |
| (j) | Multi-factor or continuous authentication, secured communications, secured emergency communications | MFA for all remote and privileged access, an out-of-band channel for crises |
For digital infrastructure, ICT service management and digital providers, Commission Implementing Regulation (EU) 2024/2690 sets these requirements in more detail. ENISA's technical implementation guidance explains them with examples of evidence and mappings to other standards, and it is a useful reference for other sectors too.
3. Incident reporting (Article 23)
Significant incidents must be reported to the national CSIRT or competent authority in three stages:
- Early warning without undue delay and within 24 hours of becoming aware of the incident.
- Incident notification within 72 hours, with an initial assessment of severity and impact and indicators of compromise where available.
- Final report no later than one month after the notification.
Meeting the 24-hour deadline is mostly a detection problem: you cannot report what you have not noticed. That is why logging, monitoring and an on-call process sit at the centre of most compliance programmes.
4. Supervision and fines (Articles 32–34)
For essential entities, supervisors can carry out on-site inspections, security audits and scans and request documented policies; important entities are supervised ex post, when there are signs of non-compliance. For breaches of Articles 21 or 23, essential entities face fines of at least €10 million or 2% of total worldwide annual turnover, whichever is higher, as the maximum; important entities at least €7 million or 1.4%. Member states can set higher maximums.
How do you become NIS2 compliant?
Most organisations follow the same six steps. The order matters more than the speed.
- Confirm scope and classification. Check sector, size and national rules, and whether you are an essential or important entity. In some countries, including Sweden, entities must also notify themselves to the designated authority.
- Brief and train management. Management must approve the measures and is accountable, so start there.
- Run a gap analysis against the ten Article 21 measures, the reporting duties and any national requirements. Score each area and record the evidence you already have.
- Build a prioritised roadmap. Fix the highest risks first: MFA, backups that are tested, incident detection and a reporting procedure usually come before policy polishing.
- Implement and document. Turn requirements into policies, technical controls and routines, and keep the evidence (logs, test reports, training records) that a supervisor will ask for.
- Keep it running. Review risks, test incident response, follow up suppliers and report status to management on a fixed schedule.
Our NIS2 compliance guide breaks these steps into a detailed roadmap, and the NIS2 compliance checklist lists the individual controls.
Can ISO 27001 help with NIS2?
Yes. An information security management system built on ISO/IEC 27001 covers much of Article 21: risk assessment, policies, access control, supplier security, continuity and internal audit. ENISA's guidance maps requirements to standards such as ISO/IEC 27001. ISO 27001 does not cover the NIS2 reporting deadlines, registration or management liability, so treat it as a strong base, not a substitute.
NIS2 in Sweden: the Cybersecurity Act
Sweden implemented NIS2 through the Cybersäkerhetslag (2025:1506), which entered into force on 15 January 2026 and replaced the 2018 act on information security for essential and digital services (2018:1174). Myndigheten för civilt försvar (MCF, formerly MSB) is the central authority under the act, including the registration of entities in scope, while sector authorities supervise their own sectors. Swedish organisations in scope should also check the sector-specific regulations from their supervisory authority.
How Opsio helps
Opsio supports NIS2 programmes from gap analysis to ongoing compliance, with a 24/7 security operations centre for the detection and incident-reporting duties. P1 security incidents are acknowledged within 15 minutes around the clock.
For Löfbergs, the Karlstad coffee roaster that falls under NIS2 and the Swedish Cybersecurity Act as a food-sector company, Opsio acts as end-to-end NIS2 partner. The work ran in four phases: a gap analysis of infrastructure, policies and governance against NIS2 and the Swedish act; a prioritised roadmap with milestones, deliverables and owners; implementation of risk management, incident handling, access control, logging and monitoring and supply chain security, each documented for audit; and ongoing compliance with regular security reviews and updated risk assessments. Read the Löfbergs NIS2 case.
Frequently asked questions
When did NIS2 come into force?
The directive required member states to adopt national laws by 17 October 2024 and apply them from 18 October 2024. National laws arrived at different dates; Sweden's Cybersecurity Act entered into force on 15 January 2026.
What is the difference between essential and important entities?
Both must meet the same risk-management and reporting duties. Essential entities, mostly large organisations in Annex I sectors, face proactive supervision and higher maximum fines. Important entities are supervised mainly after the fact, for example following an incident or a complaint.
What are the NIS2 reporting deadlines?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification.
Can managers be personally liable under NIS2?
Article 20 says management bodies can be held liable for infringements of the risk-management duties, and national laws set out how. Members of management must also take cybersecurity training.
Is NIS2 compliance a one-off project?
No. Risk assessments, supplier reviews, training, incident tests and management reporting must continue, and supervisors can ask for evidence at any time.
Related Articles
About the Author
Consultant Manager
Debolina works at the intersection of IT operations, quality management, and compliance at Opsio. She focuses on practical, data-driven insights around operational efficiency, governance, and continuous improvement — helping organisations streamline complex systems while maintaining standards.
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
