Why NIS2 Matters Across the EU. The NIS2 Directive significantly raises the EU’s cyber-resilience by expanding the scope of critical sectors and tightening security requirements. It “establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU”, replacing the original 2016 NIS Directive. NIS 2 raises the common level of ambition in cybersecurity through a wider scope, clearer rules, and stronger supervision tools. The Directive mandates that each Member State transpose NIS2 into national law; they had until 17 October 2024 to do so. In practice, however, adoption has varied: by late 2024, only four countries had implemented NIS2 laws on time, and by late 2025, just 17 out of 27 EU Member States had completed transposition.
Even though Member States are moving at very different paces, NIS2 matters because it brings cyber-risk into the boardroom view and sets a single baseline for resilience.
What NIS2 Requires at the EU Level
NIS2 imposes several core obligations on covered entities. These include cybersecurity governance and accountability at the top management level, risk management frameworks, strict incident reporting, and supply-chain security controls. Under NIS2, entities must implement technical and organizational security measures tailored to their risk profile, regularly assess vulnerabilities, and have plans for detection, response, and recovery.
NIS2’s scope is much broader than NIS1. It covers all medium-sized and large companies, in newly added sectors, in addition to those from the original directive. Specifically, it explicitly brings in providers of public electronic communications, more digital platforms, waste and wastewater management, manufacturing of critical products, postal and courier services, and public administration at all levels, as well as the space sector. As a rule, “medium-sized and large entities” in these critical sectors must comply.
The table below highlights the key differences between NIS1 and NIS2, showing how the updated directive expands coverage, strengthens requirements, and increases accountability for organizations.
|
Aspect |
NIS1 |
NIS2 |
|
Scope of Covered Entities |
Limited to sectors such as energy, transport, and healthcare |
Expanded to include postal and courier services, chemical and food industries, manufacturing, digital technology providers, and public administration |
|
Classification of Organizations |
Member states had flexibility in defining covered entities |
Uniform classification: Essential Entities (stricter requirements and supervision) and Important Entities (requirements with less oversight) |
|
Risk Management Requirements |
General cybersecurity measures encouraged |
Mandatory risk assessments, regular penetration testing and audits, supply chain security, third-party risk management, encryption, and multi-layered security |
|
Incident Reporting |
General reporting obligations |
More precise requirements: initial notification within 24 hours, detailed report within 72 hours, final report with full incident analysis and mitigation measures |
|
Penalties for Non-Compliance |
Relatively lower or undefined penalties, depending on the member state |
Higher penalties: up to €10M or 2% of global turnover for essential entities; €7M or 1.4% for important entities |
|
Administrative Burden |
Moderate compliance documentation |
Increased documentation, continuous policy updates, and regular audits |
|
Management Responsibility |
Limited personal liability |
Personal liability for managers, with potential sanctions or bans on holding executive positions |
|
Supply Chain Security |
Not explicitly required |
Mandatory assessment and monitoring of suppliers’ cybersecurity posture |
Organizational Requirements Under NIS2
NIS2 introduces key organizational requirements to strengthen cybersecurity and ensure resilience across essential entities.
Risk Management – Organizations must implement measures to reduce cyber risks, including incident management, stronger supply-chain security, enhanced network and system security, improved access controls, and encryption.
Corporate Accountability – Corporate management must oversee, approve, and be trained on the organization’s cybersecurity measures. Non-compliance can result in management liability and potential temporary bans from leadership roles.
Reporting Obligations – Entities must establish processes for prompt reporting of significant security incidents, including meeting NIS2 deadlines such as the 24-hour early warning.
Business Continuity – Organizations must plan how to maintain operations during major cyber incidents, including system recovery, emergency procedures, and establishing a crisis response team.
How Organizations Can Prepare
The NIS2 Directive does not affect every business the same way. It depends on your size, the role you play in society, and how exposed you are to cyber risks. The idea is simple: smaller businesses shouldn’t be weighed down with huge obligations, while bigger organizations take on responsibilities that match their impact. That said, there are some basic things every business should do to stay secure.
One of the key areas is risk management and policies. Organizations must regularly conduct risk assessments and implement clear security policies for their information systems. They also need to be prepared for incidents, with both an incident response plan and a business continuity plan in place. These plans should ensure that operations can continue during and after a security breach, including maintaining up-to-date backups and guaranteeing access to critical systems.
Security is not limited to internal operations. Supply chain security is equally important. Companies must assess vulnerabilities in their direct suppliers and ensure that overall supply chain security is maintained. Policies should be tailored to address specific risks posed by suppliers and other partners. Additionally, organizations need procedures to evaluate the effectiveness of their security measures, as well as policies for system procurement, development, and operation, including the reporting of vulnerabilities.
Employees play a critical role in cybersecurity. Under Articles 20 and 21 of the NIS2 Directive, organizations are required to establish and maintain structured cybersecurity training and awareness programs to ensure that employees understand their operational security responsibilities, while members of management bodies are sufficiently trained to oversee cybersecurity risk management, approve measures, and make informed decisions on digital resilience and incident handling. Businesses must also implement cryptography and encryption policies, particularly when handling sensitive data, and maintain strict access controls to protect critical information. An overview of all relevant assets helps ensure they are properly utilized and secured.
Finally, organizations are encouraged to adopt advanced security measures. These include multi-factor authentication, continuous authentication, and encryption for internal communications, including voice, video, and text, where appropriate. Secure emergency communication channels should also be established to maintain resilience during unexpected incidents.
Key Takeaways
– NIS2 requirements vary depending on business size, role, and cyber exposure.
– Regular risk assessments and clear security policies are essential.
– Check supplier security and review measures regularly.
– Train employees and management bodies to build cybersecurity awareness, accountability, and effective risk oversight.
– Use multi-factor authentication and encrypted communications when possible.
Following these steps helps your business stay secure and resilient against cyber risks.
TRECCERT Perspective – Supporting NIS2 Competence Development
As the NIS2 Directive reshapes cybersecurity expectations across the European Union, compliance is no longer a purely technical exercise; it is a people-driven capability. Organizations are now explicitly required to ensure that both staff and management bodies possess the knowledge and awareness needed to manage cybersecurity risks effectively. This has created a clear demand for structured, credible, and role-appropriate competence development. TRECCERT, a global certification body, is well-positioned to meet this transition. With extensive experience in information security, risk management, business continuity, data protection, and regulatory compliance, TRECCERT provides the expertise interpret, learn, and apply NIS2 requirements in real operational environments.
By focusing on competence, awareness, and accountability, TRECCERT helps organizations meet the intent of Articles 20 and 21, not just formal compliance, but effective cybersecurity oversight and resilience.
Corporate NIS2 Competence Solutions
For most organizations, NIS2 compliance is not achieved through isolated training, but through a tailored, organization-wide competence strategy. Different roles, from technical staff to senior management, carry different responsibilities under Articles 20 and 21, and effective training must reflect this reality.
TRECCERT’s corporate NIS2 solutions are designed as the preferred approach for organizations seeking structured, role-based, and scalable competence development. We work with organizations to tailor training pathways based on sector, size, risk profile, and internal responsibilities, ensuring that employees and management bodies receive training aligned with their actual obligations under NIS2. This approach enables organizations to demonstrate not only awareness but a deliberate and well-governed investment in cybersecurity competence.
NIS2 Essentials – A Structured Starting Point
Before implementing tailored, role-specific competence programs, organizations first need a shared baseline understanding of the NIS2 Directive. TRECCERT NIS2 Essentials is designed to provide this foundation through structured and accessible training formats.
The course is available as self-paced e-learning, instructor-led classroom training, or dedicated training material for internal deployment. These flexible delivery options allow organizations to introduce NIS2 concepts consistently across teams, regardless of location or learning preference.
NIS2 Essentials offers a clear overview of the directive’s scope, objectives, and core requirements, enabling participants to understand how NIS2 affects organizational governance, risk management, and daily operations. As a starting point, it supports awareness-building and prepares organizations for more tailored NIS2 competence development as part of a broader corporate training strategy.
As NIS2 rules take effect across Europe, having teams with recognized and proven skills gives organizations a real advantage.
