NIS2 - EU Network and Information Security Directive

NIS2 creates a major compliance challenge primarily because it massively expands the number and types of organizations in scope, extends into more industries, and can apply to entities with more than 50 employees depending on revenue, balance sheet total, and sector. This expansion is paired with stringent operational obligations, especially around incident identification, response, and rapid reporting, including an initial notification within 24 hours and a more detailed report within 72 hours. NIS2 also elevates Business Continuity Management (BCM)—including backups, disaster recovery, and crisis handling—into a core requirement, reinforcing the need for well-defined cybersecurity policies as the basis for coordinated action under pressure.

The directive mandates cyber hygiene and cybersecurity training, implying practical alignment with recognized best practices and frameworks such as ISO/IEC 27001:2022. Supply chain security becomes a major gap area because organizations must address security aspects not only internally but also across direct suppliers and service providers, including third-party access, onboarding/offboarding, and supplier assurance mechanisms such as certifications. NIS2 and the draft Implementation Regulation further require a strong cybersecurity posture with concrete measures like strong authentication, encryption where needed, asset management, and physical/logical access controls.

A further complication is uncertainty: the Implementation Regulation remains in draft close to national transposition deadlines, leaving country-specific reporting pathways and detailed expectations insufficiently defined and increasing non-compliance risk. The proposed approach is a phased, framework-driven program: confirm scope, assess current organizational and technical maturity, perform a gap analysis, prioritize actions, implement governance, and execute a roadmap supported by models such as the Cybersecurity Fabric and a reference architecture, underpinned by policies, processes, a Target Operating Model, and operational capabilities such as XDR/SOAR supported by internal teams and/or managed service providers.

• NIS2 is expected to affect about 29,500 organizations in Germany.
• About 1,100 to 1,200 organizations are currently in scope of critical infrastructure law in Germany, with 1,870 cited by other sources.
• In France, the number of organizations in scope is expected to rise from about 1,000 to at least 6,000.
• Initial incident reporting is required within 24 hours.
• A more detailed incident report is required within 72 hours.
• NIS2 lists Business Continuity Management as a requirement, including backup management, disaster recovery, and crisis handling.
• Cyber hygiene practices and cybersecurity training are mandated, including training for board members.
• The Implementation Regulation was still in draft close to the deadline for transposition into national law.
• NIS2-related measures include strong authentication, encryption where needed, asset management, and physical and logical access controls.
• Provision of SBOM information is mandated for providers of software.

• “There is no single solution to address the requirements imposed by the NIS2 regulation.”
• “Achieving compliance with NIS2 is a process that starts with an analysis of whether an organization is in scope of NIS2 or not.”
• “NIS2 comes with the obligation of continuous monitoring of networks, information systems, and physical assets regarding potential cyberattacks.”
• “Many organizations are not well-positioned yet to fulfil this requirement.”
• “NIS2 is more than a technical challenge because it requires a strong cybersecurity organization with defined accountabilities and responsibilities.”
• “Most organizations will not be able to handle all aspects of NIS2 readiness and compliance internally.”
• “Spending the budget requires a plan, based on gaps and priorities.”
• “Integration of services is essential for identifying and analyzing complex attack scenarios spanning multiple networks, systems, and applications.”
• “A frequently overlooked aspect is the need for cybersecurity governance that enforces proper execution of conceptual measures, continuous improvements, daily operations, fulfillment of reporting obligations, and daily operations.”
• “NIS2 is first about organization, policies, and processes; then about technology.”