NIS2 Directive: Expanded EU Cybersecurity
The Network and Information Systems Directive 2 (NIS2) significantly expands the scope and requirements of EU cybersecurity regulation. It applies to Essential and Important entities across 18 sectors, with stricter penalties and management accountability.
Expanded Scope
Essential Entities (Higher Requirements)
Energy, transport, banking, financial markets, health, drinking water, digital infrastructure, ICT service management, public administration, space.Important Entities
Postal services, waste management, chemicals, food, manufacturing, digital providers, research.Key Requirements
Risk Management (Article 21)
Organizations must implement cybersecurity risk management measures including:- Risk analysis and information system security policies
- Incident handling procedures
- Business continuity and crisis management
- Supply chain security
- Vulnerability handling and disclosure
- Cryptography and encryption policies
Incident Reporting (Article 23)
Mandatory reporting timeline:
- 24 hours: Early warning to national CSIRT
- 72 hours: Full incident notification with impact assessment
- 1 month: Final report with root cause analysis
Management Accountability (Article 20)
Management bodies must:- Approve cybersecurity risk management measures
- Oversee implementation
- Be held liable for non-compliance
- Undergo cybersecurity training
Supply Chain Security
Organizations must assess and manage risks from their ICT supply chain, including:- Supplier security assessments
- Contractual security requirements
- Monitoring supplier security posture
Penalties
- Essential Entities: Up to EUR 10 million or 2% of global annual turnover
- Important Entities: Up to EUR 7 million or 1.4% of global annual turnover
- Management liability: Personal accountability for non-compliance
SuperClue NIS2 Module
SuperClue's NIS2 framework scan runs 12 checks covering areas such as risk management, incident reporting readiness (24 and 72 hours), supply chain security, encryption, and MFA. It checks your external website and asks for evidence for the rest.