NIS2
The EU Directive 2022/2555 on cybersecurity across critical sectors. It sets baseline measures, including access control and MFA, and incident reporting duties for essential and important entities.
Reading Time:
4 min
NIS2 is the EU Directive 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaces the first NIS Directive and widens its scope. It requires essential and important entities in critical sectors to manage cybersecurity risk and to report significant incidents.
Medium and large organisations in sectors such as energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management and public administration, and in other critical sectors such as manufacturing, food, chemicals, postal services and digital providers. Entities are classed as essential or important, which affects how they are supervised.
A directive. Each Member State transposes it into national law, so details such as the competent authority, registration and supervision differ by country. Organisations need to check the national rules that apply to them.
Article 21 asks for appropriate and proportionate risk-management measures. They cover, among others:
It names access control policies and the use of multi-factor or continuous authentication among its baseline measures. In practice that means knowing who and what has access to critical systems, limiting it to what is needed, protecting it with strong authentication and being able to show that it is reviewed.
For a significant incident, an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. To meet them, an organisation needs to scope an incident quickly, including which accounts were involved and what they did.
Management bodies must approve the cybersecurity measures, oversee their implementation and can be held accountable for failures. Cybersecurity becomes a board matter and not only an IT one.
Member States must provide fines with maximums of at least 10 million euros or 2% of worldwide annual turnover for essential entities, and 7 million euros or 1.4% for important entities.
NIS2 covers many critical sectors and is transposed nationally. DORA is a regulation for the financial sector and applies directly. Financial entities should check how the two interact under the rules that apply to them.
GDPR protects personal data and NIS2 aims at the security and resilience of networks and services. They overlap on security measures and incident reporting, with different scope and deadlines, and an incident can trigger obligations under both.
NIS2 puts supply chain security among its baseline measures, so organisations in scope must manage the cybersecurity risk of their suppliers. Even suppliers that are not directly covered may be asked by customers to meet similar requirements, including on how their staff and systems access customer environments.
Check whether you are in scope and how you are classified. Map the critical systems and the identities that can reach them. Review access control and MFA. Prepare an incident process that can meet the 24-hour and 72-hour deadlines, and make sure management is involved from the start.
Continuous visibility on identities and privileges supports access control. Monitoring after login supports detection. Fast investigation supports the 24-hour and 72-hour deadlines. Records of who had access and what they did support audit evidence.
Sharelock supports monitoring and alignment with NIS2 by showing who has access to what and how identities behave across critical applications. No tool alone makes an organisation compliant, and NIS2 does not come with a certification mark.
Explore more terms
The leading Agentic AI Autopilot for autonomous identity threat detection and response (ITDR) and cloud entitlement protection.
