In Force Across the EU: NIS2 Cybersecurity Directive

Is My Company Affected By NIS2?

The NIS2 Directive distinguishes between essential and important entities. The main difference: important entities are subject to lower fines and reactive supervision by the authorities, as opposed to the proactive supervision reserved for essential entities. There are no longer different minimum thresholds across the EU; applicability is determined by uniform criteria, and medium and large companies are covered.

Fines And Penalties

NIS2 clarifies and strengthens the fines for non-compliance with cybersecurity risk-management measures (Article 21) and reporting obligations (Article 23). Article 34(4) provides for administrative fines that vary depending on whether the entity is essential or important:

National laws can go beyond the directive’s minimum. Germany’s BSIG brings roughly 29,500 organizations into scope across 18 sectors, codifies personal liability for managing directors and boards, and sets fines of up to €10 million or 2% of global annual turnover. Always check the national law where you operate, not only the directive text.

NIS2 For Suppliers To Important And Essential Entities

Now that NIS2 is in force, the obligations reach beyond directly regulated entities. Companies that act only as suppliers feel it through their customers. The clearest example is the financial sector: banks and insurance companies have always had stringent rules, and the “banking supervisory requirements for information technology” (BAIT) provisions are an integral part of their risk management. For third-party service providers, this can mean that a client must assess their cybersecurity and include the result in the annual financial statements prepared by auditing firms.

IT service providers and other suppliers must expect supplier audits examining the robustness of their information security. De facto, the supply chain will have to meet the exact requirements that apply to regulated clients.

What Essential And Important Entities Must Do

Affected organizations must take appropriate action in areas such as cyber risk management, supply chain security, business continuity management, penetration testing, incident response, reporting, and remediation. NIS2 is also an opportunity for CISOs to reinforce their position: under the directive, senior management is responsible for managing cybersecurity risks, and violations carry severe penalties. As a CISO, the action plan for NIS2 compliance should focus on four main areas: hardening of the company’s complete tech stack, security monitoring of that stack, incident detection and response, and governance.

“Take appropriate and proportionate technical, operational and organizational measures to manage the risks posed to the security of network and information systems…” — NIS2 Article 21

Under Article 21, essential and important entities must take at least these 10 actions:

1. Policies on risk analysis and information system security
2. Incident handling
3. Business continuity: backup management, disaster recovery, and crisis management
4. Supply chain security, including relationships with direct suppliers and service providers
5. Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
6. Policies and procedures (testing and auditing) to assess the effectiveness of cybersecurity risk-management measures
7. Basic cyber hygiene practices and cybersecurity training
8. Policies and procedures regarding the use of cryptography and, where appropriate, encryption
9. Human resources security, access control policies and asset management
10. Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems

NIS2 Vs ISO 27001:2022

Complying with NIS2 is a multi-year program for many organizations. To make the path clearer, Mondoo maps NIS2 requirements to the ISO/IEC 27001:2022 standard. With the directive transposed and the Commission’s implementing regulation (EU) 2024/2690 setting concrete technical measures for several digital sectors, the requirements are far better defined than at adoption, and ISO 27001:2022 remains the most practical lens for gauging how far along you already are.

When aligning NIS2 measures with ISO 27001:2022, most of the relevant controls come from Annex A, which lists the security controls organizations use to demonstrate compliance with clause 6.1.3 (information security risk treatment) and its Statement of Applicability:

NIS2: Additions To ISO 27001

The ISO 27001 Annex A controls that are not included in the mapping to NIS2:

• A.5.4 Management responsibilities
• A.5.5 Contact with authorities
• A.5.6 Contact with special interest groups
• A.5.8 Information security in project management
• A.5.12 Classification of information
• A.5.13 Labelling of information
• A.5.31 Legal, statutory, regulatory and contractual requirements
• A.5.32 Intellectual property rights
• A.5.33 Protection of records
• A.5.34 Privacy and protection of PII
• A.7.1 Physical security perimeters
• A.7.2 Physical entry
• A.7.3 Securing offices, rooms and facilities
• A.7.4 Physical security monitoring
• A.7.5 Protecting against physical and environmental threats
• A.7.6 Working in secure areas
• A.7.8 Equipment siting and protection
• A.7.11 Supporting utilities
• A.7.12 Cabling security
• A.7.13 Equipment maintenance
• A.8.6 Capacity management
• A.8.7 Protection against malware
• A.8.10 Information deletion
• A.8.11 Data masking
• A.8.12 Data leakage prevention
• A.8.18 Use of privileged utility programs
• A.8.22 Segregation of networks
• A.8.23 Web filtering
• A.8.34 Protection of information systems during audit testing

Streamlining Incident Reporting

NIS2 imposes stricter incident response obligations and shorter timeframes than the original NIS Directive. The first step is to create or review your Incident Response Plan, so the process is fast and orderly when a reporting obligation is triggered. NIS2 works with two distinct concepts:

In the event of a cyber threat or significant incident, essential and important entities must notify, without undue delay: the competent authorities or the national Computer Security Incident Response Team (CSIRT), including any information enabling determination of cross-border impact; where appropriate, the recipients of their services if the incident is likely to affect them; and, for a significant cyber threat, the measures or remedies those recipients can take. When reporting to the competent authority or CSIRT:

An incident is considered significant if it has caused (or can cause) severe operational disruption or financial loss for the entity, or has affected (or can affect) other persons by causing considerable material or non-material damage.

Each member state runs its own CSIRT, and national law designates the competent authorities: in Germany the BSI (confirmed under the amended BSI Act), in France ANSSI, in Belgium the CCB.

Sectors In The Scope Of NIS2

Sectors Classified As Essential (Annex I)

Sectors Classified As Important (Annex II)

Summary

The NIS2 Cybersecurity Directive updates and broadens EU cybersecurity regulations, aiming to enhance resilience against cyber threats. It extends accountability to top management and imposes significant fines for non-compliance. It also affects suppliers, requiring evaluations of third-party cybersecurity. Stricter incident response requirements mandate swift reporting to national CSIRTs or competent authorities, emphasizing a proactive approach to cybersecurity.

Organizations should conduct a thorough assessment of their cybersecurity practices and determine their classification under the directive. This self-assessment helps identify areas for improvement and ensures compliance with regulatory requirements.

How Mondoo Helps With NIS2 Compliance

Meeting NIS2 is not about producing longer lists of findings. It is about closing them, continuously, and being able to prove it. Mondoo is an agentic exposure management platform that runs one continuous closed loop across your entire estate: it detects vulnerabilities and misconfigurations, prioritizes them by real risk, ships the fix, and verifies the fix held. That loop maps directly onto what Article 21 demands, from vulnerability handling and disclosure through to the ongoing assessment of how effective your security measures actually are.

Mondoo also covers the full path from source code to production. Static code analysis and secret scanning, powered by Mondoo’s open-source xgrep across 34+ languages, secure software at the source, while continuous assessment hardens cloud, containers, and the rest of your tech stack. Because NIS2 extends accountability deep into the supply chain, this source-to-close coverage gives both regulated entities and their suppliers the secure-development and third-party assurance evidence the directive requires. And because Mondoo maps its controls to NIS2 and ISO/IEC 27002:2022 out of the box, compliance shifts from a multi-year manual exercise into continuous, evidence-backed monitoring you can put straight in front of an auditor.

You don’t just find the gaps. You close them, and you can show your work.