NIS2

How it works

NIS2 is a directive, so each Member State turns it into national law. Article 41(1) required Member States to adopt and publish the necessary measures by 17 October 2024. The obligations fall on essential and important entities, and the text is written as duties for Member States: "Member States shall ensure that...".

Three articles matter most for this entry. Article 20 is headed Governance. Article 21 sets out cybersecurity risk-management measures. Article 23 sets reporting obligations for significant incidents.

What the articles say

Article 20(1) says Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken to comply with Article 21, oversee its implementation and can be held liable for infringements of that Article. A sentence follows that leaves national rules on the liability of public institutions and officials untouched.

Article 20(2) says Member States shall ensure that members of the management bodies are required to follow training, and shall encourage entities to offer similar training to employees on a regular basis, so that they gain enough knowledge and skills to identify risks and assess cybersecurity risk-management practices.

Article 21(2) lists measures that shall include at least: policies on risk analysis and information system security; incident handling; business continuity; supply chain security; security in network and information systems acquisition, development and maintenance; policies to assess the effectiveness of the measures; basic cyber hygiene and cybersecurity training; cryptography policies; human resources security, access control and asset management; and multi-factor or continuous authentication where appropriate.

Article 23(4) sets the steps for a significant incident: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours, an intermediate report on request, and a final report not later than one month after the notification.

How it connects to executive and credential exposure

NIS2 sets no specific check on executive breach exposure, so the link is indirect. Access control and authentication fall under Article 21(2), and CEM gives the management body a dated record of each leader's breach exposure, a concrete way to show it engaged with credential and identity risk. NIS2 Article 20: what management can document about credential risk explores that, and NIS2 and DORA: what management bodies must approve, oversee and learn compares the two regimes.

Practical steps

Whether NIS2 applies to a given organization depends on national law and the organization's facts, so counsel decides that. In practice, teams map their measures to Article 21(2), record management approval, schedule leadership training, and rehearse the 24-hour and 72-hour reporting steps. This page is general information and not legal advice.

How it differs from related terms

DORA is an EU regulation for the financial sector, while NIS2 is a directive across many sectors. NIS2 Article 4(1) provides that where a sector-specific Union act imposes requirements at least equivalent in effect, the relevant NIS2 provisions do not apply to those entities. GDPR Article 33 concerns personal data breach notification to a supervisory authority, while NIS2 Article 23 concerns significant incident notification to a CSIRT or competent authority. One event can trigger both.