NIS2 compliance, without the guesswork

NIS2 covers 18 sectors split into Annex I (essential entities — energy, transport, banking, health, digital infrastructure, and more) and Annex II (important entities — manufacturing, food, chemicals, digital providers, and more). Exact size thresholds are set by each member state's national law, so the same organisation can be in scope in one country and not another. A short scope check gives you a definitive answer.

For a significant incident: an early warning within 24 hours of becoming aware of it, a fuller incident notification within 72 hours, and a final report within one month covering root cause and impact.

Essential entities face fines of up to €10 million or 2% of global annual turnover, whichever is higher; important entities up to €7 million or 1.4%. Article 20 also allows management bodies to be held personally liable for infringements.

The EU-wide deadline was 17 October 2024, but most member states missed it. As of 2026, roughly 20 member states have national NIS2 laws adopted or in force, each with its own dates — and the first national enforcement actions are beginning.

Possibly. NIS2's supply-chain security requirement means in-scope organisations must assess and monitor their suppliers, so vendors and service providers to essential or important entities are often pulled in indirectly through contractual security requirements.

It depends on your current maturity and scope. A typical path runs from a scope and gap assessment, through a prioritised remediation roadmap, to implementation and ongoing monitoring — most organisations phase this over one or two quarters rather than closing every gap at once.