Question 1

What is the NIS2 Directive?

Accepted Answer

NIS2 (Directive 2022/2555) is the EU directive on measures for a high common level of cybersecurity, replacing the original NIS Directive from 2016. It entered into force on 16 January 2023 and EU member states had until 17 October 2024 to transpose it into national law. NIS2 significantly expands the scope of organisations covered, introduces stricter security requirements, harmonises incident reporting timelines across the EU, and strengthens enforcement with fines of up to 10 million euros or 2% of worldwide annual turnover for essential entities. It covers 18 sectors spanning energy, transport, banking, health, digital infrastructure, and more.

Question 2

Who must comply with NIS2?

Accepted Answer

NIS2 applies to two categories of organisations. Essential entities include energy providers, transport operators, banking and financial market infrastructure, health sector organisations, drinking water and wastewater operators, digital infrastructure providers (DNS, TLD, cloud, data centres, CDNs), ICT service management (B2B), public administration, and space operators. Important entities include postal and courier services, waste management, chemical manufacturers, food producers, medical device manufacturers, digital providers (online marketplaces, search engines, social networks), and research organisations. The directive applies to medium-sized enterprises (50+ employees or 10M+ turnover) and above in these sectors, plus certain small entities providing critical services.

Question 3

What are the NIS2 incident notification deadlines?

Accepted Answer

NIS2 establishes a three-stage incident notification process for significant incidents. First, an early warning must be submitted to the national CSIRT or competent authority within 24 hours of becoming aware of the incident, indicating whether it is suspected to be caused by unlawful or malicious acts and whether it could have cross-border impact. Second, an incident notification with an initial assessment must be provided within 72 hours, including severity, impact, and indicators of compromise where available. Third, a final report must be submitted within one month of the incident notification, containing a detailed description, root cause analysis, mitigation measures applied, and cross-border impact. Venvera tracks all three deadlines automatically.

Question 4

What security measures does NIS2 require?

Accepted Answer

NIS2 Article 21 requires organisations to implement at least ten categories of cybersecurity risk management measures: risk analysis and information system security policies, incident handling procedures, business continuity and crisis management, supply chain security including security-related aspects of relationships with direct suppliers, security in network and information system acquisition and development, policies and procedures to assess the effectiveness of cybersecurity measures, basic cyber hygiene practices and cybersecurity training, policies on the use of cryptography and encryption, human resources security with access control policies and asset management, and the use of multi-factor authentication or continuous authentication solutions. Venvera maps your existing controls to each of these ten requirements and identifies gaps.

Question 5

What is NIS2 Article 20 management accountability?

Accepted Answer

NIS2 Article 20 requires that the management bodies of essential and important entities approve the cybersecurity risk management measures taken by the organisation, oversee their implementation, and can be held liable for infringements. Management body members must undergo training to gain sufficient knowledge and skills to identify risks and assess cybersecurity risk management practices. This means board directors and C-level executives have personal accountability for cybersecurity. Organisations must be able to demonstrate that their leadership has formally approved security policies, received cybersecurity training, and actively oversees the implementation of security measures.

Question 6

How does NIS2 apply to financial institutions already subject to DORA?

Accepted Answer

Financial entities that fall under DORA (banks, insurers, investment firms, payment providers) are subject to DORA as the sector-specific lex specialis for ICT risk management and operational resilience. Where DORA provides requirements that are at least equivalent to those in NIS2, the DORA provisions apply. However, NIS2 still sets the baseline and financial entities remain within the NIS2 ecosystem for cross-sector coordination, information sharing, and supervisory cooperation. In practice, complying with DORA will satisfy most NIS2 requirements, but organisations should verify coverage of any NIS2-specific measures not explicitly addressed by DORA. Venvera maps controls across both frameworks so you can see exactly where overlap exists and where gaps remain.

Question 7

What are the penalties for NIS2 non-compliance?

Accepted Answer

NIS2 introduces significant penalties differentiated by entity type. Essential entities face fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. Important entities face fines of up to 7 million euros or 1.4% of total worldwide annual turnover, whichever is higher. Beyond financial penalties, competent authorities can impose non-monetary remedies including binding instructions, implementation orders, security audit orders, threat notification orders to customers, and temporary suspension of certifications or authorisations. Management body members can also be held personally liable and face temporary bans from exercising managerial functions.

NIS2 COMPLIANCE SOFTWARE FOR ESSENTIAL AND IMPORTANT ENTITIES

RISK ANALYSIS AND INFORMATION SYSTEM SECURITY POLICIES

INCIDENT HANDLING WITH 24-HOUR EARLY WARNING

SUPPLY CHAIN SECURITY AND SUPPLIER RISK MANAGEMENT

BUSINESS CONTINUITY AND CRISIS MANAGEMENT

CYBER HYGIENE PRACTICES AND SECURITY TRAINING

MANAGEMENT ACCOUNTABILITY UNDER NIS2 ARTICLE 20

NIS2 COMPLIANCE: AUTOMATED VS MANUAL

What to Look For in NIS2 Compliance Software

Does it enforce the Article 23 incident reporting deadlines?

Does it produce Article 20 and supply-chain evidence?

FREQUENTLY ASKED QUESTIONS ABOUT NIS2

READY TO IMPLEMENT
NIS2 COMPLIANCE?