NIS2 Directive Requirements and Reporting Obligations

• Energy (electricity, district heating and cooling, oil, gas, hydrogen)
• Transport (air, rail, water, road)
• Banking
• Financial market infrastructures
• Health
• Drinking water and waste water
• Digital infrastructure
• ICT service management (business-to-business)
• Public administration
• Space

• Postal and courier services
• Waste management
• Chemicals (manufacture, production, distribution)
• Food (production, processing, distribution)
• Manufacturing (medical devices, electrical equipment and electronics, machinery, vehicles)
• Digital providers (online marketplaces, online search engines, social networking platforms)
• Research

Appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks, including policies on risk analysis and information system security. Examples: regular risk analyses, creating and updating a risk register, a formal risk management process.

Cybersecurity risks across the whole supply chain must be taken into account, including security aspects of the relationship between the company and its direct suppliers or service providers. Examples: security audits of suppliers, cybersecurity clauses in contracts, a supplier risk management system.

Measures to handle security incidents effectively. Examples: setting up a Computer Emergency Response Team (CERT), developing incident response plans and testing them regularly, automated detection and response systems.

Measures to keep operations running, including backup management, disaster recovery, and crisis management. Examples: business continuity and disaster recovery plans with regular tests, a crisis team for cyber incidents, redundant systems and data backups.

Security measures in the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure. Examples: security by design in the development process, regular security updates and patches, a vulnerability management program.

Policies and procedures to assess the effectiveness of cybersecurity risk-management measures. Examples: regular internal and external security audits, key performance indicators (KPIs) for cybersecurity, penetration tests and red team exercises.

Basic cyber hygiene practices and cybersecurity training. Examples: regular phishing simulations, mandatory annual cybersecurity awareness training for all employees, good-practice rules for passwords and device use.

Policies and procedures for the use of cryptography and, where appropriate, encryption. Examples: AES-256 for data encryption, TLS for data in transit, end-to-end encryption for sensitive communication.

Measures for the security of personnel, access control policies, and asset management. Examples: background checks when hiring new employees, role-based access control, physical access control systems for critical infrastructure.

Multi-factor authentication or continuous authentication, secured communication systems and, where appropriate, secured emergency communication systems. Examples: two-factor authentication for all critical systems, VPNs for remote access, a secured emergency communication system.

Security measures must take into account the state of the art and, where applicable, relevant European and international standards. Examples: regular review and updating of security measures based on current good practice and frameworks such as ISO/IEC 27001 or the NIST Cybersecurity Framework. National frameworks can also help, such as IT-Grundschutz from Germany's Federal Office for Information Security (BSI).

The proportionality of measures is assessed against factors such as exposure to risk, the size of the entity, and the potential impact of incidents. Examples: a cost-benefit analysis of security measures, security controls matched to the criticality of systems and data, security investments prioritized by risk analysis.

Essential and important entities must send an early warning to the CSIRT (computer security incident response team) or, where applicable, the competent authority. They must do so without undue delay and in any event within 24 hours of becoming aware of a significant incident.

Within 72 hours of becoming aware of the significant incident, entities must submit an incident notification. It updates the early warning and gives an initial assessment of the incident, its severity and impact and, where available, the indicators of compromise.

No later than one month after the incident notification, entities must submit a final report. It contains:

• a detailed description of the incident, including its severity and impact
• the type of threat or root cause that is likely to have triggered the incident
• applied and ongoing mitigation measures
• where applicable, the cross-border impact of the incident

For infringements of Article 21 or 23, Member States must provide for maximum fines of at least €10 million or 2% of total worldwide annual turnover for essential entities, whichever is higher. For important entities, the maximum must be at least €7 million or 1.4% of total worldwide annual turnover, whichever is higher.

Management bodies can be held liable for infringements of their obligations to approve and oversee compliance with the NIS2 risk-management measures.

In essential entities, people with managerial responsibility at chief executive officer or legal representative level can be temporarily prohibited from exercising managerial functions.