NIS2 compliance: What risk and security leaders need to know

Most organizations know NIS2 is coming. Fewer are ready for what it actually demands. Your security controls need to be documented and defensible. Your incident response has to run on a 24-72-30 clock. Your board needs to sign off and can be held personally liable if they don't. And the first audit deadline landed on June 30, 2026, with fines reaching €10 million or two percent of global turnover for essential entities.

Supervisors are already active in Germany. Registration deadlines have passed in several member states. And if your board hasn't formally approved your cybersecurity risk management measures yet, that's a gap with a name attached to it — Article 20 — and personal liability behind it.

The Commission has already referred seven member states to the Court of Justice of the EU for failing to transpose on time. Germany's BSI began active supervision in March 2026. Registration deadlines have passed in several jurisdictions. The compliance calendar many organizations built to "prepare for NIS2" has already expired in the countries moving fastest.

Here's what this guide covers: who's in scope and what that means for how supervisors treat you, what Article 21 actually demands of your security program, how the 24-72-30 incident reporting clock works and where it collides with the Digital Operational Resilience Act (DORA), what supervisors want to see as evidence, who carries personal liability when something goes wrong, and where national transposition creates real differences in what compliance looks like depending on where you operate.

Is your organization in scope for NIS2?

NIS2 applies to medium and large entities operating in 18 critical sectors, generally those with 50 or more employees or €10 million or more in annual turnover. The directive sorts in-scope organizations into two tiers, and the tier in which you land changes more than just your fine ceiling. It also changes how closely regulators watch you before anything goes wrong.

That ex-ante versus ex-post distinction carries real weight once you translate it into practice. Essential entities can be audited proactively — no incident, complaint, or trigger required. Regulators can show up and ask for evidence on their own schedule. Important entities are typically reviewed only after something happens: an incident, a complaint, a tip from another authority. A CISO at a midsize manufacturer (an important entity) has more runway to build audit-ready documentation over time. A utility operator (an essential entity) doesn't get that buffer. Build your evidence program for the tier you're in, not the one you'd prefer.

Some organizations — DNS providers, top-level domain name registries, and certain public administration bodies — are in scope regardless of size. Non-EU providers offering in-scope services in the EU, such as cloud services, data centers, content delivery networks, managed security services, and online marketplaces, must designate an EU representative under Article 26. That representative's member state becomes your competent supervisory jurisdiction.

What does Article 21 require for cybersecurity risk management?

Article 21 sets a minimum bar, not a ceiling. It mandates an all-hazards approach; protect your systems against cyber, physical, environmental, and human threats, not digital attacks alone. Meet that bar with controls across ten required measure categories:

1. Risk analysis and information system security policies
2. Incident handling
3. Business continuity, backup management, and crisis management
4. Supply chain security, including supplier and service provider relationships
5. Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure
6. Policies and procedures to assess the effectiveness of risk management measures
7. Basic cyber hygiene practices and security training
8. Cryptography and, where appropriate, encryption
9. Human resources security, access control, and asset management
10. Multifactor authentication, secured voice and video communications, and secured emergency communication systems

NIS2 doesn't name zero trust architecture. But the access control, MFA, segmentation, and continuous monitoring requirements in items nine and ten align operationally with zero trust principles. Document how your access architecture maps to those specific Article 21 provisions.

Article 21(2)(d) also creates a direct obligation on your supply chain. You're required to assess the cybersecurity posture of direct suppliers, the resilience of their products and services, and the security of their development practices. In practice, that means:

• Add NIS2-equivalent clauses to supplier contracts
• Require supplier incident notification fast enough to meet your own 24-hour reporting window
• Monitor critical ICT suppliers continuously, not on an annual review cycle

The EU Cooperation Group's coordinated risk assessments of critical supply chains, including 5G and cloud infrastructure, shape the sector-specific expectations supervisors apply here.

What are NIS2's incident reporting deadlines, and how do they overlap with DORA?

Article 23 imposes a tiered reporting structure to your national CSIRT or competent authority, built on three fixed checkpoints:

1. Early warning, within 24 hours of becoming aware of a significant incident: a concise notification to the CSIRT or competent authority
2. Incident notification, within 72 hours: an update covering initial severity assessment, impact, and indicators of compromise
3. Final report, within one month: root cause analysis, mitigation measures taken, and any cross-border impact

Manual workflows miss the 24-hour mark. Build the detection-to-notification trigger directly into your incident response platform before you need it, not after.

If your organization also falls under the Digital Operational Resilience Act (DORA), don't run two separate reporting tracks. DORA's initial notification and intermediate and final report timelines operate on a different clock for financial entities, and the two regimens don't automatically sync. Build one incident response playbook that satisfies the stricter of the two timelines for every applicable deadline, rather than managing NIS2 and DORA compliance as parallel workstreams. Financial entities in scope for both directives should brief their compliance and internal audit teams on where the clocks diverge before an incident forces that conversation under pressure.

What evidence do supervisors expect during a NIS2 audit?

Compliance with NIS2 is a legal obligation, not a voluntary posture, and supervisors are increasingly specific about what counts as proof. The European Union Agency for Cybersecurity’s Technical Implementation Guidance (June 2025) maps Article 21 controls directly to NIST CSF 2.0 and ISO 27001/27002, and national regulators now treat alignment with those frameworks as primary compliance evidence.

What does that mean for your documentation? Map your existing controls to the ten Article 21 categories, keep that mapping current (not a one-time exercise), and be ready to produce it on demand if you're an essential entity. Several member states have gone further and formally embedded specific frameworks into their national guidance — the details differ by jurisdiction, and we cover those differences in the transposition section below.

Who is personally liable under NIS2, and what triggers it?

Article 20 holds management bodies of essential and important entities directly responsible for approving and overseeing cybersecurity risk management measures. This is the sharpest delta from the original NIS Directive, and it's why internal audit and compliance teams should make NIS2 readiness a recurring board-level conversation.

Member states can impose personal liability under Article 20, including temporary bans from management functions for executives at essential entities. Article 32(6) reinforces this for essential entities specifically; competent authorities can order a temporary ban on a natural person from exercising managerial responsibilities when leadership fails to remedy non-compliance. Germany's transposition, the BSI Act, took effect in December 2025 and explicitly elevates NIS2 to a board-level issue with director liability attached.

Fines compound that exposure. NIS2 harmonizes administrative fine ceilings by tier:

Fines aren't the only enforcement tool. Competent authorities can issue binding instructions, order security audits at the entity's expense, and suspend certifications or authorizations. For essential entities, that list extends to the management ban under Article 32(6). As of May 2026, the Commission has escalated infringement proceedings against seven member states to the CJEU. Supervisory intensity is accelerating, not leveling off.

Where does national transposition create the biggest differences?

NIS2 is an EU directive, not a regulation, which means each member state transposes it into national law on its own timeline and with its own specific requirements. That creates real variation in what "compliant" looks like depending on where you operate.

Germany transposed NIS2 in December 2025 through the BSI Act, which explicitly elevates cybersecurity risk management to a board-level responsibility and attaches personal director liability.

Spain remained pending publication in the Boletín Oficial del Estado (BOE) as of early 2026, leaving entities operating there without a finalized national framework to audit against.

Italy integrated NIST CSF 2.0 into its updated National Framework for Cybersecurity, making that framework a recognized path to demonstrating compliance.

Belgium's CyberFundamentals (CyFun) framework references ISO 27001/27002 and the CIS Controls for general cybersecurity risk management, and adds IEC 62443 specifically for operational technology (OT) environments.

Slovenia's national guidelines reference ISO 27001/27002 as acceptable compliance evidence.

Ukraine adopted NIST CSF 2.0 for critical information infrastructure, aligning its approach with Italy's framework choice even outside the EU's transposition process.

If you operate across multiple member states, don't build separate documentation for each jurisdiction. Maintain one control inventory mapped to the frameworks referenced across your footprint — NIST CSF 2.0, ISO 27001/27002, the CIS Controls, and IEC 62443 where OT is in scope. That single inventory demonstrates compliance efficiently no matter which national authority asks to see it, and it keeps your team from redoing the same mapping exercise four times.

Your NIS2 readiness checklist

Treat readiness as four distinct workstreams, not one long to-do list. Each bucket answers a different question a supervisor will ask.

Confirm scope and jurisdiction

• Determine whether you qualify as an essential or important entity based on sector, headcount, and turnover.
• Identify every member state where you operate and confirm each jurisdiction's transposition status and audit deadline.
• Designate an EU representative under Article 26 if you're a non-EU provider offering in-scope services.
• Stand up evidence-backed controls
• Map your existing controls to all ten of Article 21's required measure categories.
• Align your control inventory to NIST CSF 2.0 or ISO 27001/27002. Multiple national regulators already accept these as primary evidence.
• Extend supplier contracts with NIS2-equivalent clauses, incident notification terms, and continuous monitoring requirements.

Prepare for reporting and response

• Automate the 24-hour early warning trigger inside your incident response platform.
• Build a single incident response playbook that satisfies the stricter of your NIS2 and DORA reporting timelines if both apply.
• Assign the coordination point between your legal, compliance, and CISO functions before an incident forces that conversation.

Document management oversight

• Brief your management body on Article 20 obligations and document evidence of board-level training.
• Record how your access architecture maps to Article 21's access control and MFA provisions.
• Keep your control-to-framework mapping current, not static. Supervisors expect evidence generated continuously, not assembled before an audit.

Build NIS2 evidence into how you already work

NIS2 rewards organizations that treat compliance as a continuous output of daily operations, not a scramble before an audit date. Integrate risk identification, assessment, response, and monitoring into a single workflow, and align your controls to NIST CSF 2.0 or ISO 27001, so NIS2 evidence gets generated as a byproduct of how your team already works.

Security and risk leaders scaling these controls across multiple sectors and jurisdictions increasingly consolidate them inside one cyber risk management platform instead of tracking Article 21 obligations, incident timelines, and board reporting across disconnected spreadsheets. Supervisory activities are already underway in several member states. Organizations that have not started building an evidence trail are now working against enforcement timelines, not ahead of them.