NIS2 is the successor to the original 2016 NIS Directive and substantially broadens both its scope and its teeth. The original directive covered operators of essential services and certain digital service providers; NIS2 covers a much wider population, organised into essential entities (energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, public administration, and space) and important entities (postal, waste, chemicals, food, manufacturing, digital providers, and research). Most medium and large organisations in the EU are now in scope.
The directive's core obligation is the implementation of risk-management measures. In-scope entities must take appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risk, based on an all-hazards approach. The measures must address at minimum: risk analysis, incident handling, business continuity, supply-chain security, secure development, vulnerability handling, encryption, access control, multi-factor authentication, asset management, and training. The leadership body must approve these measures, oversee their implementation, and can be held personally liable for non-compliance.
Incident reporting is one of the most operationally significant obligations and a step-change from the original directive. A significant incident must be notified to the CSIRT within 24 hours (an early warning), followed by an incident notification within 72 hours, and a final report within one month. The tight timelines require preparedness: a process to identify significant incidents, the contacts and templates to report within hours, and the forensic and legal capability to assess an incident accurately under pressure. This reporting regime is broadly modelled on GDPR's breach notification, and organisations that have built that capability have a head start.
Supply-chain security is a major new emphasis. Entities must consider the vulnerabilities specific to each direct supplier and the overall security of their supply chain, and supervisors are empowered to oversee this. In practice this means vendor risk assessment, contractual security requirements, ongoing monitoring of critical suppliers, and the ability to demonstrate supply-chain due diligence. For many organisations this is the most novel and demanding part of NIS2, because it reaches outside the organisation's direct control.
Passeca supports NIS2 compliance from scoping — determining whether and how the organisation is in scope — through risk-management measure implementation, the 24/72-hour reporting process, management accountability and training, and supply-chain security on the Panorays platform. The most common starting point is a NIS2 scope self-assessment, available as a free guide, which helps an organisation determine its obligations and set the implementation priorities. NIS2 work substantially overlaps with ISO 27001 and DORA, and a combined programme is usually the most efficient path.