Art. 21(2)(a)
Risk analysis and information system security policies
A documented, maintained view of the risks to the network and information systems your services run on, and the policies that answer them.
Directive (EU) 2022/2555
NIS2 compliance
Who the directive covers, the ten measures it requires, the reporting clock that starts at 24 hours, and what changes when your country writes it into law.
NIS2 — Directive (EU) 2022/2555 — is the EU's cybersecurity law for organisations whose services the economy depends on. It applies to medium and large entities in the 18 sectors listed in its two annexes, plus some entities regardless of size, and sorts them into essential and important entities. Both must take the ten cybersecurity risk-management measures in Article 21, report significant incidents on a fixed clock under Article 23 — an early warning within 24 hours, a notification within 72 hours and a final report within a month — and have their management body approve and oversee those measures. Because it is a directive, the obligations reach you through your country's transposing law.
Key takeaways
- Scope is set by sector (Annexes I and II) and by size: medium-sized and larger entities are in, with some — DNS providers, TLD registries, trust service providers — in regardless of size.
- Essential and important entities owe the same measures; what differs is how they are supervised and the size of the maximum fine.
- Article 21 lists ten measures, from risk analysis and incident handling to supply chain security, cryptography and multi-factor authentication.
- Article 23 reporting runs on a clock: 24 hours to an early warning, 72 hours to a notification, one month to a final report.
- Management bodies must approve the measures, oversee them and take training — and can be held liable for failing to.
Scope
Who NIS2 applies to
NIS2 scope is two tests applied together: are you in a listed sector, and are you big enough. Your national law then settles the edges.
- Annex I lists the sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space.
- Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers such as online marketplaces, search engines and social networks, and research.
- The size cap brings in medium-sized enterprises and larger — broadly 50 or more employees, or more than €10 million in annual turnover and balance sheet. Below that you are generally out, unless your entity type is named regardless of size.
- Some entities are in scope whatever their size, including DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications networks, and member states can designate others.
- Large entities in Annex I sectors are generally essential; most other in-scope entities are important. Essential entities face proactive supervision, important entities supervision after the fact.
- Cloud providers, data centres, managed service providers and managed security service providers also follow Implementing Regulation (EU) 2024/2690, which spells out the Article 21 measures in technical detail.
Requirements
What NIS2 requires
The directive asks for outcomes, not documents. Each measure has to be appropriate to your risk, proportionate to your size, and demonstrably operating.
Art. 21(2)(b)
Incident handling
The ability to detect, triage, contain and recover from incidents — the operational half of what Article 23 then asks you to report.
Art. 21(2)(c)
Business continuity and crisis management
Backup management, disaster recovery and crisis management that keep services running or bring them back.
Art. 21(2)(d)
Supply chain security
Security in your relationships with direct suppliers and service providers, judged against each supplier's own vulnerabilities and practices.
Art. 21(2)(e)
Secure acquisition, development and maintenance
Security across the life of your systems, including vulnerability handling and disclosure.
Art. 21(2)(f)
Assessing effectiveness
Policies and procedures to test whether the measures actually work — the line that turns NIS2 from a paperwork exercise into an evidence one.
Art. 21(2)(g)
Cyber hygiene and training
Basic hygiene practices and cybersecurity training across the organisation.
Art. 21(2)(h)
Cryptography and encryption
Policies on when and how cryptography and encryption are used.
Art. 21(2)(i)
People, access and assets
Human resources security, access control policies and asset management.
Art. 21(2)(j)
Strong authentication and secured communications
Multi-factor or continuous authentication, and secured voice, video, text and emergency communications where appropriate.
Art. 20
Management accountability
The management body approves the measures, oversees their implementation, follows training, and can be held liable for infringements.
Art. 23
Incident reporting
Significant incidents are reported to the CSIRT or competent authority on a fixed timeline, and recipients of your services are told when they may be affected.
Timeline
Dates and deadlines
The directive's own dates, and the reporting clock that starts the moment you become aware of a significant incident.
- 16 Jan 2023NIS2 enters into force
- 17 Oct 2024Transposition deadline; national measures apply from 18 October 2024
- 15 Jan 2026Sweden's Cybersecurity Act (2025:1506) enters into force
- Within 24 hoursEarly warning of a significant incident to the CSIRT or competent authority
- Within 72 hoursIncident notification with an initial assessment of severity and impact
- Within one monthFinal report after the incident notification, or a progress report if the incident is still ongoing
Overlaps
How it fits with other frameworks
NIS2 rarely arrives alone. Where it meets the other regimes you probably already run.
ISO 27001
Most of the Article 21 measures map onto Annex A controls, so a running ISMS covers much of NIS2. It does not cover the reporting clock, management liability or national registration.
DORA
DORA is sector-specific law for finance. Where it applies, its ICT risk and incident rules take precedence over NIS2's for those entities.
EU Cyber Resilience Act
The CRA governs the security of products with digital elements you place on the market; NIS2 governs how you run your own services. A software company can owe both.
GDPR
A significant incident involving personal data can trigger both NIS2 reporting and a GDPR breach notification, to different authorities on different clocks.
On Noru
How Noru runs NIS2
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
NIS2 on the shared control library
NIS2 is one of the frameworks you switch on in Noru. Its requirements are mapped onto the same control library as ISO 27001 and SOC 2, each with its own clause reference — the quarterly access review that answers ISO 27001 A.5.18 also answers Article 21(2)(i).
Evidence that is current, not filed
Controls are monitored from connected systems, so each Article 21 measure has a current status and a dated evidence history rather than a policy document and a review date.
Supply chain in the same programme
The vendor register, supplier assessments and third-party findings sit beside the controls, which is what Article 21(2)(d) asks for — not a second tool with a second register.
Gap first, then policies
Turning NIS2 on shows which mapped controls your existing programme already answers. What is new arrives as tasks with owners, and Cortex drafts the policy set for review.
Is my company in scope for NIS2?
Check two things: whether your activity falls in one of the sectors in Annex I or II, and whether you are at least medium-sized (broadly 50 or more employees, or over €10 million in turnover and balance sheet). If both, you are probably in scope. Some entity types — DNS providers, TLD registries, trust service providers, public electronic communications providers — are in regardless of size. Your national transposing law and its registration requirements give the final answer.
What is the difference between an essential and an important entity?
Both owe the same Article 21 measures and Article 23 reporting. Essential entities — broadly, large entities in Annex I sectors and some named types — are supervised proactively, through audits and inspections. Important entities are supervised after the fact, typically when there is evidence of non-compliance. Maximum fines are also higher for essential entities.
What are the ten NIS2 Article 21 measures?
Risk analysis and security policies; incident handling; business continuity and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling; procedures to assess effectiveness; cyber hygiene and training; cryptography; human resources security, access control and asset management; and multi-factor authentication with secured communications.
Can management be held personally liable under NIS2?
Article 20 requires the management body to approve the cybersecurity measures, oversee their implementation and take training, and allows member states to hold its members liable for infringements. For essential entities, authorities can also temporarily bar a person from exercising managerial functions.
We are a SaaS supplier, not a critical operator. Does NIS2 affect us?
Often yes, in one of two ways. You may be in scope yourself — business-to-business ICT service management, cloud computing and managed services are listed sectors. And even if you are not, your in-scope customers must secure their supply chain under Article 21(2)(d), so expect their security requirements to arrive in contracts and questionnaires.
How does Sweden implement NIS2?
Through the Cybersecurity Act (2025:1506) and its accompanying ordinance, in force since 15 January 2026, which replaced the earlier NIS Act. In-scope entities must register with the supervising authority, implement security measures, train management and report significant incidents.
Primary sources
Regulatory references on this page were last checked on .
See where you stand
A 45-minute walkthrough of NIS2 against your own controls, integrations and evidence.