Information security
NIS2 Directive — Directive (EU) 2022/2555 on cybersecurity
The EU directive requiring cybersecurity measures and incident reporting from thousands of essential and important entities.
At a glance
- Type
- EU directive (transposed into national law)
- Adopted
- 14 December 2022
- Authority in France
- ANSSI
- Fines
- Up to €10M or 2% of worldwide turnover (essential), €7M or 1.4% (important)
29 requirements tracked · 97 shared controls
What is NIS2?
Directive (EU) 2022/2555, known as NIS2, replaces the 2016 NIS Directive and greatly widens its scope: 18 sectors, two categories of entities (essential and important) and a threshold set in principle at medium-sized enterprises (50 employees or €10 million turnover and balance sheet). Some entities are in scope whatever their size.
Entities must implement cybersecurity risk-management measures, involve their management bodies, register with the authority and report significant incidents on a tight schedule. In France, transposition through the “Resilience” bill was not complete in autumn 2026: ANSSI offers voluntary pre-registration on MonEspaceNIS2 and published its Référentiel Cyber France (ReCyF) in March 2026.
Key requirements
- 1
Governance (Art. 20)
Management bodies approve the cybersecurity measures, oversee their implementation, can be held liable and must follow training.
- 2
Risk analysis and security policies
The first of the ten minimum measures of Article 21: policies on risk analysis and information system security.
- 3
Incident handling and continuity
Incident handling, business continuity, backups, disaster recovery and crisis management.
- 4
Supply chain security
Assess and govern the security of direct suppliers and service providers.
- 5
Cyber hygiene, training and access control
Basic practices, awareness, human resources security, asset management, MFA, encryption and secure communications.
- 6
Significant incident reporting (Art. 23)
Early warning within 24 hours, incident notification within 72 hours, final report within one month.
- 7
Registration (Art. 3 and 27)
Register with the competent authority and keep that information up to date.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- NIS2 requirements linked to 97 common controls, with a score that rises as soon as your ISO 27001 or ANSSI controls progress
- Incident register with the NIS2 deadlines (24 h, 72 h, 1 month) computed and reminded automatically
- “Cybersecurity governance policy” and “Significant incident notification procedure” templates
- Supplier assessment questionnaires, with AI-assisted analysis of the answers
- Awareness campaigns and a “NIS2 for management” module, with completion tracking
- A dashboard for management and an evidence pack you can export for the authority or your customers
Related frameworks
With ISO 27001 controls in place, your NIS2 starting score is about 52 to 72%.
The controls you put in place for NIS2 also count for:
- ISO 27001An ISO 27001 ISMS covers most Article 21 measures; registration and the reporting timeline remain.
- ANSSI hygiene guideThe ANSSI hygiene guide answers the expected basic cyber hygiene practices (Art. 21(2)(g)).
- ISO 22301Business continuity and crisis management are part of the minimum measures.
- DORAFor financial entities, DORA applies as the sector-specific act.
Frequently asked questions about NIS2
How do I know whether my company is in scope of NIS2?
First check whether your activity is listed in Annex I or II of the directive, then your size (medium-sized or larger, in principle). In France, ANSSI provides an online test on MonEspaceNIS2. The final criteria are set by each country’s transposition law.
Should we wait for the national law before acting?
No. The expected measures are known (Article 21 of the directive, ANSSI’s ReCyF in France) and take several months to implement. Starting with a risk assessment and basic hygiene measures is useful whatever the final date.
Does NIS2 require a certification?
No, the directive does not impose a general certification. It allows Member States to require some European certification schemes for products or services. ISO 27001 certification remains a good way to demonstrate your level.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment