Glossary · N
NIS2 Directive
Network and Information Security Directive 2
EU cybersecurity requirements for essential and important entities
What it means
Directive (EU) 2022/2555, known as NIS2, sets cybersecurity risk-management and incident-reporting requirements for entities within its scope. Applicability depends on factors including sector, size and specific exceptions. Obligations are implemented through national law and include staged reporting of significant incidents.
What it means for a business
A company should establish whether the relevant legal entity falls within scope, identify the applicable national rules and assign responsibility for risk management and incident reporting. The assessment should consider the entity's activities and specific circumstances, rather than size alone.
In practice
Explore the knowledge base