NIS2 catches so many organisations off guard because most assume it applies only to large infrastructure providers or government bodies — when, in reality, the directive’s scope is significantly broader than its predecessor and pulls in thousands of mid-sized companies that have never dealt with formal cybersecurity regulation before. The combination of expanded sector coverage, stricter management accountability, and short incident reporting windows creates obligations that look nothing like a standard IT compliance project. Below, we work through the most common questions organisations are asking in 2026 as they try to make sense of what NIS2 actually demands. If you want to talk through your specific situation, feel free to get in touch with us and we will be happy to help.

Which organisations actually fall under NIS2?

NIS2 applies to organisations operating in sectors deemed essential or important to societal and economic continuity across the EU. It covers both essential entities and important entities, distinguished primarily by sector criticality and company size. Any organisation with at least 50 employees or an annual turnover above 10 million euros, operating in a covered sector, is likely in scope.

The sectors covered under NIS2 include energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. A second tier of important sectors adds postal services, waste management, chemicals, food production, manufacturing, and digital providers such as online marketplaces and search engines.

What surprises many organisations is that size thresholds are not the only trigger. Certain entities qualify regardless of size if they are the sole provider of a critical service in a member state, if disruption to their service could have a significant impact on public safety, or if they operate critical infrastructure. Supply chain relationships also matter: if your organisation provides services to an entity that is in scope, you may face indirect obligations through contractual requirements even if you fall outside the directive’s direct reach.

Why do so many organisations misread their NIS2 obligations?

Organisations misread their NIS2 obligations primarily because they apply the wrong mental model. Many approach NIS2 as an IT security checklist or a one-time audit exercise, when it is actually a continuous governance obligation that touches risk management, incident response, supply chain oversight, and board-level accountability simultaneously.

Several factors compound this misreading. First, NIS2 was transposed into national law across EU member states, meaning the exact obligations vary slightly depending on where an organisation is registered. Dutch organisations, for example, operate under the Cyberbeveiligingswet, which carries its own specific implementation details. Reading the EU directive text without understanding the local transposition can leave significant gaps.

Second, many organisations conflate NIS2 readiness with having an ISO 27001 certificate or a GDPR compliance programme already in place. While these frameworks overlap in useful ways, NIS2 introduces requirements that neither framework fully addresses, particularly around incident reporting timelines and personal liability for management.

Third, the directive uses terms like “appropriate and proportionate measures” that require genuine risk-based judgement rather than a fixed control checklist. Organisations used to working from prescriptive standards sometimes underestimate how much interpretive work is required to translate NIS2 obligations into operational practice.

What are the actual NIS2 requirements organisations must meet?

NIS2 requires organisations to implement risk management measures across ten defined areas, report significant incidents within strict timeframes, and ensure that senior management is personally accountable for cybersecurity governance. These are not aspirational guidelines — they are enforceable obligations with financial penalties attached.

The ten risk management areas mandated by NIS2 include:

  • Policies on risk analysis and information system security
  • Incident handling procedures
  • Business continuity and crisis management, including backup and disaster recovery
  • Supply chain security, covering relationships with direct suppliers and service providers
  • Security in network and information systems acquisition, development, and maintenance
  • Policies and procedures for assessing the effectiveness of cybersecurity measures
  • Basic cyber hygiene practices and cybersecurity training
  • Policies and procedures relating to the use of cryptography and encryption
  • Human resources security, access control policies, and asset management
  • Use of multi-factor authentication and secure communication systems

On incident reporting, NIS2 sets a three-stage timeline. Organisations must issue an early warning within 24 hours of becoming aware of a significant incident, submit an incident notification within 72 hours, and provide a final report within one month. These windows are tight and require pre-built processes — organisations that try to manage reporting reactively almost always miss the deadlines.

Management accountability is one of the most significant additions NIS2 brings. Senior leadership must approve cybersecurity measures, oversee their implementation, and can be held personally liable if negligence is demonstrated. This is not a responsibility that can be delegated entirely to an IT department or an external consultant.

How does NIS2 differ from ISO 27001 and GDPR compliance?

NIS2, ISO 27001, and GDPR address overlapping concerns but serve different purposes and carry different legal weight. NIS2 is a mandatory regulatory directive with enforcement authority; ISO 27001 is a voluntary certification standard; and GDPR governs the protection of personal data specifically. Having one does not substitute for the others.

NIS2 versus ISO 27001

ISO 27001 provides a comprehensive framework for building an information security management system, and much of the control work required for NIS2 aligns with ISO 27001 Annex A controls. However, ISO 27001 does not mandate incident reporting to national authorities, does not impose personal liability on management, and does not prescribe the specific risk domains NIS2 covers. An ISO 27001 certificate demonstrates that your security management system meets a recognised standard, but it does not constitute NIS2 compliance. That said, organisations with a mature ISO 27001 programme have a significant head start because the governance discipline, documentation habits, and risk management processes transfer directly.

NIS2 versus GDPR

GDPR focuses on protecting the personal data of individuals, with obligations around lawful processing, data subject rights, breach notification, and data protection by design. NIS2 focuses on the security and resilience of network and information systems, regardless of whether personal data is involved. The two frameworks intersect most visibly in the area of security measures and breach notification, but GDPR compliance does not address the full range of NIS2 requirements around business continuity, supply chain security, or management accountability. Organisations subject to both directives need to treat them as complementary rather than interchangeable.

What happens if an organisation fails to comply with NIS2?

Non-compliance with NIS2 can result in significant financial penalties, operational restrictions, and personal liability for senior management. For essential entities, fines can reach up to 10 million euros or 2% of global annual turnover, whichever is higher. For important entities, the ceiling is 7 million euros or 1.4% of global annual turnover.

Beyond financial penalties, national competent authorities have the power to issue binding instructions, require organisations to implement specific security measures, and, in serious cases, temporarily prohibit individuals from exercising managerial responsibilities. This last point is significant: NIS2 is one of the few cybersecurity frameworks where regulators can hold a named individual accountable rather than simply fining the organisation as a whole.

Reputational consequences also matter. Significant incidents that trigger the reporting obligations under NIS2 may become public, particularly if they affect customers, partners, or critical services. Organisations that cannot demonstrate they had appropriate governance in place before an incident face a much harder position when regulators and stakeholders start asking questions. This is precisely why continuous governance matters more than a point-in-time compliance exercise: the evidence of ongoing readiness is what protects an organisation when things go wrong.

How should an organisation approach NIS2 readiness?

An organisation should approach NIS2 readiness as a governance programme rather than an IT project. The starting point is a gap assessment that maps current security practices against NIS2’s ten risk management domains, identifies where incident response processes fall short of the required timelines, and clarifies where management accountability needs to be formalised.

From that baseline, a realistic readiness programme typically works through three phases. First, establish the governance structure: define roles, assign ownership, and ensure senior management is actively engaged rather than passively informed. Second, build and test the operational processes: incident detection and reporting workflows, business continuity plans, supply chain security reviews, and training programmes all need to be functional and documented before an incident occurs. Third, embed continuous monitoring: NIS2 compliance is not a destination but an ongoing state, and organisations need mechanisms to detect drift, respond to changes in their risk environment, and demonstrate readiness to regulators at any point.

One of the most common mistakes organisations make is treating readiness as a project with a defined end date. Certification cycles, regulatory updates, and changes in the threat landscape mean that governance must remain active. This is where a model built around continuous governance makes a practical difference: rather than rebuilding compliance knowledge from scratch before each review, organisations that maintain governance as a permanent capability are always audit-ready and far less exposed to the kind of governance drift that leads to incidents and penalties.

If your organisation is working through its NIS2 obligations and wants a structured approach that integrates security, privacy, and quality governance into a single managed system, explore what we offer at Moatt and see how ongoing governance support works in practice. When you are ready to take the next step, contact us to plan a conversation about where your organisation stands and what readiness looks like for your specific context.

Frequently Asked Questions

We are a non-EU company that sells services to EU-based clients — does NIS2 apply to us?

NIS2 can apply to organisations based outside the EU if they provide services within the EU and operate in a covered sector. If your organisation qualifies as an essential or important entity based on the services it delivers to EU customers, you may be required to designate a representative in an EU member state and comply with the directive's obligations. The safest approach is to assess whether your services fall within a covered sector and whether the size thresholds are met in the context of your EU operations, rather than assuming non-EU registration provides an exemption.

How do we know whether we are classified as an 'essential entity' or an 'important entity,' and does the distinction matter?

The classification depends primarily on the sector you operate in and your organisation's size. Essential entities typically operate in higher-criticality sectors such as energy, health, transport, banking, and digital infrastructure, while important entities cover a broader second tier including food production, manufacturing, and postal services. The distinction matters practically because essential entities face stricter supervisory regimes — including proactive inspections — and higher financial penalties for non-compliance, whereas important entities are generally subject to reactive supervision triggered by evidence of a breach or incident.

What does the 24-hour early warning requirement actually mean in practice — what information do we need to provide?

The 24-hour early warning is not expected to be a full incident report; it is an initial notification to your national competent authority or CSIRT indicating that a significant incident has occurred or is suspected. At this stage, you typically need to provide a basic description of the incident, an indication of whether it is suspected to be malicious, and any cross-border impact if relevant. The critical takeaway is that the 24-hour clock starts from the moment your organisation becomes aware of the incident, not when the investigation is complete — which means your incident detection and internal escalation processes must be fast and well-rehearsed before an incident ever happens.

Our organisation already has cyber insurance — does that reduce our NIS2 compliance obligations or protect us from penalties?

Cyber insurance does not reduce your NIS2 compliance obligations and will not shield your organisation or its management from regulatory penalties. Insurance can help cover financial losses, recovery costs, and certain liability claims arising from an incident, but regulators assess compliance independently of whether an organisation is insured. In fact, some insurers are increasingly requiring evidence of NIS2-aligned governance as a condition of coverage, which means strong compliance practices and insurance coverage are becoming complementary rather than alternatives.

How should we handle NIS2 obligations in our supply chain — what do we actually need to ask of our suppliers?

NIS2 requires you to assess and manage cybersecurity risks across your supply chain, which means you cannot simply assume your suppliers are adequately secured. In practice, this involves mapping which suppliers and service providers have access to your systems or handle critical processes, conducting risk assessments of those relationships, and introducing contractual requirements around security standards, incident notification, and audit rights. You do not need to audit every supplier to the same depth — a tiered approach based on criticality and access level is both proportionate and defensible to regulators.

What is the most common mistake organisations make when building their NIS2 incident response process?

The most common mistake is designing incident response processes on paper without ever testing them under realistic conditions. Many organisations document workflows that look thorough in a policy document but fall apart the first time a real incident occurs, because the people involved have never practised the escalation chain, the authority to notify regulators has not been clearly assigned, or the 24-hour early warning window has not been factored into detection and triage timelines. Running tabletop exercises that simulate a significant incident — including the reporting steps — is one of the most effective ways to expose gaps before regulators do.

How involved does senior management actually need to be, and what does 'personal liability' mean in concrete terms?

NIS2 requires senior management to actively approve cybersecurity risk management measures and oversee their implementation — passive sign-off on an annual security report is not sufficient. Personal liability means that if an incident occurs and regulators determine that management failed to exercise adequate oversight or ignored known risks, individual executives can face consequences beyond fines levied on the organisation, including temporary bans on holding managerial roles. The practical implication is that cybersecurity must become a standing agenda item at board and executive level, with documented evidence that leadership is engaged, informed, and making informed decisions about risk.

Related Articles

Share

  • June 9, 2026