What is the NIS2 Directive?
NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. It replaced the original NIS Directive of 2016. EU member states had to transpose NIS2 into national law by 17 October 2024, and the national rules apply from 18 October 2024. In Belgium, the NIS2 law of 26 April 2024 applies from 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the national authority.
NIS2 widens the scope to many more sectors, introduces management accountability (Article 20), sets minimum security measures (Article 21), and imposes strict incident-reporting deadlines (Article 23).
Who does NIS2 apply to?
NIS2 generally applies to medium and large organisations — at least 50 employees or more than €10 million annual turnover and balance sheet — that operate in a sector listed in Annex I or Annex II. Some entities are in scope regardless of size, such as providers of public electronic communications networks, trust service providers, DNS service providers and TLD registries.
Entities are classified as essential or important. Essential entities are typically large organisations in Annex I sectors of high criticality; most other in-scope entities are important. Both must meet the same security measures; the difference is the supervision regime and the maximum fines.
- Annex I (high criticality): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure (including cloud, data centres, CDNs), ICT service management (B2B managed services and managed security services), public administration and space.
- Annex II (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers (online marketplaces, search engines, social networks) and research.
What are the NIS2 deadlines and penalties?
| Obligation | Deadline or amount |
|---|---|
| Transposition into national law | 17 October 2024 |
| Early warning of a significant incident | Within 24 hours of becoming aware |
| Incident notification | Within 72 hours of becoming aware |
| Final incident report | Within one month of the notification |
| Maximum fine — essential entities | €10 million or 2% of worldwide annual turnover, whichever is higher |
| Maximum fine — important entities | €7 million or 1.4% of worldwide annual turnover, whichever is higher |
What does Article 21 require?
Article 21(2) lists ten minimum measures that must be appropriate and proportionate to the risk:
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity, backup management, disaster recovery and crisis management.
- Supply chain security.
- Security in network and information system acquisition, development and maintenance, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of the measures.
- Basic cyber hygiene practices and cybersecurity training.
- Policies on cryptography and, where appropriate, encryption.
- Human resources security, access control policies and asset management.
- Multi-factor or continuous authentication, secured communications and secured emergency communications.
How does ComplyPilot map NIS2 requirements to controls and evidence?
ComplyPilot (EU compliance platform) treats NIS2 as a framework overlay. Each NIS2 requirement is linked to the controls, policies, risks and evidence that satisfy it. If you already work with ISO 27001, the same control records count towards NIS2, so you do not maintain two separate programmes.
The NIS2 dashboard shows readiness by category — governance, risk management, incident handling, business continuity, supply chain and more — using the same thresholds everywhere: 75% or higher is on track, 40–74% is in progress and below 40% needs attention. Supplier records with review dates support the supply-chain measure, and tasks with due dates track remediation.
Spreadsheets vs enterprise GRC vs ComplyPilot for NIS2
| Criterion | Spreadsheets | Enterprise GRC | ComplyPilot |
|---|---|---|---|
| Article 21 measures pre-mapped | No | Usually | Yes |
| Reuse of ISO 27001 controls | Manual | Yes | Yes |
| Supplier review tracking | Separate sheet | Yes | Yes, with review frequency |
| Time to first readiness view | Weeks | Months | Same day |
| Built for small and mid-sized entities | Yes | Rarely | Yes |
Frequently asked questions
When did NIS2 start to apply?
Member states had to transpose NIS2 by 17 October 2024 and apply the rules from 18 October 2024. Exact national dates and registration deadlines vary by country.
Is my company an essential or an important entity?
It depends on your sector (Annex I or II), your size and national rules. Large entities in Annex I sectors are usually essential; most other in-scope entities are important. Check your national authority's guidance, such as the CCB in Belgium.
Does ISO 27001 certification mean NIS2 compliance?
Not automatically. ISO 27001 covers much of Article 21, but NIS2 adds legal obligations such as incident reporting within 24 and 72 hours, management accountability and registration with your national authority.
Can management be held liable under NIS2?
Yes. Article 20 requires management bodies to approve and oversee the cybersecurity measures and to follow training, and member states can hold them liable for infringements.