Directive (EU) 2022/2555
NIS2
The law that turns security from good practice into a duty of the management body. It names eighteen sectors, puts digital providers among them, and asks every entity in scope to manage the security of its suppliers, which is how it reaches companies the directive never names.
Does it apply to you?
Directly if you are a digital provider of a certain size. Indirectly if your customers are.
In scope
You are a digital provider and not small.
Cloud, data centre, managed services, managed security, online marketplaces, search engines and social networks are named sectors. From fifty employees or ten million euro turnover you are an important entity; larger, an essential one.
In scope, through your customers
Your customers are essential or important entities.
Article 21 makes them responsible for the security of their suppliers. They pass the measures down in contracts and questionnaires, and your evidence is what they file.
Out of scope
You are small and nobody regulated depends on you.
Below the size cap and outside the named sectors the directive does not bind you, unless your member state designates you or a customer's contract does.
What the directive asks
Article 20
Management owns it
The management body approves the measures, oversees them, and can be held liable. Its members, and the people they rely on, are trained for it.
Article 21
Ten measures, all of them
Risk analysis and policies, incident handling, continuity and backups, supply chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication.
Article 21(2)(d)
Supply chain security
The security of direct suppliers and service providers is the entity's own measure: assessed, contracted and monitored. The reason suppliers receive the questionnaire.
Article 23
Report significant incidents
An early warning within 24 hours, a notification within 72 hours, and a final report within a month, to the CSIRT or the competent authority.
When it applies
A directive: member states transpose it, and the national laws carry the dates that bind. Read the directive.
- 16 January 2023Entered into force, twenty days after publication in the Official Journal.
- 17 October 2024Deadline for member states to transpose the directive and to apply its measures.
- 17 April 2025Member states had to have established their lists of essential and important entities.
- National lawEach member state's act sets the registration, supervision and penalty details. Check the one where you are established.
How the evidence lands
Multi-factor authentication
Who has two-factor on, read from your identity and workspace tools, filed on the Article 21 measure that names it.
Backups and continuity
Backup state from the clouds and backup services you connect, as evidence of the continuity measure rather than a policy that says so.
Supply chain
The vendor graph: every supplier, its sub-processors, and the reports on its record. The register the supply chain measure assumes you have.
Incidents and training
An incident register with its timeline for Article 23, and policies acknowledged by every person for the hygiene and training measure.
See the Article 21 measures filled from your own tools
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.