The NIS2 directive introduces new security requirements for organizations operating within the European Union. For businesses, it is therefore essential to determine whether you are affected and, if so, how you can comply effectively.
Our cybersecurity experts explain everything you need to know about this directive and how to prepare for compliance.
Quick Overview of the NIS2 Directive
What Is the NIS2 Directive?
The NIS2 Directive, adopted on December 27, 2022, is a major overhaul of the 2016 original NIS directive concerning European cybersecurity standards. This updated regulation extends the scope of NIS and aims to strengthen the security of networks and information systems while improving organizational resilience against cyber threats.
“The requirements laid down by the European directive encourage many entities to build a solid roadmap for deploying and strengthening their cyber defense resources, with the objectives of safer structural operation, greater confidence vis-à-vis their stakeholders and improved competitiveness for businesses.”
Effective Date of the NIS2 Directive
NIS2 came into force on January 16, 2023. EU member states had to transpose its directions into their respective national legislation by October 17, 2024. This is therefore a critical time for organizations to align their security measures with the new obligations.
Does the NIS2 Directive Apply to Your Business?
+1 000 entities targeted
+18 business sectors concerned
The directive applies to two categories of organizations: Essential Entities (EE) and Important Entities (EI).
Businesses exceeding critical thresholds in terms of sales (10 million euros), headcount (more than 50 employees), or significant economic impact are the primary focus.
Refer to the table below to check if your organization needs to comply with NIS2 regulations.
Mandatory compliance for essential and important entities
| Essential Entities (EE) | Important Entities (EI) |
|---|---|
 Public administration |
 Chemical manufacturing |
 Drinking water |
 Digital services providers |
 Wastewater |
 Waste management |
 Energy sector |
 Manufacturing industry |
 Aerospace industry |
 Food production, processing and distribution |
 IT and communications services |
 Research |
 Financial market infrastructure |
 Postal and shipping services |
 Digital infrastructure |
|
 Healthcare |
|
 Banking sector |
|
 Transportation |
Victrix Has a Dedicated Cybersecurity Offer for the Healthcare Sector
Ensure Compliance with EU Cybersecurity Directives
With our Scalable Security Operations Center we help organizations meet the highest cybersecurity standards (GDPR, DORA, NIS2, ISO 27001:2022)
4 Key Obligations of NIS2 for Essential and Important Entities
Governance
Take direct responsibility for cybersecurity strategies and integrate them into the organization’s overall governance framework.
Cybersecurity Risk Management
Establish regular assessments to identify, analyze and mitigate vulnerabilities.
Obligation to Inform
Report any significant cybersecurity incident within a maximum period of 24 to 72 hours.
Supply Chain Security
Ensure supplies comply with equivalent cybersecurity standards.
Risks of Non-Compliance with NIS2
- Fines up to 2% of global annual turnover
- Implementation of mandatory corrective measures enforced by authorities
- Suspension of critical activities until compliance is achieved
- Reputational damage, leading to loss of customer and partner confidence
Is Your Business NIS2 Compliant?
Victrix guides and supports essential and important entities in achieving NIS2 compliance. With a rigorous approach and certified GRC consultants, we guarantee customized compliance tailored to your business reality.
SEvOC: Your Partner Service in NIS2 Compliance
Victrix’s exclusive SOC offering helps organizations achieve and maintain NIS2 compliance. Here’s how.
Compliance Audit
We identify your gaps concerning NIS2 requirements and propose customized recommendations based on the specific standards of your business sector.
Action Plan Development
Following the compliance audit, we work with your teams to define the necessary steps and accelerate the compliance process.
Implementation of Compliance Measures
- End-to-end encryption (E2EE) for optimal data security
- Action traceability to meet audit requirements
- Strengthening resilience to improve incident and downtime management
- Integration of reliable technological solutions for critical systems
Monitoring and Continuous Improvement
Implement regular monitoring and evaluation processes.
Additional Information About NIS2
5 Main Goals of the NIS2 Directive
- Strengthen cybersecurity for critical networks
- Harmonize security standards across the EU
- Enhance cross-border cooperation and information sharing
- Address digital threats in businesses more effectively
- Increase digital trust and protect fundamental rights
6 Key Differences Between NIS (2016) and NIS2 (2022)
- Extended Coverage: Includes sectors related to Important Entities (EI).
- Stronger Obligations: Stricter security measures at all levels—technical, operational and organizational.
- Improved Collaboration: Increased emphasis on information sharing between Member States and competent authorities.
- Incident Reporting: shorter deadlines and more detailed information required.
- Stricter Enforcement: Stricter compliance mechanisms and higher fines for non-compliance.
- **NEW** Supply Chains Security: Entities must verify the level of cybersecurity of their suppliers.