The NIS2 Directive is fundamentally reshaping Europe's cybersecurity landscape. What previously only affected critical infrastructure operators now applies to an estimated 30,000 to 40,000 companies in Germany alone. Violations carry fines of up to 10 million EUR and personal liability for management.

This guide explains what NIS2 means for your company, what measures need to be implemented, and how to plan the implementation efficiently. No legal theory -- practical steps you can apply immediately.

What Is the NIS2 Directive?

The NIS2 Directive (Network and Information Security Directive 2) is the revised EU regulation on cybersecurity. It replaces the original NIS Directive from 2016 and addresses its biggest weaknesses: too narrow scope, inconsistent implementation across member states, and insufficient sanctions.

Key changes at a glance:

NIS2 vs. NIS1: the most important change

While NIS1 left EU member states a lot of leeway in implementation, NIS2 relies on harmonisation. That means the same minimum standards in all 27 EU countries -- an advantage for companies operating internationally, as they no longer have to follow 27 different rulebooks.

Who Is Affected by NIS2?

NIS2 distinguishes between essential entities and important entities. The difference lies in the supervisory regime and in the level of fines.

Essential Entities (proactive supervision)

Important Entities (reactive supervision)

Self-check: are you affected?

Check two criteria: (1) Does your company belong to one of the 18 sectors? (2) Do you have at least 50 employees OR an annual turnover of at least EUR 10 million? If both apply, NIS2 covers you. Smaller companies can also be affected if they are classified as particularly critical.

The 6 Core Obligations Under NIS2

NIS2 defines concrete obligations that every affected company must implement:

1. Risk Management

Companies must establish systematic risk management for their network and information systems. This includes identification, assessment, and treatment of risks, as well as regular reviews. Technical and organisational measures must correspond to the current state of the art and be proportionate to the risk.

2. Incident Response and Reporting

For significant security incidents, a three-stage reporting procedure applies: early warning within 24 hours, detailed notification within 72 hours, and final report within one month. Companies must have an incident response plan in place beforehand that defines responsibilities, escalation paths and communication plans.

3. Business Continuity

Affected companies need plans for maintaining business operations during cyber attacks. This includes backup management, disaster recovery, crisis management and regular testing of these plans.

4. Supply Chain Security

Companies must assess and manage the cybersecurity risks in their supply chain. That means anchoring security requirements in supplier contracts, carrying out regular audits and assessing the security posture of critical suppliers.

5. Training and Awareness

Management must participate in cybersecurity training -- this cannot be delegated. In addition, all employees must be trained regularly. The training must be documented and verifiable.

6. Technical Measures

NIS2 requires appropriate technical measures: encryption, multi-factor authentication (MFA), regular vulnerability scans and penetration tests, network segmentation, and least-privilege access controls.

Reporting Obligation: 24 Hours Count

The reporting obligation is one of the most critical aspects of NIS2. The three-stage procedure in detail:

StageDeadlineContent
Early warning24 hoursType of incident, suspected cause, cross-border impact
Detailed notification72 hoursInitial assessment, severity, indicators of compromise, measures taken
Final report1 monthDetailed description, root cause analysis, measures taken and planned, lessons learned
The 24-hour deadline starts when you become aware of the incident. Make sure your incident response team can be reached around the clock and that reporting channels are clearly defined.

Fines and Management Liability

NIS2 relies on substantial sanctions:

Critically: management liability. For the first time in an EU cybersecurity directive, managing directors and board members are personally liable for implementing cybersecurity measures. Delegation to the CISO or IT department does not release management from responsibility.

Comparison: NIS2 vs. GDPR fines

While the GDPR provides for fines of up to 4% of annual turnover, NIS2 is lower at 2%. The decisive difference: the personal liability of management goes beyond the GDPR and creates a direct incentive to take cybersecurity seriously.

Implementing NIS2 in 7 Steps

The following roadmap helps you approach the NIS2 implementation in a structured way. Plan for 6 to 12 months.

Step 1: Impact Assessment (Week 1-2)

Check whether your company falls under NIS2. Analyse your sector, company size and the criticality of your services. Include subsidiaries and affiliated companies as well.

Step 2: Gap Analysis (Week 2-4)

Compare your current IT security posture with NIS2 requirements. Identify gaps in risk management, incident response, business continuity, supply chain security and training. Document everything.

Step 3: Prioritisation and Roadmap (Week 4-6)

Prioritise identified gaps by risk and effort. Create a realistic roadmap with milestones, responsibilities, and budget. Tools like PathHub AI can help structure the implementation as a project and automatically identify stakeholders.

Step 4: Technical Measures (Week 6-20)

Implement the prioritised technical measures: MFA rollout, network segmentation, backup strategy, vulnerability management, logging and monitoring. Start with the measures that reduce the most risk for reasonable effort.

Step 5: Establish Processes (Week 8-24)

In parallel, build the organisational processes: incident response plan, business continuity plan, risk management process, supplier assessment process and training concept. Define clear responsibilities and escalation paths.

Step 6: Conduct Training (Week 12-28)

Train management (mandatory under NIS2!), the IT security team and all employees. Training should be practical -- phishing simulations, tabletop exercises and regular awareness campaigns.

Step 7: Test and Document (Week 20-36)

Test all processes: incident response, backup recovery times and the 24-hour reporting chain. Document everything -- in an audit by the supervisory authority, you must be able to show that your measures are appropriate and effective.

Supply Chain Security Under NIS2

For many companies, the supply chain security requirements are the biggest challenge. In concrete terms:

Ensuring Compliance with Digital Tools

Implementing NIS2 is a complex project with many parties, dependencies and deadlines. Digital project management tools help:

PathHub AI offers an integrated compliance database that automatically incorporates regulatory requirements like NIS2 into project planning, ensuring no obligation is forgotten.

Frequently Asked Questions

The NIS2 Directive (Network and Information Security Directive 2) is an EU regulation to strengthen cybersecurity. It replaces the original NIS Directive from 2016 and significantly expands the scope to more sectors and smaller companies.
NIS2 affects companies with 50+ employees or 10 million EUR annual revenue in 18 critical sectors, including energy, transport, healthcare, digital infrastructure, public administration, food, chemicals, and IT service providers.
Essential entities face fines of up to 10 million EUR or 2% of global annual revenue. Important entities face up to 7 million EUR or 1.4% of revenue. Additionally, managing directors are personally liable.
For significant security incidents, an early warning must be submitted within 24 hours. A detailed notification is required within 72 hours, and a final report within one month.
Full NIS2 implementation typically takes 6 to 12 months, depending on the current maturity of IT security. A gap analysis and prioritisation should be completed within the first 4 weeks.