NIS2 applies to organizations providing “essential or important services.” 

Essential entities are large organizations that operate across 11 critical sectors, including: 

• Energy
• Transport
• Banking
• Financial Market Infrastructure
• Health
• Drinking Water
• Waste Water
• Digital Infrastructure
• ICT Service Management (B2B)
• Public Administration
• Space

Important entities are medium-sized organizations that operate in seven areas of high criticality, including: 

• Postal and Courier Services
• Waste Management
• Manufacture, Production and Distribution of Chemicals
• Production, Processing and Distribution of Food
• Manufacturing
• Digital Providers
• Research

Large companies are those with at least 250 employees, an annual turnover of at least €50 million, or an annual balance sheet of at least €43 million, whereas medium companies are those with at least 50 employees, an annual turnover of at least €10 million, or a €10 million balance sheet.

Article 21 of the framework specifies cybersecurity risk management measures that Member States are expected to build on based on the criticality and size of covered entities. The 10 broad measures include:

1. Risk Management: Policies on risk analysis and information system security.
2. Incident Response: Procedures for handling and reporting cybersecurity incidents.
3. Continuity Planning: Business continuity measures, including backup management, disaster recovery, and crisis management.
4. Supply Chain: Security measures for relationships between entities and their direct suppliers or service providers.
5. System Security: Practices for secure acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure.
6. Effectiveness Assessment: Policies and procedures to evaluate the impact of cybersecurity risk-management measures.
7. Training: Implementation of basic cyber hygiene practices and cybersecurity training programs.
8. Encryption: Policies and procedures regarding the use of cryptography and, where appropriate, encryption techniques.
9. Access Control: Human resources security measures, access control policies, and asset management strategies.
10. Authentication: Deployment of multifactor or continuous authentication solutions, secured communications systems, and emergency communication tools within the entity, as appropriate.

Management bodies, including senior management and executive leadership, must participate in the development, implementation, and management of their organization’s cybersecurity initiatives and programs. They’re also required to undergo risk management and cybersecurity training, and it’s recommended that employees undergo the same training. Should a cybersecurity incident occur due to gross negligence of management, they can be held criminally liable.

NIS2 broadly mandates organizations to strengthen supply chain security. Organizations should assess and understand the risks associated with suppliers and vendors, implement appropriate security measures based on those risks, and regularly monitor and respond to ongoing supplier risk. Organizations may be considered non-compliant should they conduct business with high-risk third parties in the supply chain, meaning that organizations who fall outside the original scope of NIS2 may still be required to comply.

Covered entities must report incidents with the potential to cause severe operational disruptions or financial loss to the covered entity or other entities. Three incident reports must be submitted to the national computer security response incident response team (CSIRT):

• Initial report: Submitted within 24 hours of becoming aware of an incident and outlining the type of incident and its expected impact.
• Follow-up report: Submitted within 72 hours of becoming aware of an incident and including an assessment of the incident as well as details of its severity and impact.
• Comprehensive report: Submitted within one month of the incident and including details of remediation efforts and what initiatives have been implemented to mitigate risk in the future.