Two very different conversations start with NIS2. In the first, a company reads the sector list, recognises its own activity and works out that it is directly regulated. In the second, a company that is not in scope at all receives a security questionnaire from a customer who is, and discovers that the substance of the directive has arrived anyway, as contract terms.
The second route is the more common one, and it is the one most often handled badly, because the supplier has no legal text to work from and no obvious way to judge which demands are reasonable.
Scope is a two-step test
The first step is the sector. The directive works from two lists. One covers sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. The second adds further critical sectors: postal and courier services, waste management, chemicals, food production and distribution, a large part of manufacturing, digital providers such as online marketplaces, search engines and social platforms, and research.
Manufacturing is the entry that surprises people. Categories including medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment are covered, which pulls in a great many industrial companies that never considered themselves regulated infrastructure.
The second step is size. As a general rule the threshold sits at the medium-sized enterprise level in the EU definition of an SME, which an entity reaches with fifty or more staff, or with both annual turnover and balance sheet total above ten million euro. Below it an entity is usually outside scope, above it inside. The two steps together also decide the tier: large entities in the high criticality sectors are treated as essential, while medium-sized entities in those sectors and entities from the second list are important.
One detail changes the answer more often than any other. The size calculation follows the European rules on linked and partner enterprises, so a twenty-person subsidiary of a large group can be over the threshold even though it looks like a small business on its own.
Where size stops mattering
Some categories are covered regardless of headcount and turnover. These include providers of public electronic communications networks and publicly available electronic communications services, trust service providers, top-level domain name registries and DNS service providers.
The same applies to an entity that is the sole provider in a member state of a service essential for critical societal or economic activity, to entities whose disruption could significantly affect public safety, security or health or could create systemic risk, and to entities of specific importance at national or regional level. Parts of public administration are in on this basis too.
The practical consequence is that a very small digital infrastructure provider can carry the full set of obligations while a larger company in another sector carries none. A conclusion drawn from employee count alone is unreliable in both directions.
The directive is not the text that binds you
NIS2 is a directive rather than a regulation, so it does not impose obligations directly. Each member state transposes it into national law, and the operative text for any given company is that national law together with whatever the national authority issues under it. The European transposition deadline passed in October 2024 and member states moved at different speeds.
For a group operating in several countries this is the detail that decides project structure. The directive sets a floor, but member states can bring additional entities into scope and they define the actual registration, reporting and supervision procedures, including which authority receives what and in which language. A single group-wide policy set is still the right approach; a single group-wide filing process is not. In Romania, for example, the competent national authority is the Directoratul Național de Securitate Cibernetică, and the reporting channels and forms follow from its regulations rather than from the directive.
What the tier changes
The list of risk management measures is identical for essential and important entities. Supervision and penalties are what differ.
Essential entities are supervised proactively. The authority can carry out inspections, security audits and information requests without any prior indication of non-compliance. Important entities are supervised reactively, meaning intervention follows evidence or an indication that obligations are not being met, most often after an incident or a complaint.
On penalties, the directive sets higher maximum ceilings for essential entities than for important ones, expressed both as an absolute amount and as a percentage of worldwide annual turnover. For essential entities there are also measures beyond fines, such as suspending an authorisation or temporarily barring an individual from management functions. The amounts that actually apply come from national law.
Registration and the reporting sequence
In-scope entities have to make themselves known to the authority, providing identifying details, sector, contact points and, for some categories, information about the IP ranges they use. For certain digital infrastructure and digital provider categories that information also feeds a registry maintained at EU level. Keeping the details current is part of the obligation.
Significant incidents are reported in three stages. An early warning is due within twenty-four hours of becoming aware, carrying only what is known at that point. A fuller notification follows within seventy-two hours, with an initial assessment of severity and impact and any indicators of compromise. A final report describing root cause, applied mitigations and effects is due within one month of that notification, and if the incident is still running at that point a progress report takes its place, with the final report following once the incident is closed. The authority can request intermediate reports, and in some circumstances the recipients of affected services have to be informed as well.
The first deadline is the one that breaks organisations, because it is too short to be met by a decision taken during an incident. Meeting it assumes a named person with the mandate to report, a channel already established and an internal definition of what counts as significant, all agreed in advance.
The supply chain route, and why it reaches further
Supply chain security is one of the named risk management measures, with explicit attention to the security of relationships with direct suppliers and service providers. In-scope entities therefore have to manage supplier risk, and the only instruments they have for that are contracts, questionnaires, evidence requests and audit rights.
That is how NIS2 arrives at companies the directive never covered. If you provide managed IT, software, hosting, logistics, maintenance or any service that touches a regulated customer’s operations, you can expect security requirements in the contract, a questionnaire before renewal, notification obligations toward that customer on a deadline shorter than your own comfort, and in some cases the right to audit.
For suppliers established outside the EU, this is usually the whole exposure, and it is real even though no regulator will ever write to you. A separate direct route also exists: certain categories of digital service provider that offer services in the EU without being established there fall under the directive and have to designate a representative in a member state where they operate. Outside those categories, the contractual channel is what matters.
Suppliers who treat this as an obstacle lose contracts slowly. Suppliers who prepare a short evidence pack, covering access control, patching, backup and restore testing, incident notification with named contacts, subcontractor list and the certifications they hold, answer in days rather than weeks. The requirements do not change, but the sales cycle does.
What the measures actually require
The directive asks for an all-hazards approach with measures proportionate to exposure, and it names no technology. The requirements cover risk analysis and information system security policies, incident handling, and business continuity including backup management, disaster recovery and crisis management.
They continue with supply chain security, security in the acquisition, development and maintenance of systems including vulnerability handling, and policies to assess whether the measures are effective. That last one is where most programmes are weakest. A written policy is easy to produce, while evidence that a control works requires measurement.
The remainder covers basic cyber hygiene and training, cryptography and encryption where appropriate, human resources security alongside access control policies and asset management, and finally multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems where appropriate.
Read as an implementation order it is misleading. An accurate asset and service inventory is the precondition for nearly everything else, and multi-factor authentication on every administrative path is the cheapest large reduction in risk available.
Accountability sits with the management body
NIS2 places responsibility on the management body rather than on the IT function. Management has to approve the risk management measures, oversee their implementation, and can be held liable for breaches of the obligations. Members of the management body are also required to undergo training and to see that comparable training is offered to staff.
The practical effect is that a formally approved measure list with no budget and no dates is itself a compliance problem. Decisions need to be recorded, with owners and deadlines attached.
Sequencing from a standing start
Start with a documented scope determination: sector, size test, resulting tier and the reasoning, signed off by management. It is the first document anyone will ask for and the basis of every later decision. Suppliers who are not in scope need the equivalent artefact, which is a short statement of what they do for regulated customers and which of their systems touch that work.
Next comes the asset and service inventory, then risk analysis and a minimal set of policies that describe how the organisation actually operates. On the technical side the priorities are multi-factor authentication, removing exposed management interfaces, clearing the patch backlog, and isolated backups with tested restores.
Only after that foundation exists is there value in the incident reporting process with internal deadlines and a rehearsal, the critical supplier register with security clauses, effectiveness measurement and the training programme. Registration and the evidence pack close the phase. For a mid-sized organisation the realistic span is several months of actual work.
Where to start
The useful first output is a gap assessment between what the applicable national law requires and what already exists, with effort estimated per item. We produce that as part of cybersecurity and compliance, and where the discussion starts from architecture and priorities instead, the entry point is IT consulting.