Quick summary
NIS2 sets out baseline requirements you can act on now – even if national law in your country isn’t finalized yet
There are 3 core areas to focus on: management accountability, cyber risk mitigation, and incident reporting
Leadership is now legally responsible for compliance and training
Companies must implement technical, operational, and organizational cybersecurity measures
You must report major cyber incidents within 24-72 hours
How should you approach NIS2 compliance before national laws are finalized?
Even if local legislation or sector guidelines aren’t available yet, the NIS2 Directive already defines minimum requirements you must meet.
Start now by:
Implementing baseline cybersecurity measures
Ensuring leadership awareness and accountability
Preparing your incident reporting processes
By the time you have implemented those minimum requirements, national legislation will likely have been adopted in your country, and sector-specific guidelines will have been published.
At that point, you will simply need to perform a gap analysis to verify whether any additional actions are required from your side to address the specifications provided at the national level and by industry authorities.
To help you kick off your NIS2 compliance program, we have gathered all the information you need about the requirements set by the NIS2 Directive in this blog post.
What are the requirements you need to comply with?
The requirements imposed on companies by the NIS2 Directive can be grouped into three areas:
- Management buy-in, responsibility, training, and liability
- Preventative measures to mitigate the risk of cyber incidents
- Reporting obligations in the event that cyber incidents occur
Let’s analyze each of them in detail.
1. Management is now liable for NIS2 compliance
The Directive addressed the risk that the C-suite would not devote the appropriate resources to ensure NIS2 compliance by placing on a company’s management the responsibility to approve the cybersecurity risk-management measures taken in their company to comply with the NIS2 requirements.
Additionally, management is responsible for overseeing the implementation of these measures and can be held personally liable for compliance failures.
In particular, competent authorities can temporarily remove the CEO or other legal representative from exercising managerial functions in case they find compliance infringements.
Moreover, management is required to follow cybersecurity training and is encouraged to offer similar training to employees on a regular basis so that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.
To sum up, management involvement, training, buy-in, and approval of cybersecurity measures are not only recommended ways to proceed – they are now a legal requirement, and non-compliance is punished with suspension.
2. Cybersecurity risk-management measures listed in Article 21
While the NIS2 Directive comprises a total of 46 articles, the one to which companies should devote most of their attention when working toward achieving compliance is Article 21.
Article 21 requires companies to take appropriate and proportionate technical, operational, and organizational measures to manage the risks posed to their NIS (Network and Information System) security and prevent or minimize the impact of incidents on service recipients.
Such a statement is meant to broadly include all measures necessary to mitigate cyber risks. But what does it really mean?
What are these measures, and how can you make sure they are adequate for your company?
Let’s clarify what’s intended.
NIS2 requires you to implement:
Technical measures:
those that can be implemented physically, such as alarm systems, firewalls, cryptography, and encryption. For example, implementing a secure remote access solution like Secomea’s to manage and control access to your OT devices and authenticate users via MFA would fall into the category of technical measures implemented under this article.
Operational measures:
those related to the processes to follow to proactively ensure cybersecurity and reactively respond in case of an incident. They include how to manage risks, analyze them, and mitigate their impact, as well as the steps to take for crisis management or recovery from an incident.
Organizational measures:
those implemented through instructions, policies, and procedures, such as regular cybersecurity training for staff and, more generally, the focus on building a cyber-secure company culture based on cyber-hygiene practices.
The measures should be:
Appropriate:
These measures should ensure a level of security of your network and information systems that is adequate to prevent and mitigate the risks posed by potential incidents affecting your NIS security and, in turn, your services – as well as the recipients-users of your services. To ensure an appropriate level of security, consider the state-of-the-art and relevant international standards, as well as the associated implementation costs.
Proportionate:
These measures should be risk-based, taking into account your company’s exposure to risks, size, and the likelihood and severity of incidents.
Your risk analysis should be built on an all-hazards approach – meaning that you should consider all of the thinkable threats that could affect your NIS security.
What exactly should these measures be about? What elements should they cover?
Your cybersecurity measures should cover, at a minimum, the 10 elements listed in Article 21.
If you receive a visit from the competent authorities coming to audit your organization’s compliance with the NIS2 legislation, you need to ensure that you can demonstrate you have implemented measures, including all of the elements listed below:
- Policies on risk analysis and information system security
- A plan for handling potential incidents
- Business continuity, such as backup management, disaster recovery, and crisis management
- Supply chain security, taking into account the vulnerabilities specific to each direct supplier and service provider and the overall quality, development procedures, and cybersecurity practices of the products and services provided by their suppliers and service providers.
- Security in network and information systems acquisition, development, and maintenance – including vulnerability handling and disclosure
- Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
- Basic cyber hygiene practices and cybersecurity training
- Policies and procedures regarding the use of cryptography and, where appropriate, encryption
- Human resources security, access control policies, and asset management
- The use of multi-factor authentication or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems within the entity, where appropriate.
Companies violating these requirements will be mandated to take, without undue delay, all necessary, appropriate, and proportionate corrective measures to avoid being issued fines.
How can you prove to competent authorities that your measures are appropriate and proportionate?
In case of a compliance inspection from the authorities, you must be able to demonstrate that the measures you implemented are appropriate and proportionate.
To this end, you will need to be able to prove that:
- The risks and threats you have identified have been handled, the vulnerabilities you encountered in your risk assessment have been mitigated, and you have been periodically reassessing such risks as well as the effectiveness and adequacy of your measures.
- All 10 minimum requirements listed in Article 21 have been addressed, your incident response plan has been tested, and your company’s management has taken an active part in the process and approved it.
- The budget approved by management for cybersecurity is adequate for your company’s risk level and size, taking into account the other expenses you have allocated to safety management, for example.
- All of the above is documented, periodically reviewed, and updated as needed.
3. Reporting obligations
Even if you’ve done everything in your power to prevent a cybersecurity incident from occurring, it can still happen.
Implementing the cybersecurity measures required by the NIS2 Directive will significantly enhance your NIS security and help prevent incidents. However, in the event that an incident does happen, you need to be prepared for it and know how to act.
In particular, certain reporting obligations need to be addressed.
Companies must notify their national CSIRT or, where applicable, other competent authorities without undue delay of any incident that has a significant impact on the provision of their services.
Let’s discover what these reporting obligations entail.
Which incidents should be reported?
Companies must notify of any incident that significantly impacts the provision of their services.
An incident is to be considered significant if:
- it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;
- it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
Who should be notified?
Companies must notify their national CSIRT (Computer Security Incident Response Teams) or, where applicable, other competent authorities.
Moreover, if the incident is likely to adversely affect the provision of a company’s services, the company should also notify its customers (the recipients of the services affected) and, if appropriate, provide information on the cyber threat and the measures or remedies that the recipients can take to respond to it.
Nobody likes to give bad news, but it’s your responsibility to reassure the people using your services affected by cyber incidents that you have a best practice plan, that you are working hard to limit the damage, and that competent authorities have been notified promptly.
Despite the crisis, businesses must be transparent in letting people know when things go wrong. To begin rebuilding trust with your customers, those affected should see you take ownership of the issue and act responsibly in the aftermath.
When should the notification be made?
The notification should be made without undue delay, meaning as soon as possible and, in any case, within 24 hours of becoming aware of the significant incident.
In particular, companies must notify authorities:
- within 24 hours, through an early warning indicating whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
- within 72 hours, through an incident notification updating the information shared via the early warning and indicating the initial assessment of the incident, including its severity and impact;
- upon request, via an intermediate report on relevant status updates;
- within a month after the incident notification, via a final report, including:
- a detailed description of the incident, including its severity and impact;
- the type of threat or root cause that is likely to have triggered the incident;
- applied and ongoing mitigation measures;
- where applicable, the cross-border impact of the incident.
What will happen after a company notifies the authorities of a significant incident?
Upon receiving notification of the incident, the CSIRT will respond to the notifying company within 24 hours, including initial feedback on the significant incident.
Companies can also request guidance and operational advice on implementing possible mitigation measures, as well as technical support.
If the incident is suspected to be of a criminal nature, the CSIRT will also guide the company in reporting it to the competent law enforcement authorities.
Once a company has fulfilled its notification duty, the CSIRT will inform other Member States and ENISA if the cyber incident concerns two or more Member States.
If necessary, the incident will also be disclosed to the general public.
These new rules aim to enhance the EU’s approach to preventing, handling, and responding to large-scale cybersecurity incidents and crises. They do so by introducing clear responsibilities, appropriate planning, and more EU cooperation to ensure that Member States can mutually assist each other in the case of cross-border malpractices, have a more structured dialogue with the private sector, and coordinate the disclosure of vulnerabilities found in software and hardware sold across the internal market.
How Secomea can help you
The implementation of Secomea’s secure remote access solution on your factory floors can be considered one of the technical measures required under Article 21 of the NIS2 Directive to manage the risks posed to the security of network and information systems and prevent or minimize the impact of incidents.
Besides, using Secomea will address other elements mandated by the legislation.
Moreover, we have outlined a 10-step implementation roadmap that you can follow to ensure compliance with NIS2 requirements.
To help you navigate the NIS2 legislation and prepare for NIS2 inspections, we have prepared this comprehensive whitepaper.
All you need to know to ensure NIS2 compliance
Download it now for free!
Has the NIS2 Directive been implemented in my country yet?
While the NIS2 Directive set a clear deadline of 17 October 2024 for national transposition, implementation progress has varied significantly across the EU and EEA.
The whitepaper below offers a practical, country-by-country overview of where things stand as of mid-2025.
Does the national law in my country lay down the same requirements?
Download the whitepaper to find out what national laws require, how obligations differ, and what industrial companies must do to comply.
NIS2 implementation progress across Europe
Download it now for free!
Frequently asked questions (FAQ)
What are the 3 key areas of NIS2 compliance?
NIS2 compliance spans three focus areas:
Management responsibility, training, and liability
Cybersecurity risk management (Article 21)
Incident reporting and response
What are management’s responsibilities under NIS2?
Leadership plays a central role in cybersecurity under NIS2. Companies often lack resources, and executives may underestimate cyber risk. But under NIS2, cybersecurity is a legal obligation – not a nice-to-have.
Management must:
Approve and oversee cybersecurity risk management
Complete regular cybersecurity training
Provide staff with ongoing training and awareness
Allocate adequate budget for compliance
Build a security-first culture
What are the consequences of non-compliance for management?
If competent authorities find compliance failures, they can:
Temporarily suspend certifications
Temporarily remove the CEO or legal representative from their role
Hold senior managers personally liable
Cybersecurity isn’t just IT’s responsibility – it’s a leadership issue.
Can executives be held liable under NIS2?
Yes. CEOs and managers can be suspended or held personally responsible if they fail to ensure NIS2 compliance.
What does Article 21 require?
You must implement technical, operational, and organizational measures that are:
Appropriate – aligned with risk level and current standards
Proportionate – scaled to your company’s size and risk exposure
Your approach should follow an all-hazards risk model, covering every conceivable cyber threat.
What types of measures must be implemented?
Technical measures
Secure remote access (e.g. MFA, encryption)
Firewalls, monitoring systems, endpoint protection
Operational measures
Risk assessment procedures
Incident response and crisis management
Backup and recovery plans
Organizational measures
Cybersecurity policies
Regular staff training
Defined roles and responsibilities
What are the 10 minimum elements you must cover?
You must be able to demonstrate compliance in all 10 areas listed in Article 21:
Risk analysis and information system security policies
Incident handling plans
Business continuity and disaster recovery
Supply chain risk management
Security in system development and maintenance
Regular evaluation of cybersecurity measures
Basic cyber hygiene and employee training
Use of cryptography and encryption
Access control, asset management, HR security
MFA, secured comms, and emergency comms systems
Secomea’s platform helps address many of these areas – particularly technical controls, access governance, and audit readiness.
What types of incidents must be reported?
You must report any incident that significantly impacts your service or users, including:
Operational disruption
Financial loss
Material or non-material damage to others
Who do you report to?
Your national CSIRT (Computer Security Incident Response Team)
Other competent authorities, if applicable
Affected customers, if services are disrupted
What’s the reporting timeline?
Within 24 hours – Early warning (basic info + whether incident is malicious)
Within 72 hours – Incident notification (severity + impact)
Upon request – Intermediate updates
Within 1 month – Final report, including:
Incident description, impact, and root cause
Mitigation actions
Cross-border effects (if any)
CSIRTs will respond within 24 hours and may provide technical support or guidance.
Do the NIS2 requirements vary in the different EU/EEA countries?
While registration deadlines vary, most countries require in-scope entities to register with authorities between Q3 and Q4 2025.
Incident notification obligations often follow the NIS2-standard model: initial notification within 24 hours of becoming aware of an incident, followed by updates and a final report within 72 hours or as information becomes available.
Some countries, such as Poland and Malta, are introducing executive liability, enhanced audit rights, or corrective enforcement powers that exceed the Directive’s minimum requirements.
Some Member States also introduced mandatory internal or third-party cybersecurity audits on a regular basis (e.g., Poland requires biennial audits, Belgium introduced ISO-aligned self-assessments).
Have a look at our whitepaper to learn more about local peculiarities and what the NIS2 rules look like in your country.
