NIS2 Directive: Complete Guide 2024-2025
Everything you need to know about the new European cybersecurity regulation: obligations, affected sectors, penalties, and deadlines.
The NIS2 Directive (Network and Information Security 2) is European legislation that came into force on January 16, 2023. It replaces and strengthens the original NIS Directive from 2016, which was the first pan-European cybersecurity legislation.
NIS2 aims to establish a common high level of cybersecurity across the European Union. It imposes stricter cybersecurity risk management measures and incident notification obligations on essential and important entities.
EU Member States were required to transpose this directive into their national legislation by October 17, 2024. Affected organizations must comply with the new requirements or face significant financial penalties.
- Harmonize cybersecurity requirements across all EU Member States
- Expand scope to more sectors and entities (from 7 to 18 sectors)
- Strengthen security requirements with 10 mandatory minimum measures
- Improve cooperation between Member States through cooperation groups
- Introduce stricter incident notification obligations (24h/72h)
- Establish a dissuasive sanctions regime up to €10M or 2% of global turnover