Step 1: Open your ICT provider register. If you don't have one, that's your first problem. The NIS2 directive demands comprehensive tracking and oversight of third-party providers. Ignoring this requirement can lead to severe consequences. The NIS2 directive, or Network and Information Systems 2, is the EU's latest attempt to strengthen the cybersecurity resilience of its member states, particularly in critical sectors like financial services. If you're a compliance professional, CISO, or IT leader at a European financial institution, this matters to you. Failure to comply can result in fines of up to EUR 10 million or 2% of total worldwide annual turnover, audit failures, operational disruption, and severe reputational damage.
The NIS2 directive is not just another regulation to check off a list. It represents a fundamental shift in how the EU approaches cybersecurity. By reading this article, you'll gain a deep understanding of what NIS2 means for your organization, who it affects, and what concrete steps you can take to ensure compliance.
The Core Problem
Many organizations mistakenly view the NIS2 directive as a mere cybersecurity standard. In reality, it's much more. NIS2 has far-reaching implications for any organization operating within the EU, particularly those in the financial services sector.
Consider the numbers: An essential entity can face fines of up to at least 10 million EUR or 2% of total worldwide annual turnover, whichever is higher. For a financial institution with a turnover of 1 billion EUR, that's 20 million EUR in potential fines. That's real money. And that's just the financial cost. The operational disruption and reputational damage caused by non-compliance can be even more devastating.
Most organizations are also getting the scope of NIS2 wrong. They're focusing on the cybersecurity aspects, when in reality, NIS2 has a much broader scope. For example, per Article 21(1) of the NIS2 directive, entities in scope must take appropriate technical, operational and organisational measures to manage risks to their network and information systems and to prevent or minimise the impact of incidents. For banks and other financial entities, DORA applies as the sector-specific act where its rules are equivalent (Article 4 NIS2).
This means organizations need to have robust incident response plans in place. They also need to have processes for identifying, assessing, and managing risks to network and information security. Many organizations are failing to implement these requirements, leaving them exposed to NIS2-related risks.
Why This Is Urgent Now
The urgency of compliance with the NIS2 directive is only increasing. Article 34 of NIS2 sets maximum administrative fines for essential and important entities. Member states fix the actual amounts in their own national law, so your exposure depends on where you operate. The transposition deadline was 17 October 2024, and national regimes are now taking effect one by one. Supervision and penalties sit with the national competent authorities, not with the European Commission.
Moreover, customers are increasingly demanding cybersecurity certifications. Security has become part of how buyers judge a supplier. Non-compliance with NIS2 not only exposes your organization to regulatory risks but also puts you at a competitive disadvantage.
The gap between where most organizations are and where they need to be is significant. Third-party risk management is still thin at many financial institutions. This despite the fact that Article 21(2)(d) of the NIS2 directive requires supply chain security, including the security of relations with direct suppliers and service providers.
In the face of increasing regulatory scrutiny and market pressure, organizations can no longer afford to delay their NIS2 compliance efforts. The consequences of non-compliance are simply too severe. The good news is that by taking proactive steps today, you can position your organization for success under the NIS2 directive.
The Solution Framework
To effectively navigate the NIS2 landscape, establishing a structured, risk-based approach is essential. This framework acts as a map for organizations to identify and manage the cybersecurity risks they face due to NIS2.
Step 1: Identify Key Assets
Start by identifying the critical digital services your organization provides and the assets that support these services. Asset management is one of the measures in Article 21(2)(i) of NIS2, so you must have a clear understanding of your services' architecture and the assets involved. This involves cataloging all hardware, software, and data that could be affected by a cybersecurity incident.
Step 2: Conduct Risk Assessments
Under NIS2, risk analysis is a core measure (Article 21(2)(a)). Use these assessments to identify potential cybersecurity threats and vulnerabilities. The goal is to understand the likelihood and potential impact of various incidents. Use both quantitative and qualitative analyses to assess risk, and consider the dependencies and interconnections between different assets and services.
Step 3: Establish and Implement Security Measures
NIS2 (Article 21) requires organizations to implement proportionate measures that take the state of the art into account. This involves developing and implementing security policies, procedures, and controls that will effectively manage the identified risks. Ensure these measures align with industry best practices and are adaptable to evolving threats.
Step 4: Incident Reporting and Management
NIS2 demands mandatory incident reporting (Article 23). Develop robust incident management processes that include timely detection, response, and reporting mechanisms. This includes having clear communication channels with relevant authorities and stakeholders.
Step 5: Continuous Monitoring and Improvement
NIS2 requires you to assess the effectiveness of your measures (Article 21(2)(f)). Regularly review and update your cybersecurity measures, risk assessments, and incident response plans. This ongoing process helps ensure that your organization remains compliant and resilient in the face of changing threats.
Common Mistakes to Avoid
Underestimating Asset Identification: Some organizations underestimate the breadth of assets they must protect under NIS2. They might overlook third-party services or fail to consider interdependencies between systems. This mistake can leave gaps in your security posture. Instead, conduct comprehensive asset identification that includes all digital services, assets, and their interconnections.
Inadequate Risk Assessments: A common error is performing risk assessments that are too generic or superficial. This can result in an incomplete understanding of the organization’s exposure to cybersecurity threats. Instead, perform detailed, asset-specific risk assessments that consider the unique vulnerabilities and potential impacts of each asset.
Lack of Incident Response Preparedness: Some organizations fail to establish clear incident response plans or neglect to train staff in the execution of these plans. This can lead to delayed or ineffective incident management. Develop and regularly update incident response plans, and ensure that all relevant personnel are trained in their execution.
Neglecting Continuous Improvement: Finally, some organizations view NIS2 compliance as a one-time task rather than an ongoing process. This can result in compliance gaps over time. Instead, commit to continuous monitoring and improvement of your cybersecurity measures, ensuring that your organization remains resilient against evolving threats.
Tools and Approaches
Manual Approach
- Pros: It can be cost-effective and allows for a high degree of customization. It also encourages a deep understanding of the organization’s specific risks and assets.
- Cons: It is time-consuming and prone to human error. It also struggles to keep pace with the dynamic nature of cybersecurity threats.
- When It Works: It can be effective for small organizations with limited assets and a simple digital service architecture.
Spreadsheet/GRC Approach
- Limitations: While this approach can help manage documentation and tracking of compliance efforts, it often lacks the ability to automate processes or integrate with other systems. This can result in inefficiencies and delays in identifying and addressing compliance issues.
- When It Works: It can be suitable for medium-sized organizations that have some cybersecurity processes in place but require a structured way to document and track compliance efforts.
- What to Look For: Look for platforms that support risk assessments, incident reporting, and continuous monitoring. They should also integrate with other systems and be customizable to meet the specific needs of your organization.
- When It Helps: Automation can significantly reduce the workload and increase the accuracy of compliance efforts, especially for larger organizations with complex digital service architectures and numerous assets.
- When It Doesn’t: While automation can streamline many compliance tasks, it cannot replace the need for human judgment and expertise in areas such as risk assessment and incident response.
Matproof Mention
Matproof, a compliance automation platform specifically built for EU financial services, can support organizations in their NIS2 compliance journey. It offers AI-powered policy generation, automated evidence collection from cloud providers, and an endpoint compliance agent for device monitoring—all while ensuring EU data residency. This can help organizations efficiently manage their compliance efforts, from risk assessments to incident reporting and beyond. Visit Matproof to explore how it can streamline your NIS2 compliance process.
Getting Started: Your Next Steps
To ensure you are compliant with the NIS2 directive, follow these five steps this week:
Review the NIS2 directive: Start with the official source, Directive (EU) 2022/2555 as published in the Official Journal. Review it to understand the scope and requirements that apply to your organization.
Action: Visit the European Commission's NIS2 page to download the NIS2 directive.
Assess your current cybersecurity posture: Identify gaps between your current practices and NIS2 requirements. Review your incident management, risk assessment, and reporting procedures.
Action: Conduct a quick audit of your security policies and incident response plan.
Engage with your IT and security teams: Discuss the NIS2 directive’s implications and collaborate on a strategic plan to address the requirements.
Action: Schedule a meeting with your IT and security teams to discuss NIS2 compliance.
Determine the need for external expertise: Consider whether you need external help or if your in-house team can manage the compliance efforts.
Action: Evaluate your team’s bandwidth and expertise. If gaps exist, explore hiring a consultant or compliance automation platform.
Quick win: Implement an endpoint compliance agent: A simple, immediate step is deploying an endpoint compliance agent to monitor devices and ensure they meet security requirements.
Action: Start with a free assessment from Matproof, which offers an endpoint compliance agent and can help automate compliance.
Frequently Asked Questions
Q1: What are the reporting obligations under NIS2?
Under Article 23 of NIS2, essential and important entities must report significant incidents. An incident is significant if it causes or can cause severe operational disruption or financial loss, or considerable damage to others. Send an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
Action: Review the NIS2 requirements to understand the specific reporting obligations.
Q2: How will NIS2 impact incident response planning?
NIS2 intensifies the focus on incident response. Companies will need to ensure they have robust incident response plans that align with the directive’s requirements. This includes having clear procedures for identifying, containing, and mitigating incidents, as well as communicating them to the relevant authorities within the specified timeframe.
Action: Update your incident response plan to align with NIS2 requirements, specifically the 24-hour early warning, the 72-hour notification and the one-month final report.
Q3: What are the penalties for non-compliance with NIS2?
Non-compliance with NIS2 can result in significant penalties. Article 34 sets maximum fines of at least €10 million or 2% of total worldwide annual turnover for essential entities, whichever is higher. For important entities, the maximum is at least €7 million or 1.4%. Additionally, repeated violations may lead to periodic penalty payments.
Action: Review the penalties outlined in the NIS2 directive to understand the risks of non-compliance.
Q4: How does NIS2 affect cloud service providers?
Cloud service providers are considered critical digital infrastructure under NIS2. They must apply the measures in Article 21 and report significant incidents under Article 23, starting with an early warning within 24 hours. Commission Implementing Regulation (EU) 2024/2690 sets more detailed technical requirements for them. Under Article 27, they must also register with the member state of their main establishment.
Action: Cloud service providers should review Articles 21, 23 and 27 of the NIS2 directive.
Q5: Is our organization considered an essential service under NIS2?
NIS2 does not use the term "essential service" any more. It applies to essential and important entities in the sectors listed in Annex I (high criticality, such as energy, transport, banking, health and digital infrastructure) and Annex II (other critical sectors, such as manufacturing and food). Article 2 sets the size thresholds, and Article 3 decides if you are essential or important.
Action: Review Annexes I and II of the NIS2 directive to determine if your organization is in scope.
Key Takeaways
- The NIS2 directive significantly expands the scope of cybersecurity requirements to essential and important entities in 18 sectors.
- Compliance will require a comprehensive review of your organization’s cybersecurity practices, incident response planning, and reporting procedures.
- The penalties for non-compliance are severe, with potential fines up to EUR 10 million or 2% of total worldwide annual turnover for essential entities.
- Matproof can help automate compliance with NIS2 and other regulations. Visit Matproof for a free assessment and to start your compliance journey.
Frequently Asked Questions
Q: Who is subject to NIS2 compliance requirements?
A: NIS2 applies to two categories of entities in 18 critical sectors. "Essential entities" include operators in energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space — organizations with 250+ employees or EUR 50M+ revenue. "Important entities" cover postal and courier services, waste management, chemicals, food, manufacturing, digital providers (online marketplaces, search engines, social networks), and research — organizations with 50-249 employees or EUR 10-49M revenue. Member states may extend scope further, and organizations in the EU supply chain of affected entities may be indirectly required to comply.
Q: What are NIS2's key cybersecurity requirements?
A: NIS2 requires organizations to implement 10 minimum cybersecurity measures under Art. 21: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; network and information system security in procurement; policies to assess ICT risk management effectiveness; cybersecurity training; cryptography and encryption use; human resources security and access control; and multi-factor authentication. These must be proportionate to the organization's risk exposure and implemented regardless of whether a breach occurs.
Q: What are the NIS2 incident reporting deadlines?
A: NIS2 Art. 23 establishes a three-stage notification obligation: (1) Early warning within 24 hours of becoming aware of a significant incident; (2) Incident notification with initial assessment within 72 hours; (3) Final report within one month. "Significant incidents" are those causing or capable of causing severe operational disruption, financial loss, or reputational damage. Reporting must go to the national CSIRT and, where relevant, competent authority. Cross-border incidents affecting multiple member states require coordination through ENISA.
Q: What are the fines for NIS2 non-compliance?
A: NIS2 Art. 34 sets maximum fines of EUR 10 million or 2% of global annual turnover for essential entities (whichever is higher), and EUR 7 million or 1.4% of global turnover for important entities. Member states may impose additional penalties beyond these minimums. Unlike GDPR, NIS2 also enables temporary bans on individuals in management roles at essential entities from exercising managerial functions when non-compliance results from a serious breach. National competent authorities can also publish the identity of violating entities.
Q: How does NIS2 differ from NIS1?
A: NIS2 significantly expands NIS1 in three ways: scope (NIS1 covered 7 sectors; NIS2 covers 18 and adds "important entities" category), obligations (NIS2's 10-measure security baseline is more prescriptive than NIS1's risk-based approach), and enforcement (NIS2 harmonizes penalties across member states and adds personal liability for management). NIS2 also explicitly requires supply chain security assessments, something NIS1 did not address. National transposition was due October 17, 2024; most EU member states have transposed or are in the process of transposing into national law.
Related reading
Ready to act on this? Matproof runs continuous AI penetration testing and compliance monitoring. Start the 14-day trial.