NIS2 Directive

From NIS1 to NIS2: What Changed?

The original NIS Directive (2016) was the EU's first cybersecurity legislation. While groundbreaking, it suffered from inconsistent implementation across member states, a narrow scope, and weak enforcement. NIS2 addresses all of these:

• Scope expansion: From ~7 sectors to 18 sectors, covering an estimated 160,000+ entities across the EU.
• Harmonized rules: Minimum requirements are now uniform, eliminating the "race to the bottom" between member states.
• Stronger enforcement: GDPR-style fines and personal liability for management bodies.
• Supply chain focus: Organizations must assess and manage cybersecurity risks in their supply chain.
• Incident reporting: Strict 24h/72h notification timelines to national CSIRTs.

Who Is In Scope?

NIS2 categorizes entities into two tiers, each with different oversight regimes:

Essential Entities (Stricter Oversight)

Important Entities (Lighter Oversight)

• Postal and courier services
• Waste management
• Chemicals manufacturing and distribution
• Food production and distribution
• Manufacturing (medical devices, electronics, machinery, vehicles)
• Digital providers (online marketplaces, search engines, social platforms)
• Research organizations

Size threshold: Generally applies to medium-sized entities (50+ employees or €10M+ annual turnover). However, certain entities like DNS providers, TLD registries, and trust service providers are in scope regardless of size.

Core Requirements (Article 21)

NIS2 mandates an "all-hazards approach" to cybersecurity risk management. The minimum measures include:

1. Risk analysis and information system security policies
2. Incident handling — detection, response, and recovery
3. Business continuity — backup management, disaster recovery, crisis management
4. Supply chain security — assessing suppliers' cybersecurity posture
5. Security in network and information systems acquisition, development, and maintenance — including vulnerability handling and disclosure
6. Policies for assessing cybersecurity risk-management effectiveness
7. Cybersecurity hygiene and training
8. Cryptography and encryption policies
9. Human resources security — access control and asset management
10. Multi-factor authentication (MFA) — and secured communications

Incident Reporting Timeline

Penalties & Personal Liability

Critically, NIS2 introduces personal liability for management. Board members and C-level executives can be held responsible for non-compliance, including temporary bans from exercising managerial functions.

NIS2 vs. DORA: Understanding the Relationship

DORA is the EU's sector-specific regulation for financial services. NIS2 is the horizontal framework covering all critical sectors. The key relationship:

• DORA is lex specialis — it takes precedence for financial entities where it provides more specific rules.
• NIS2 still applies where DORA does not cover specific aspects (e.g., supply chain requirements beyond ICT third parties).
• Both share similar principles: risk-based approach, incident reporting, and regulator cooperation.

Compliance Roadmap

1. Scope Assessment: Determine if your organization qualifies as Essential or Important.
2. Gap Analysis: Map current security posture against the 10 minimum measures in Article 21.
3. Supply Chain Audit: Evaluate cybersecurity practices of critical suppliers and ICT service providers.
4. Incident Response Plan: Ensure capability to meet 24h/72h reporting deadlines.
5. Board Training: Management must approve and oversee cybersecurity measures—and receive training.
6. Continuous Monitoring: Implement ongoing risk assessment and vulnerability management.

Alterra's Perspective

NIS2 is not just a compliance checkbox—it's a fundamental shift in how European organizations approach cybersecurity governance. At Alterra Solutions, we help entities navigate the intersection of NIS2 compliance with existing frameworks like NIST 800-53 and Zero Trust Architecture, ensuring that compliance investments also deliver genuine security improvements.