NIS2 is the European cybersecurity directive designed to ensure a high common level of security across the Union. It significantly expands its scope compared to the original NIS, now applying to ‘essential’ and ‘important’ entities in critical sectors such as energy, transport, banking, health, water, digital infrastructure, waste management, and, very importantly, to their supply chains.

EU Member States have until October 17, 2024, to transpose the directive into their national legislation, at which point the new obligations will be formally applicable to organizations.

Unlike previous regulations, NIS2 places strict focus on indirect risk. It requires companies to proactively assess and manage the cybersecurity risks of their direct vendors and technology service providers, making continuous monitoring and third-party auditing mandatory.

The directive establishes a tiered and very strict approach: it requires issuing an early warning to authorities within 24 hours of becoming aware of a serious incident, a formal incident notification within 72 hours, and a detailed final report within a maximum period of one month.

Absolutely. If your organization already complies with ISO 27001 or the National Security Framework (ENS), you have already made significant progress. GlobalSuite® allows you to map security controls across frameworks, so that the evidence you upload for one regulation (e.g., ENS) automatically serves to justify the corresponding requirements mandated by NIS2, avoiding duplicate work.