Does NIS 2 apply to you?
NIS 2 is the European Directive (EU) 2022/2555 on the security of network and information systems.
Three questions are enough for a first check:
- Is your sector listed in the annexes of the Directive? Annex I lists sectors of high criticality: energy, transport, health, banking, digital infrastructure, managed ICT services. Annex II adds, among others, manufacturing, chemicals, food and digital providers.
- Are you at least a medium-sized company? As a general rule, the Directive covers entities with 50 or more employees, or whose turnover and balance sheet exceed the European thresholds. Some activities are covered regardless of size.
- Are your customers in scope themselves? The Directive requires them to secure their supply chain. So they pass requirements on to their suppliers and subcontractors, by contract.
Entities in scope fall into two categories. Essential entities, often the largest in Annex I sectors, face stricter supervision. Important entities are mostly supervised after the fact, for example following an incident.
In France, the authority in charge of NIS 2 is ANSSI, France's national cybersecurity agency.
Not sure about your status?
Get your company assessed in 30 minutesNIS 2 explained: what the Directive actually requires
NIS 2 does not impose a specific tool. It imposes outcomes: control your cyber risks, respond fast to incidents, and be able to prove it.
NIS 2 obligations fall into three blocks.
1. Cybersecurity risk-management measures (Article 21). The Directive lists ten areas, to be covered in proportion to your risks:
- Risk analysis and information system security policies.
- Incident handling.
- Business continuity: backups, disaster recovery, crisis management.
- Supply chain security, including your suppliers.
- Security in system development and maintenance, including vulnerability handling.
- Assessment of the effectiveness of the measures.
- Cyber hygiene and cybersecurity training.
- Cryptography and encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication and secured communications.
2. Incident reporting (Article 23). A significant incident must be reported to the authority in three steps. An early warning within 24 hours. An incident notification within 72 hours. A final report within one month.
3. Management accountability (Article 20). Management bodies approve the measures and oversee their implementation. They can be held liable for infringements. They must also follow training.
What NIS 2 is not:
- Not a certification. There is no "NIS 2 certificate". It is a regulatory obligation, supervised by the authority.
- Not a topic for the technical team alone. Management is personally involved.
NIS 2 fines can reach 10 million euros or 2% of worldwide turnover for an essential entity. For an important entity, the cap is 7 million euros or 1.4% of worldwide turnover.
How long does NIS 2 compliance take?
It depends on your starting point.
The work means closing the gaps with Article 21, writing the reporting procedure, training management, collecting the evidence. ouwba supports you, ANSSI supervises.
Why so many projects slip:
- The company's status is never settled.
- The Directive is read as a legal text, not as an action plan.
- Suppliers are forgotten, although the Directive targets the supply chain.
- The incident reporting procedure is never tested.
NIS 2, ISO 27001, SOC 2, HDS: which one do you need?
NIS 2 is an obligation. The other frameworks are ways to prove your security level.
- NIS 2 applies to you and you want to prove it: NIS 2 and ISO 27001 go hand in hand. An ISO 27001 Information Security Management System (ISMS) covers a large part of Article 21. See our ISO 27001 certification support.
- Your customers are American: they often ask for a SOC 2 (System and Organization Controls 2) report. Discover our SOC 2 support.
- You host health data on behalf of third parties: HDS certification (health data hosting) is mandatory in France. See our HDS certification support.
Torn between NIS 2 alone and ISO 27001?
Ask an expertYour questions about NIS 2 compliance
Is my company in scope of NIS 2?
Check two criteria. Your activity must belong to a sector listed in Annex I or II of the Directive: energy, transport, health, digital infrastructure, manufacturing, food, among others. As a general rule, your company must have at least 50 employees or exceed the European turnover and balance sheet thresholds. Some activities are covered regardless of size. The ouwba assessment settles the question with you.
What is the difference between an essential and an important entity?
Essential entities are often the largest companies in the sectors of high criticality listed in Annex I, plus some activities covered regardless of size. They face stricter supervision, including checks before any incident. Important entities are mostly supervised after the fact, for example following an incident. The required security measures are similar. The maximum fines differ.
Is there a NIS 2 certification?
No. NIS 2 is a regulatory obligation, not a certification standard. No body issues a "NIS 2 certificate". Compliance is supervised by the national authority, ANSSI in France. To prove your security level to customers, ISO 27001 certification remains the recognised reference. It covers a large part of the measures required by Article 21 of the Directive.
What are the fines for non-compliance?
Fines can reach 10 million euros or 2% of worldwide turnover for an essential entity. For an important entity, the cap is 7 million euros or 1.4% of worldwide turnover. The higher of the two amounts applies. The Directive also provides for measures targeting management, who can be held liable for infringements.
What must we do when an incident happens?
A significant incident must be reported to the authority in three steps. An early warning within 24 hours. A fuller incident notification within 72 hours. A final report within one month. These deadlines are short. They require a written procedure, named owners and a test exercise. ouwba writes this procedure with you.
How do NIS 2 and ISO 27001 relate?
ISO 27001 is an international standard for information security management. Its controls largely overlap with the ten areas of Article 21 of NIS 2. A company certified ISO 27001 has therefore already covered much of the ground. What remains is mostly incident reporting, management training and the points specific to its sector.
I supply an entity in scope: what should I do?
Even if you are not directly covered, your customers must secure their supply chain. So they pass requirements on to you by contract: questionnaires, security clauses, evidence to provide, sometimes an ISO 27001 certification. The right move is to structure your security once, then reuse the same evidence for all your customers in scope. ouwba helps you build this common foundation.
Are company leaders personally liable?
Yes, the Directive involves them directly. Under Article 20, management bodies approve the cybersecurity risk-management measures and oversee their implementation. They can be held liable for infringements. They must also follow cybersecurity training. NIS 2 compliance therefore cannot be fully delegated to the technical team. The evidence file must show their involvement.
How long does it take to become compliant?
It all depends on your starting point. A company already certified ISO 27001 moves much faster than one without a formal framework. With ouwba, count on a few weeks, depending on scope and your teams' availability. Your status, on the other hand, is assessed in the very first conversation with an expert.
Where do I start?
Start by assessing your situation. Are you an essential entity, an important entity, a supplier to an entity in scope, or out of scope? The ouwba assessment answers this question in 30 minutes with an expert. You leave with your likely status, your priorities and a first estimate of the timeline. You will also know which customers are likely to ask you for evidence.