Directive 2022/2555: risk-management and incident duties have applied since 18 October 2024. The Commission’s first review is due by 17 October 2027.
Directive (EU) 2022/2555 — NIS2 — sets a higher common level of cybersecurity across the Union. Member States were due to transpose it by 17 October 2024. National implementation remains uneven, but the obligations for essential and important entities are no longer a future project.
Covered organisations sit in critical and important sectors under Annexes I and II — energy, transport, banking, health, digital infrastructure, manufacturing, food and others — generally once they meet size thresholds, with some digital and trust services in scope regardless of size. Essential entities face more intensive supervision; important entities are still in scope for the same core duties.
The 24-hour clock
Management bodies must approve cybersecurity risk-management measures, oversee them, and can be held liable for infringements. Article 21 requires appropriate and proportionate technical, operational and organisational measures on an all-hazards basis: risk analysis, incident handling, business continuity, supply-chain security, vulnerability handling, cryptography, human-resource security and authentication among them.
Supply-chain security is explicit. Entities must take account of vulnerabilities in direct suppliers and service providers, and of the quality of those suppliers’ cybersecurity practices — including secure development. A control framework that stops at the organisation’s own perimeter is incomplete.
Significant incidents have a clock. An early warning is due within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Recipients of the service may also need to be informed. Those timelines only work if assets, contacts, evidence and decision rights already exist.
Where it breaks
- Inventory: which assets, services and controls are in scope, and which suppliers sit on the critical path.
- Evidence: policies, tests, exceptions and supplier assessments that can be shown to a supervisor — not documents that exist only as intent.
- Incident: who detects, who decides, who notifies the CSIRT or competent authority, and how the trail from early warning to final report is kept.
What we build
Asset and control inventory, evidence a supervisor can see, supplier risk in the same picture as internal measures, and an incident path that can notify within 24 hours.
Primary text
This field note is general information, not legal advice. Whether an organisation is essential or important, and how national supervisors apply the rules, should be checked in the law applicable to each entity.