Nexuldra
// security
NIS2
NIS2 — Directive (EU) 2022/2555 — is the EU's cybersecurity law, replacing the 2016 NIS directive. It obliges medium and large companies in 18 sectors, split between "essential" and "important" entities, to manage cyber risk, report incidents on a strict clock and secure their supply chains. The transposition deadline was October 2024; enforcement is rolling out through 2025 and 2026.
It matters because it moves cybersecurity from policy to management accountability: executives can be held personally liable, and repeated violations can bring temporary bans from managerial roles. Incident reporting runs on a strict clock — an early warning within 24 hours, a fuller notification within 72 hours, and a final report within a month. Fines reach up to €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher; important entities face up to €7 million or 1.4%.
For small suppliers the practical effect arrives through contracts. NIS2 requires in-scope companies to assess and control the security of their suppliers, so a small software or cloud provider selling to an essential entity will meet security questionnaires, encryption and MFA demands, and audit rights it never faced before. Some provider types — managed service providers among them — are covered regardless of size. The sensible preparation is boring: MFA everywhere, patched systems, tested backups, and incident contacts that work out of hours.
Frequently asked questions
- Does NIS2 apply to small companies?
- The general rule covers medium and large companies in the 18 sectors, but with exceptions: some provider types — managed service providers, certain DNS and cloud services — are covered regardless of size. And even a small supplier outside scope feels NIS2 through contractual security demands flowing down from in-scope customers.
- What happens if we miss the reporting deadlines?
- Expect administrative fines on the order of up to €10 million or 2% of worldwide turnover for essential entities — €7 million or 1.4% for important ones — plus potential management liability. Exact amounts are set by national laws transposing the directive, which are still landing at different speeds across member states.