Who it applies to
NIS2 is the EU directive on cybersecurity for essential and important entities: medium and large organisations in sectors such as energy, transport, banking, health, digital infrastructure, manufacturing and many more, and some smaller ones regardless of size. Each member state writes it into national law, so the exact obligations and the supervising authority depend on your country.
The core of the directive is Article 21: appropriate and proportionate technical, operational and organisational measures to manage the risks to your network and information systems. "Appropriate" depends on your size, your exposure and the impact an incident would have.
The ten measures
| Measure | What it asks for | Attack surface view |
|---|---|---|
| 21(2)(a) Risk analysis and security policies | Know your risks and write down how you handle them. | Supports |
| 21(2)(b) Incident handling | Detect, analyse, contain and recover from incidents. | Your processes |
| 21(2)(c) Business continuity | Backups, disaster recovery and crisis management. | Your processes |
| 21(2)(d) Supply chain security | The security of your direct suppliers and service providers. | Your processes |
| 21(2)(e) Secure acquisition, development and maintenance | Including vulnerability handling and disclosure. | Supports |
| 21(2)(f) Assessing effectiveness | Check that the measures actually work. | Supports |
| 21(2)(g) Cyber hygiene and training | Basic practices, and training for all staff. | Your processes |
| 21(2)(h) Cryptography | Policies on cryptography and, where appropriate, encryption. | Supports |
| 21(2)(i) HR security, access control and asset management | Who has access to what, and what you have. | Supports |
| 21(2)(j) Multi-factor authentication and secured communication | Including secured emergency communication. | Your processes |
An attack surface platform supports five of the ten with evidence: the inventory, the vulnerabilities, the cryptography checks and the proof that you check regularly. The other five are organisational. No tool makes you compliant on its own.
Reporting incidents: Article 23
Significant incidents must be reported to the national authority or CSIRT in stages:
- Within 24 hours: an early warning.
- Within 72 hours: an incident notification with a first assessment.
- Within one month: a final report.
Write the procedure down before you need it: who decides whether an incident is significant, who reports, and to whom.
Management is accountable: Article 20
The management body must approve the measures, oversee how they are put in place and can be held liable when they are not. Its members must also follow training. Reports that management can read and sign off matter as much as the technical work.