NIS2 raised the bar for cyber risk management across eighteen sectors in the EU, and made management personally accountable for it. It does not apply in the UK, which has its own regime, and the difference matters if you operate in both.
What is NIS2?
NIS2, Directive (EU) 2022/2555, replaced the original NIS Directive and widened its reach to eighteen sectors, splitting in-scope organisations into essential and important entities. Member states were required to transpose it into national law by 17 October 2024.
Because it is a directive rather than a regulation, your obligations sit in the implementing law of each member state you operate in, and those differ. Two things are consistent everywhere: management bodies must approve and oversee the risk measures, with personal liability available to regulators, and significant incidents carry a 24-hour early warning followed by a 72-hour notification.
NIS2 has no effect in the UK. The UK regime remains the NIS Regulations 2018, assessed through the NCSC Cyber Assessment Framework, and the Cyber Security and Resilience Bill is currently before Parliament to update it. The Bill is broadly aligned with NIS2 in ambition but differs in detail, so a group operating in both places needs to satisfy two regimes rather than one.
Compliance requirements
The obligations below are common across member states. The detail of how each is implemented is set by national law, so the member state you operate in changes the specifics.
Management bodies must approve the cyber risk measures, oversee implementation, and undergo training. Member state law can hold managers personally liable, which is the change that moved this up the board agenda.
A defined baseline covering risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and multi-factor authentication.
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.
Security considered across the direct supplier relationship, including the quality of suppliers own practices, not only your contract with them.
In-scope entities register with their national authority. Essential entities face proactive supervision, important entities face supervision after the fact.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We establish whether NIS2 reaches you at all, which member states law applies, and whether you are an essential or an important entity. For UK-headquartered groups this is usually the whole question.
We assess your current position against the risk management measures required by the relevant implementing law, which differs between member states.
We put the management body approval, oversight and training obligations in place, and document them, because personal liability makes evidence matter here.
Your compliance manager implements the required measures across risk analysis, continuity, supply chain, cryptography and access control.
We build the detection and escalation path that makes a 24-hour early warning achievable, then test it. Most organisations fail this on discovery time, not on reporting.
We complete registration with the national authority and support you through supervisory engagement.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone