What is NIS-2?

NIS-2 is an EU-wide directive aimed at strengthening the cybersecurity and digital resilience of organizations. It builds on the previous NIS Directive and addresses the sharp rise in cyber threats, IT outages, and the growing digital dependence of businesses and public institutions.

The goal of NIS-2 is to establish a uniformly high level of security for network and information systems throughout Europe. To this end, the directive significantly expands both the scope of affected organizations and the requirements for cybersecurity, governance, and oversight.

It is no longer just traditional critical infrastructures that are affected. NIS-2 also applies to many medium-sized and large companies in sectors such as IT services, digital services, manufacturing, energy, healthcare, transportation, government, and research. The decisive factor here is not whether a company classifies itself as “critical,” but whether it meets the defined criteria regarding size, industry, and role.

Among other things, NIS-2 focuses on:

• systematic cyber risk management,
• clear lines of responsibility at the management level,
• Measures for the prevention, detection, and handling of security incidents,
• as well as mandatory reporting and documentation requirements vis-à-vis government agencies.

Since when has NIS-2 been mandatory?

The NIS 2 Directive has been in effect at the EU level since January 2023. However, it will become binding for companies once it is implemented at the national level in the individual EU member states.

The EU has set a clear deadline for this:
All member states were required to transpose NIS-2 into national law by October 17, 2024, at the latest.
As of that date, NIS-2 will be mandatory for all affected organizations—depending on the respective national implementing legislation.

It is important to note:
NIS-2 is not a future requirement. There is no “grace period.” Once the national law takes effect, companies must be able to demonstrate that they meet the directive’s requirements.

Why NIS-2 Is More Than Just an IT Issue

NIS-2 makes cybersecurity a management responsibility. Senior management bears explicit responsibility for compliance with the directive. Security measures can no longer be delegated exclusively to the IT department. Violations are subject to severe penalties, which may also affect management.

In addition, NIS-2 requires that cybersecurity be implemented in a verifiable and traceable manner. Organizations must be able to demonstrate that risks are assessed, measures are defined, and incidents are handled in a structured manner. Individual technical solutions are not sufficient to meet these requirements.

Another key issue is the requirement to report security incidents. Certain incidents must be reported within clearly defined time frames. This requires established processes, clear responsibilities, and a shared understanding—long before an incident occurs.

Supply chains and external service providers are also coming under greater scrutiny. NIS-2 requires that dependencies be assessed and security risks along the entire value chain be taken into account. Cybersecurity, therefore, does not end at an organization’s own boundaries.

In short:
NIS-2 is not purely an IT project; it also affects organization, processes, governance, and leadership. Those who prepare early can prioritize in a structured manner, reduce risks, and avoid unnecessary time and cost pressures.

From the Directive to Understanding: NIS-2 Foundation

To properly understand NIS-2 and make informed decisions, a solid basic understanding of the directive is essential. This is exactly where the NIS-2 Foundation training course comes in.

The NIS-2 Foundation course covers the fundamentals of the directive, explains key terms, roles, and responsibilities, and clearly illustrates what NIS-2 means for organizations in practical terms. It is designed for executives, IT and security managers, and anyone who needs to understand NIS-2 from both a strategic and practical perspective.

The Foundation course thus provides the ideal introduction to NIS-2—serving as a foundation for further training and structured implementation within one’s own organization.