NIS2 Directive.

EU Directive 2022/2555 that raises baseline cybersecurity requirements and incident-reporting obligations for essential and important entities across the Union. It belongs to the Compliance & Frameworks category of cybersecurity.

EU Directive 2022/2555 that raises baseline cybersecurity requirements and incident-reporting obligations for essential and important entities across the Union.

The NIS2 Directive (EU Directive 2022/2555) is the European Union's second-generation network and information security law, replacing the original NIS Directive of 2016. It was adopted in December 2022 and Member States were required to transpose it into national law by 17 October 2024. NIS2 expands the in-scope sectors (energy, transport, banking, health, digital infrastructure, public administration, manufacturing of critical products and more) and introduces stricter security measures, supply-chain risk management, executive accountability, and a 24-hour early warning followed by a 72-hour incident notification to the national CSIRT or competent authority. Sanctions include administrative fines of up to EUR 10 million or 2% of global annual turnover for essential entities.

Defences for NIS2 Directive typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: NIS 2, Directive (EU) 2022/2555.