NIS2 guides: scope, obligations and national laws.
Whether NIS2 applies to you, what Article 21 and incident reporting require, how supervision and fines work, what it means sector by sector, and how member states have transposed it.
NIS2 registration with the ILR: who must register, what to submit and what happens next
Entities in scope of Luxembourg's NIS2 law register themselves with the ILR through its self-registration form. The deadline was 10 July 2026. What the form asks for, how the ILR confirms your status, and what follows.
NIS2 incident notification in Luxembourg: what to report to the ILR, when, and a template
In Luxembourg, significant incidents go to the ILR through the SERIMA form: a preliminary notification within 24 hours, an incident notification within 72 hours and a final report within a month. What counts as significant, what each report contains, and a template.
Security annex in supplier contracts: what each clause asks for, and how to answer it
A security annex turns your customer's security requirements into contract terms with a clock, an audit right and a consequence. Its core is usually the eight supplier contract points in Regulation (EU) 2024/2690. Ten clauses, what each costs, what to negotiate, and a checklist.
vCISO first 90 days: the plan for a part-time security owner
A vCISO or part-time security owner's first 90 days should produce four things you can prove, not forty policies. The six fifteen-day phases, what to refuse, and the four yes-or-no tests that tell you at day 90 whether it worked.
Cybersecurity requirements for space suppliers: NIS2, the proposed EU Space Act, ESA and prime contractors
Most space suppliers get cybersecurity requirements through customers, not regulators. What NIS2 covers in the space sector, what the proposed EU Space Act would add, what ESA, EU programme and prime contracts ask, which comes first, and what to build once.
Who is responsible for cybersecurity in an SME? (and when a vCISO makes sense)
Management is accountable, and one named person has to own the decisions. NIS2 puts approval and oversight on the management body, ISO 27001 requires the roles to be assigned, and neither requires a CISO. Where the job lands by default, what it involves, and when a vCISO fits.
NIS2 for telecom suppliers: the two ways the obligations reach you, and what operators will ask for
NIS2 reaches telecom suppliers in two ways: through the operator's contracts, because operators must manage direct supplier risk, and directly if you are a medium-sized or larger MSP, cloud or data centre provider. Both routes, what operators ask for, what to build.
ISO 27001 vs NIS2: how the two map, and how to do both once
An ISO 27001 ISMS covers roughly 70 to 80 per cent of NIS2 Article 21: five of the ten measures fully, five partly. The mapping table, where partial bites, the five NIS2 obligations no ISMS contains, and how to run both as one programme.
NIS2 and ransomware: what you must report, whether you can pay, and what Article 21 expects
Ransomware that can severely disrupt your services is a significant NIS2 incident: early warning within 24 hours, notification within 72. NIS2 does not ban paying. Reporting, payment, the COM(2026) 13 proposal, Article 21, GDPR and a first-24-hours checklist.
NIS2 supply chain security: how to assess supplier risk under Article 21
NIS2 makes supply chain security one of the ten minimum measures. You must assess each direct supplier's vulnerabilities, product quality and security practices, and take EU coordinated assessments into account. The steps, the contract clauses and what Article 22 adds.
Does NIS2 apply to SMEs? Who is in scope, and what smaller suppliers still have to do
NIS2 applies to medium-sized and large companies in the sectors it lists: 50 or more employees, or more than EUR 10 million in both turnover and balance sheet. Small companies are mostly out of scope, but their NIS2-regulated customers pass the requirements on.
NIS2 encryption requirements: what Article 21 asks for cryptography, and when encryption is expected
NIS2 requires every essential and important entity to have a cryptography policy, and encryption where appropriate to the risk. What Article 21(2)(h) says, what Regulation 2024/2690 adds, a policy outline, key management, post-quantum plans and the telecom rules.
NIS2 for the food sector: which food businesses are in scope (wholesale, processing, production)
NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, if medium-sized or larger. Who is in and out, from dairies and drinks makers to retailers, restaurants and farms, essential or important, and what applies.
NIS2 Article 28: domain registration data (WHOIS) obligations for registries and registrars
NIS2 Article 28 requires TLD registries, registrars and resellers to keep accurate and complete domain registration data, verify it, publish non-personal data and answer access requests within 72 hours. Scope, data fields, GDPR and a verification checklist.
NIS2 in Germany: what the NIS2UmsuCG and the new BSIG require, who is in scope and the BSI deadlines
NIS2 has applied in Germany since 6 December 2025 through the NIS2UmsuCG and a new BSIG. Who is in scope under § 28, the § 33 registration deadline that has passed, § 32 reporting, § 30 measures, § 38 management duties and § 65 fines, mapped to NIS2.
NIS2 training requirements: who must be trained, on what, and how often
NIS2 requires members of the management body to follow cybersecurity training and makes staff training a minimum risk-management measure. It sets no hours, certificate or approved provider. What the law says, what the implementing rules add, a training plan and a record template.
NIS2 in Belgium: what the law of 26 April 2024 requires, who is in scope and the CCB deadlines
Belgium's NIS2 law, the Law of 26 April 2024, has applied since 18 October 2024, with the CCB as national authority. Scope, Safeonweb@work registration, incident reporting, the CyberFundamentals and ISO 27001 routes, the 2026 and 2027 deadlines, and fines.
NIS2 jurisdiction: which Member State supervises you, and how the main establishment rule works
Under NIS2 you are supervised by the Member State where you are established. Telecoms answer to each country they serve; cloud, MSP and other digital providers to their main establishment. The rules, the main establishment test, non-EU providers, mutual assistance and groups.
NIS2 in Luxembourg: the Law of 5 May 2026 explained (scope, ILR registration, reporting and fines)
Luxembourg transposed NIS2 through the Law of 5 May 2026, in force since 10 May 2026. Who is in scope, how to register with the ILR, the ten Article 12 measures, the 24-hour reporting clock and fines of up to EUR 10 million or 2% of turnover.
NIS2 coordinated vulnerability disclosure: what Article 12 sets up, and what your company must do about vulnerabilities
NIS2 Article 12 makes one CSIRT per country the coordinator for vulnerability reports and has ENISA run a European vulnerability database. Article 21 makes companies handle and disclose vulnerabilities. What each means, the CRA link and a policy template.
NIS2 manufacturing: which manufacturers are in scope (NACE C26 to C30 and medical devices)
NIS2 covers makers of medical devices and IVDs and of products in NACE Rev. 2 divisions 26 to 30, from 50 staff or over EUR 10 million turnover and balance sheet. What each division covers, automotive suppliers, car dealers, status and duties.
NIS2 for financial services: when DORA applies instead, and where CER fits
NIS2 lists only banks, trading venue operators and CCPs, and even for them DORA replaces the NIS2 risk and reporting rules. Insurers, investment firms, payment institutions and fund managers follow DORA alone. Who follows what, DORA's deadlines, and where CER fits.
NIS2 certification: is there a NIS2 certificate, and what counts as proof?
There is no NIS2 certificate for companies. NIS2 lets authorities require certified ICT products (Article 24), encourages standards such as ISO 27001 (Article 25) and audits entities (Articles 32 and 33). What exists, what is proposed, and what an auditor asks for.
NIS2 for MSPs and MSSPs: are managed service providers in scope, and what applies?
Managed service providers and managed security service providers are an Annex I sector under NIS2. If you are medium-sized or larger, you are in scope: important if medium, essential if large. What applies, which country supervises you, what to register and report.
NIS2 vs GDPR: the differences, where they overlap, and how to handle one incident under both
GDPR protects personal data; NIS2 protects the systems behind essential and important services. One incident can trigger both: a NIS2 early warning within 24 hours and a GDPR notification within 72. Side-by-side table, fines, a worked example and a joint playbook.
What is a significant incident under NIS2? The legal test, the thresholds for digital providers, and how to decide fast
Under NIS2 Article 23(3), an incident is significant if it causes or can cause severe operational disruption or financial loss for you, or considerable damage to others. The legal test, who decides, the thresholds for digital providers, a decision tree and the GDPR difference.
NIS2 for transport: which air, rail, water and road operators are in scope and what applies
NIS2 covers transport operators of an Annex I type that are at least medium-sized: air carriers, airports, air traffic control, rail, shipping, ports, VTS, road authorities and ITS operators. Who is in and out, essential or important, and how Part-IS, ISPS and CER fit.
Who enforces NIS2? Competent authorities, CSIRTs and the EU bodies behind them
NIS2 is enforced by national competent authorities; incident reports go to a national CSIRT or the authority. What each national and EU body does, which ones a company deals with, how to find yours, and what the 2026 proposal would change for ENISA.
NIS2 fines and penalties: how much, for what, and what else regulators can do
For breaches of Article 21 or 23, national law must set NIS2 fines with a maximum of at least €10M or 2% of worldwide turnover for essential entities and €7M or 1.4% for important ones. What triggers them, group turnover, GDPR, other powers and personal liability.
NIS2 for healthcare: which hospitals, clinics, labs and pharma companies are in scope
NIS2 covers healthcare providers, pharma R&D and manufacturing, and medical device makers once they have 50 staff, or turnover and balance sheet both over €10 million. Clinics, radiology, labs, pharmacies and pharma, essential or important, and what applies.
NIS2 all-hazards approach: what it means for physical and environmental security
NIS2 Article 21(2) requires measures based on an all-hazards approach that protects network and information systems and their physical environment. The hazards the recitals name, the rules for digital providers, the link with the CER Directive and a proportionate SME baseline.
NIS2 digital infrastructure: what applies to cloud, data centre, DNS, CDN and IXP providers
NIS2 Annex I names nine digital infrastructure entity types. DNS, TLD, trust service and telecom providers are covered at any size; cloud, data centre, CDN and IXP providers from medium size. Definitions, status, jurisdiction, incident thresholds and a checklist.
NIS2 essential vs important entities: how you are classified and what changes for you
Large Annex I entities and a few named categories are essential; other in-scope Annex I and II entities are important. Both follow the same Articles 20, 21 and 23. Supervision, enforcement and fines differ. How classification works, and what changes for you.
NIS2 for the energy sector: which operators are in scope and what applies (electricity, gas, oil, hydrogen, heating)
NIS2 applies to electricity, district heating and cooling, oil, gas and hydrogen operators of an Annex I type that are at least medium-sized; large ones are essential. Scope by subsector, oil and gas, the electricity network code, the CER Directive and OT in practice.
NIS2 incident reporting timeline: 24 hours, 72 hours, one month, and what goes in each report
NIS2 gives you 24 hours from becoming aware of a significant incident for an early warning, 72 hours for the incident notification and one month after that for the final report. What each report contains, who receives it, telling customers, and a timeline to copy.
NIS2 board duties: what Article 20 requires from management, and when directors can be held liable
Under NIS2 Article 20 the management body approves the Article 21 measures, oversees their implementation and can be held liable; its members must follow training. What each duty means, whether approval can be delegated, who is liable, and a board-pack template.
NIS2 Article 21: the 10 cybersecurity risk-management measures, explained
Article 21 of NIS2 requires appropriate and proportionate measures to manage cybersecurity risk, based on an all-hazards approach, and lists ten minimum measures. What each one means in practice, what proportionate means, and what evidence an authority will ask for.
NIS1 vs NIS2: the key differences, side by side
NIS2 replaced NIS1 on 18 October 2024. The biggest change is scope: NIS1 covered operators each country chose in 7 sectors, NIS2 applies by size in 18 sectors. It adds ten minimum measures, management liability, a 24-hour clock and fine ceilings. The comparison table.
NIS2 scope: does NIS2 apply to your company? A four-step check
NIS2 applies to entities of a type listed in Annex I or II that are at least medium-sized and active in the EU, plus a short list covered regardless of size. The four-step check, a decision table, the size rules, exclusions and registration.
NIS2 compliance: what the directive requires, who is in scope, and where to start
NIS2 applies to medium-sized and larger entities in 18 sectors. Compliance means registering, board approval and training, ten minimum security measures and incident reporting within 24 hours. Who is in scope, each duty, fines, national laws and a 90-day plan.