The Network and Information Security Directive 2 — NIS2 (EU 2022/2555) — is the most significant cybersecurity regulation the European Union has ever adopted. It replaces the original NIS Directive from 2016 with dramatically broader scope, stricter security requirements, and enforcement mechanisms that include personal liability for company directors. For incident response teams, the implications are immediate and concrete: you now have legally mandated timelines for incident detection, reporting, and root cause analysis.
This guide breaks down what NIS2 requires, who it applies to, and exactly what your incident response program needs to change to achieve compliance. Whether you're already well into your NIS2 preparation or just beginning to assess the impact, this article focuses on the practical IR implications rather than the full regulatory text.
What Is NIS2
NIS2 is the EU's updated directive on cybersecurity for network and information systems. It entered into force on January 16, 2023, and EU member states had until October 17, 2024 to transpose it into national law. The directive aims to achieve a high common level of cybersecurity across the EU by imposing security and incident reporting obligations on a much wider range of organizations than its predecessor.
The original NIS Directive (2016) applied to a relatively narrow set of "operators of essential services" and "digital service providers." NIS2 dramatically expands this scope and introduces more prescriptive security requirements, standardized incident reporting timelines, and meaningful enforcement penalties.
For organizations already subject to other EU regulations (GDPR, DORA), NIS2 adds a cybersecurity-specific layer that complements but does not replace those existing obligations. The incident reporting requirements under NIS2 are separate from GDPR's 72-hour data breach notification and may apply to incidents that don't involve personal data at all.
Who Does NIS2 Apply To
NIS2 divides in-scope organizations into two categories with different supervision regimes:
Essential Entities
Subject to proactive regulatory supervision (authorities can audit and inspect without a triggering event):
- Energy (electricity, oil, gas, hydrogen, district heating)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Health (hospitals, laboratories, medical device manufacturers, pharmaceutical companies)
- Drinking water and wastewater
- Digital infrastructure (internet exchange points, DNS providers, TLD registries, cloud computing providers, data center operators, CDN providers, trust service providers, public electronic communications networks)
- ICT service management (B2B, managed service providers, managed security service providers)
- Public administration (central government)
- Space
Important Entities
Subject to reactive supervision (authorities investigate after an incident or evidence of non-compliance):
- Postal and courier services
- Waste management
- Chemical manufacturing, production, and distribution
- Food production, processing, and distribution
- Manufacturing (medical devices, computers, electronics, machinery, motor vehicles)
- Digital providers (online marketplaces, search engines, social networking platforms)
- Research organizations
Size thresholds: NIS2 generally applies to medium-sized and large enterprises (50+ employees or annual turnover exceeding €10 million). However, member states can designate additional entities regardless of size if they are the sole provider of a critical service, if disruption could have significant impact on public safety or health, or if the entity is systemically important for the member state. Some sectors (DNS providers, TLD registries, trust service providers) are in scope regardless of size.
NIS2 Incident Reporting Requirements
The incident reporting timeline is the area with the most direct impact on IR operations. NIS2 introduces a multi-stage reporting obligation with strict deadlines, measured from when the organization first becomes aware of the significant incident.
Notify your national CSIRT or competent authority with an early warning that includes:
- Whether the incident is suspected to be caused by unlawful or malicious acts
- Whether the incident could have cross-border impact
- Basic scope and impact description
This is not a full incident report. It's an alert that triggers coordination mechanisms, especially for incidents with potential cross-border implications. The 24-hour clock starts when you become aware of the incident, making detection speed a compliance factor.
Provide a more detailed incident notification that updates the early warning with:
- Initial assessment of severity and impact
- Indicators of compromise (IOCs)
- Affected services and systems
- Number of affected users or entities
At this stage, your investigation should have progressed enough to provide meaningful impact assessment and technical indicators. This notification must be actionable — authorities and peer organizations need IOCs to check their own environments.
The CSIRT or competent authority may request intermediate status updates at any point during the incident response. Your IR team needs established communication channels and reporting templates to respond to these requests without disrupting the active investigation.
Submit a comprehensive final report including:
- Detailed description of the incident, including severity and impact
- The type of threat or root cause that likely triggered the incident
- Remediation measures applied and ongoing
- Cross-border impact, where applicable
The one-month deadline for root cause analysis means your forensic investigation must produce results within this window. For complex incidents, this is an aggressive timeline that requires adequate forensic capability — either internal or through retainer agreements with external IR providers.
What constitutes a "significant incident"? NIS2 defines this as an incident that has caused or is capable of causing: severe operational disruption of the services or financial loss for the entity concerned, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. This is a broad definition, and member states may provide additional specificity in their national transposition.
Security Measures Required by Article 21
NIS2 Article 21 mandates a set of cybersecurity risk-management measures that organizations must implement. Several of these have direct relevance to your IR program:
- Risk analysis and information system security policies — You need documented security policies that are regularly reviewed and updated. These form the foundation for your IR plan.
- Incident handling — Explicit requirement for incident handling procedures. This is your incident response plan, and it must exist, be documented, and be maintained.
- Business continuity and crisis management — Your IR plan must integrate with business continuity plans. Incident response in isolation is insufficient — NIS2 requires that you can maintain or restore operations during and after a significant incident.
- Supply chain security — You must assess and manage cybersecurity risks related to your suppliers and service providers. This includes incident notification obligations in your supply chain contracts.
- Vulnerability handling and disclosure — Procedures for vulnerability management and coordinated vulnerability disclosure. This includes the ability to identify, assess, and remediate vulnerabilities in your environment.
- Policies for assessing effectiveness — You must have mechanisms to evaluate whether your cybersecurity measures are actually working. Tabletop exercises, penetration testing, and post-incident reviews all serve this requirement.
- Cybersecurity training — Regular cybersecurity awareness and skills training for all staff, including management. For IR specifically, this means your responders must be trained and your broader workforce must know how to recognize and report security incidents.
- Cryptography and encryption — Policies for the use of cryptography and, where appropriate, encryption. This is relevant to IR when handling sensitive evidence and communicating about incidents.
- Human resources security and access control — Including access management policies, asset management, and multi-factor authentication or continuous authentication for privileged access.
Penalties and Enforcement
NIS2 introduces enforcement mechanisms with real financial consequences:
- Essential entities: Fines up to €10,000,000 or 2% of worldwide annual turnover, whichever is higher
- Important entities: Fines up to €7,000,000 or 1.4% of worldwide annual turnover, whichever is higher
- Management liability: NIS2 explicitly states that management bodies can be held personally responsible for non-compliance with the directive's requirements. This includes the obligation for management to approve cybersecurity risk-management measures, oversee their implementation, and undergo cybersecurity training
The management liability provision is a significant departure from the original NIS Directive. It means that board members and senior executives who fail to ensure compliance can face personal sanctions, not just organizational fines. This elevates cybersecurity from an IT issue to a board-level governance obligation.
What This Means for Your IR Program
Translating NIS2's requirements into practical IR program changes produces a concrete list of capabilities you must have:
- A documented incident response plan — Required explicitly by Article 21. This plan must cover detection, analysis, containment, eradication, recovery, and post-incident activity.
- Detection capability within 24 hours — You cannot report what you cannot detect. The 24-hour early warning requirement means you need monitoring and alerting that can identify significant incidents quickly enough to start the reporting clock with time to spare.
- Established CSIRT communication channels — You need to know your national CSIRT, have a designated point of contact, and have tested the reporting process before an incident occurs. In Belgium, this is the Centre for Cybersecurity Belgium (CCB).
- Evidence preservation for root cause analysis — The one-month final report requires root cause identification. This means your IR procedures must include evidence preservation steps that support forensic analysis — not just containment and recovery.
- Trained incident response staff — Your IR team must be capable of performing the analysis needed to meet reporting requirements. This includes technical skills (log analysis, forensics, IOC extraction) and communication skills (writing clear incident reports for regulatory audiences).
- Regular IR testing — NIS2's requirement for effectiveness assessment means you need to test your IR plan regularly through tabletop exercises, simulation exercises, or actual incident reviews.
- Supply chain incident procedures — Your IR plan must address incidents that originate from or affect your supply chain. This includes notification procedures for your suppliers and contractual incident reporting obligations.
- Management briefing procedures — Given management's personal liability, your IR plan must include procedures for briefing senior leadership on significant incidents and ensuring they fulfill their governance obligations.
Preparing for Compliance: An Actionable Checklist
If you haven't started your NIS2 preparation, or want to validate your current readiness, work through this checklist:
- Determine your scope — Are you an Essential or Important entity? Check your sector, size, and any member state-specific designations. Consult your national authority's guidance.
- Gap assessment — Map your current IR capabilities against the NIS2 requirements outlined above. Document what you have, what's missing, and what needs improvement.
- Establish CSIRT relationship — Identify your national CSIRT and competent authority. Register if required. Test the reporting channel with a non-incident communication.
- Develop reporting templates — Create standardized templates for the 24-hour early warning, 72-hour notification, and one-month final report. Pre-populate them with your organization's details so responders can focus on incident-specific information during an actual event.
- Review logging and monitoring — Ensure your logging infrastructure supports the 24-hour detection requirement. Do you have adequate log retention? Real-time alerting? After-hours monitoring capability?
- Conduct a tabletop exercise — Run a tabletop exercise that specifically tests your NIS2 reporting workflow. Include the 24-hour early warning as a decision point in the scenario. Verify that your team can produce the required reports within the mandated timelines.
- Review supply chain contracts — Ensure your contracts with suppliers and service providers include cybersecurity requirements and incident notification obligations consistent with NIS2.
- Brief management — Inform your board and senior leadership about NIS2's management liability provisions. Ensure they understand their obligations to approve cybersecurity measures, oversee implementation, and complete cybersecurity training.
- Engage external IR support — If your internal team cannot guarantee the forensic depth needed for one-month root cause analysis, establish a retainer agreement with an external IR provider. The time to find an IR partner is before the incident, not during it.
Need Help with NIS2 Compliance?
ForgeWork helps organizations across Belgium and the EU prepare for NIS2 compliance. From IR program development to tabletop exercises and managed detection, we can help you meet the directive's requirements.