02.02.2026

Author: Peter Amrhyn

NIS2 basics: 7 questions every executive should be able to answer

Are NIS and critical infrastructure only for IT security nerds, Brussels bureaucrats, and highly regulated industries? Well, that's no longer the case. With the revised NIS2 regulation, the EU is widening the scope and expanding the list of critical sectors, now classifying them as either "essential" or "important". This means that a significantly larger number of companies are now affected, so all business leaders should familiarize themselves with the new legislation to avoid any unpleasant surprises. We've compiled seven key questions and answers for business leaders.

What is NIS2 and why does it matter?

NIS stands for "network information security," and with NIS2, the EU has updated the cybersecurity directive to strengthen the resilience of critical services across Europe. It significantly expands the scope of the original NIS Directive and introduces stricter governance, risk management, and incident-reporting requirements. For executives, NIS2 is not just an IT topic – it is a board-level responsibility that directly affects operational resilience, regulatory exposure, and digital trust. As an EU directive, NIS2 does not take effect automatically; it must first be transposed into national law by member states. If you want to know which countries have accomplished this step, take a look at our map in the NIS2 cheat sheet

Who is affected by NIS2?

NIS2 applies to medium-sized and large organizations operating in defined sectors, including energy, transport, healthcare, digital infrastructure, and cloud services. Certain entities are covered regardless of size if they are deemed critical. Non-EU companies can also fall under NIS2 if they provide relevant services within the EU.

Whether your company is affected, and to what extent, must be examined on a case-by-case basis in accordance with the national laws applicable in the countries in which the company operates. In case of doubt, companies should seek legal advice.

The State of NIS2 Implementation in the EU

What are the key obligations at a glance?

NIS2 requires organizations to implement risk-based cybersecurity and resilience measures, including:

Clear security governance and policies
Formal risk management and regular assessments
Incident detection, response, and mandatory reporting
Business continuity and disaster recovery planning
Supply chain and third-party risk management
Employee awareness and role-based training

The focus is not on specific technologies, but on effectiveness, accountability, and continuous improvement.

What does NIS2 mean for executive management?

NIS2 explicitly assigns responsibility to the organization's management body. Executives must:

Approve cybersecurity risk management measures
Oversee their implementation
Ensure adequate resources are available
Receive regular reporting on cybersecurity risks

While tasks can be delegated, accountability cannot. In some countries, non-compliance may result in personal sanctions for management.

What are the incident reporting requirements?

Organizations must report significant cybersecurity incidents to national authorities within strict time limits. Further details can be found in national legislation, but a typical timeframe is:

An early warning within 24 hours
A more detailed notification within 72 hours
A final report after the resolution of an incident

This makes strong detection, logging, and response processes essential.

What are the consequences of non-compliance?

Depending on national implementation, fines can reach up to:

€10 million or 2% of global annual turnover for essential entities
€7 million or 1.4% of global annual turnover for important entities

Beyond fines, organizations face reputational damage, increased supervisory scrutiny, and potential operational restrictions.

How should organizations approach NIS2 in practice?

Executives should view NIS2 as a strategic resilience program, not a one-off compliance exercise. Key steps include:

Confirm whether and where NIS2 applies to your organization
Establish clear governance and management oversight
Perform a structured gap analysis against NIS2 requirements
Prioritize remediation based on business risk
Select trusted, compliant partners for critical digital services

Do you want to know more about the current status of NIS2 implementation across EU countries, or assess the readiness of your cybersecurity risk management? Download our new NIS2 cheat sheet!

This article is for informational purposes only and does not constitute legal advice. Organisations should assess NIS2 obligations based on their specific circumstances and national implementation.

Customer success stories

Customer success stories

NIS2 basics: 7 questions every executive should be able to answer

What is NIS2 and why does it matter?

Who is affected by NIS2?

What are the key obligations at a glance?

What does NIS2 mean for executive management?

What are the incident reporting requirements?

What are the consequences of non-compliance?

How should organizations approach NIS2 in practice?

Latest Blog Articles

NIS2 basics: 7 questions every...

5 Digital Trust and identification...

FAQ EU Digital Product Passport (DPP)

Digital Product Passport: Burden or...