← Standards
Directive (UE) 2022/2555 — NIS 2Union européenne
Measures for a high common level of cybersecurity across the Union
NIS 2 substantially widens its predecessor's scope: eighteen sectors, essential and important entities, management liability and significant administrative fines. Article 21 explicitly requires business continuity and crisis management among the minimum measures.
Official textWho it applies to
- Designated essential or important entities
- Their direct suppliers
- Management, who can be held liable
Structuring points
- Article 21(2) lists ten minimum measures, including business continuity and backup management
- Early warning is due within 24 hours, notification within 72 hours
- Training of management bodies is an obligation, not a recommendation
- The directive is transposed nationally: always check your member state's text
Essential and important entities across energy, transport, health, water, digital, public administration, space, postal services, waste, chemicals, food, manufacturing, digital providers and research.