Cybersecurity · NIS2 Directive
Network security, with the board on the hook.
NIS2 raises cybersecurity duties for essential and important entities across the EU — with 24/72-hour incident reporting and personal management accountability. The transposition deadline was 17 October 2024; national implementation is still being completed.
Technical & organisational measures for network and information security — proportionate to risk (Art. 21).
Early warning within 24h, notification within 72h, final report within 1 month, using the EU common reporting templates (Art. 23).
Assess and manage the security of suppliers and service providers.
Management bodies approve and oversee cyber-risk measures — and can be held personally liable (Art. 20).
Frequently asked
What is the NIS2 Directive?
NIS2 (Directive (EU) 2022/2555) is the EU's cybersecurity law for 'essential' and 'important' entities across critical sectors. It mandates risk-management measures, incident reporting, supply-chain security and management accountability.
When does NIS2 apply?
NIS2 (Directive (EU) 2022/2555) had a member-state transposition deadline of 17 October 2024; several member states are still completing transposition, so national implementation varies. Verify your member state's law.
What are the NIS2 reporting timelines?
For significant incidents: an early warning within 24 hours, a notification within 72 hours, and a final report within one month — following the EU common templates.
How do NIS2 and DORA overlap?
NIS2 and DORA overlap substantially on ICT risk management, incident reporting and third-party/supply-chain risk. Note DORA is lex specialis for financial entities — where both could apply, DORA's ICT rules take precedence. CSOAI's DORA×NIS2 crosswalk maps the overlap once to avoid duplicated controls.
How does CSOAI help with NIS2?
CSOAI maps NIS2 to one control set, crosswalks it to DORA and the Cyber Resilience Act, structures incident reporting to the common templates, and produces Layer-0 (Ed25519) signed evidence for supervisors.
Status verified July 2026; national transposition varies. Indicative guidance, not legal advice — verify against your member state's implementation.