NIS2 puts three things on a DevOps lead's desk: security measures you can show, control over your supply chain, and incident reporting on a clock that starts at awareness, with an early warning within 24 hours. If your company is covered, the work is mostly logging, inventories and rehearsal.
Is my company covered?
NIS2 is Directive 2022/2555. The European Commission says it creates a framework for 18 critical sectors, and as a rule medium and large entities in those sectors must take risk management measures and notify significant incidents. Member States had to apply their national laws from 18 October 2024, but each country transposed it in its own way, so the national law is what binds you. Check the law of the country where you operate, and ask legal rather than assuming.
What is the incident clock?
The directive's recitals describe a staged process. An early warning goes out without undue delay and in any event within 24 hours of becoming aware of a significant incident. An incident notification follows within 72 hours, updating the first report with an initial assessment, severity, impact and indicators of compromise where available. A final report is due not later than one month after the notification.
Constructed example: at 02:10 a monitoring alert shows that a build runner has pushed an unexpected image to production. By 09:00 someone must decide whether this is a significant incident, and by 02:10 the next day the early warning window closes. The engineering question is whether your records can support those decisions: what was deployed, by which identity, from which commit.
What do the security measures mean for pipelines?
The directive requires measures based on an all hazards approach, protecting systems and their physical environment. It also names supply chain security, including security in the relationships with direct suppliers and service providers. For delivery pipelines, that translates to controls you can point at.
- Access to CI and deployment systems is limited, reviewed and uses strong authentication.
- Build and release logs are retained and tamper resistant enough to reconstruct an incident.
- Third party actions, plugins and base images are pinned and tracked.
- You can list every dependency in a release.
- Vulnerabilities in what you ship have an owner and a due date.
The national law and any implementing acts may say more. Treat this list as a baseline, not as the legal text.
Who answers if it goes wrong?
NIS2 makes management bodies accountable for approving and overseeing risk measures, and the Commission calls out accountability of top management as a key feature. Fines for essential entities can reach at least 10 million euros or 2 percent of worldwide annual turnover, whichever is higher, as the directive sets the maximum level Member States must provide for. That is why your risk acceptance decisions need a named senior owner rather than an informal agreement in a chat thread.
Where does vulnerability handling fit?
The Commission's page notes that national strategies include policies on vulnerability management and supply chain security. In practice, auditors and customers will ask whether a newly published flaw in a package you ship leads to action. A dependency inventory plus reachability analysis shows which advisories your code can really hit. Safeguard provides SBOM generation, dependency scanning and reachability analysis for that purpose, and the Gold scan at gold.safeguard.sh/scan checks up to 100 dependencies for free in the browser.
What to do
- Confirm with legal whether you are an essential or important entity and which national law applies.
- Write the incident decision tree: who declares significance, who files, with what data.
- Run a timed drill that ends with a draft early warning.
- Pin and inventory CI plugins, actions and base images.
- Turn on retention for pipeline and deployment logs.
- Keep a dependency inventory per release and assign vulnerability owners.
Quick check
Does NIS2 apply to small companies?
As a rule it targets medium and large entities in covered sectors, though Member States may extend scope. Check your national law.
When does the 24 hour window start?
It runs from the moment the entity becomes aware of a significant incident, per the directive's recitals. Confirm exact wording in your national law.
Sources
Last reviewed: 18 October 2026.
