NIS2 in plain language: a glossary of the terms that matter

NIS2 is the EU's Directive 2022/2555 on cybersecurity for network and information systems. It requires medium-sized and large organizations in listed sectors to manage cyber risk, report significant incidents quickly, and hold senior management accountable. Because it is a directive, each Member State turned it into national law, so check your country's rules.

This glossary uses the directive text on EUR-Lex and the European Commission's NIS2 page. It is a plain language guide, not legal advice.

The basics

NIS2. The Directive (EU) 2022/2555. The Commission says it replaced the first NIS Directive, 2016/1148, and raises the common level of cybersecurity ambition through a wider scope, clearer rules and stronger supervision. It came into force in January 2023. Member States had until 17 October 2024 to transpose it, and the Commission says it repealed NIS1 from 18 October 2024.

Sectors. The Commission describes 18 critical sectors, including energy, transport, health, finance, water, digital infrastructure and public administration, plus areas added by NIS2 such as space and critical product manufacturing. As a rule, medium-sized and large entities in these sectors must take risk-management measures and notify significant incidents.

Essential entity and important entity. The two categories the directive uses. Recital 15 says entities should be classified into those two. One difference shows up in the maximum fines, covered below. Your national authority tells you which category you fall in.

What you must do

Cybersecurity risk-management measures. Article 21 requires appropriate and proportionate technical, operational and organizational measures. Paragraph 2 says they shall include at least policies on risk analysis and information system security, incident handling, business continuity such as backups and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling and disclosure, ways to assess whether the measures work, and basic cyber hygiene and training. It also lists further items beyond those.

Supply chain security. Article 21(2)(d) names supply chain security, including security-related aspects of the relationships with direct suppliers or service providers. In practice this is where an inventory of the software you buy and build, vulnerability handling and supplier reviews come in. Recital 85 adds that entities should take into account the overall quality of their suppliers' products and practices.

Management body. The board or equivalent leadership. Article 20 says management bodies must approve the risk-management measures, oversee their implementation and can be held liable for infringements. It also says members must follow training so they can assess cyber risks and practices.

Incidents and reporting

Significant incident. Under Article 23(3), an incident is significant if it has caused or can cause severe operational disruption or financial loss, or if it has affected or can affect other people by causing considerable material or non-material damage.

Early warning. The first report. Article 23(4) says it is due without undue delay and in any event within 24 hours of becoming aware of a significant incident. It should say whether the incident is suspected to come from unlawful or malicious acts, or could have cross-border impact.

Incident notification. The second report, due within 72 hours of becoming aware. It updates the early warning and gives an initial assessment, including severity, impact and indicators of compromise where available.

Final report. Due not later than one month after the incident notification. It includes a detailed description, the likely root cause, mitigation measures and any cross-border impact. If the incident is still ongoing, a progress report is due and the final report follows within one month of handling it.

Who is on the other side

CSIRT. A computer security incident response team, the body that usually receives reports and offers help. Article 23(5) says the CSIRT or competent authority should reply within 24 hours of the early warning where possible, with initial feedback and, on request, guidance.

Competent authority. The national body that supervises compliance. It differs by country.

EU-CyCLONe and the NIS Cooperation Group. EU level networks. The Commission describes the first as supporting coordinated management of large-scale incidents and crises, and the second as a platform for cooperation among Member States, the Commission and ENISA, which publishes non-binding guidelines.

Consequences

Administrative fines. Under Article 34, Member States must ensure that for infringements of Articles 21 or 23, essential entities face maximum fines of at least EUR 10 million or at least 2 percent of total worldwide annual turnover, whichever is higher. For important entities the figures are at least EUR 7 million or at least 1.4 percent. National law sets the exact regime.

What is changing?

The Commission says that on 20 January 2026 it proposed targeted amendments to NIS2 to increase legal clarity and simplify compliance, estimating relief for 28,700 companies. A proposal is not law. Watch for adoption.

What to do

1. Find out from your national authority whether you are an essential or important entity, or neither.
2. Map your current controls to the Article 21 list and mark the gaps.
3. Write a reporting runbook with clocks for 24 hours, 72 hours and one month, and name who files.
4. Brief and train your management body, and record it.
5. List critical suppliers and the software you depend on, and set review dates.
6. Check your country's transposition page for local forms and contacts.

Quick check

Sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex
• European Commission, NIS2 Directive: securing network and information systems

Last reviewed: 18 October 2026.