NIS2 is the EU directive that sets cybersecurity risk management and incident reporting duties for medium and large entities in covered sectors. For a VP of engineering the practical points are a staged reporting clock of 24 hours, 72 hours and one month, accountability reaching top management, and supply chain security that pulls vendors and open source into scope.
Who is covered?
The European Commission says NIS2 applies across 18 critical sectors. Beyond sectors already under the first directive, such as energy, transport, healthcare, finance, water and digital infrastructure, it adds providers of public electronic communications, more digital services, waste management, critical product manufacturing, postal services, public administration and space. As a rule, medium-sized and large entities in these sectors must take risk management measures and notify authorities of significant incidents.
Software vendors may be covered directly in some categories, and indirectly as suppliers to covered customers. Which applies depends on national law, since the directive had to be transposed by 17 October 2024 and countries moved at different speeds. Ask legal which national rules govern you.
The Commission also proposed targeted amendments on 20 January 2026 to increase legal clarity and ease compliance for some companies. Check the status before planning around any simplification.
What is the incident clock?
The directive's recitals describe the staged path. After becoming aware of a significant incident, an entity submits an early warning without undue delay and in any event within 24 hours. An incident notification follows within 72 hours of awareness, updating the early warning with an initial assessment, severity, impact and indicators of compromise where available. A final report is due not later than one month after the incident notification.
This is the section engineering feels. The clock starts at awareness, so detection speed and an agreed definition of "significant" decide your exposure. Confirm the exact thresholds in your national transposition.
Where does engineering carry responsibility?
Detection and triage. Alerts, on-call and a quick route to whoever decides that an incident is significant. If that decision takes two days, the 24 hour warning is already late.
Runbooks. A reporting template that can be filled from what you know in the first hours, with unknowns marked as unknowns. The early warning only needs the information necessary to alert the authority, and says whether malicious acts are suspected and whether there is cross-border impact.
Supply chain. The directive expects supply chain security, including attention to vendors and their security practices. In practice you need an inventory of suppliers and software components, security terms in contracts, and a process for reacting when a dependency has a known vulnerability.
Management accountability. The Commission notes NIS2 introduces accountability of top management for non-compliance with risk management measures. Leadership should see risk reports, not only hear about incidents.
What do you decide?
You decide the engineering controls and the evidence: logging coverage, vulnerability handling times, backup and recovery tests, access control, and the supplier review routine. You also decide how quickly a suspected incident is escalated.
You do not decide legal scope, the final call on reportability or what is said to the authority. Those need legal and the designated contact.
How to check or apply this
- Confirm with legal whether you are in scope, and under which national law.
- Define "significant incident" criteria with legal, and write them into the runbook.
- Time a drill from first alert to a filled 24 hour warning.
- Build a supplier and component inventory with owners.
- Add security and notification clauses to supplier contracts.
- Report risk metrics to leadership quarterly.
- Re-check national rules and the pending amendments twice a year.
Safeguard's SBOM and dependency scanning supports the component inventory in step 4.
Quick check
When does the 24 hour clock start?
At awareness of a significant incident, per the directive's recitals. It is not the time the incident began.
Is NIS2 a regulation that applies the same everywhere?
No. It is a directive, so each Member State transposes it into national law. Check your country's rules.
Sources
Last reviewed: 18 October 2026.
