Strengthening Cybersecurity and Resilience Across Europe's Critical Sectors
The Network and Information Security Directive 2 (NIS2) is the European Union's most significant cybersecurity legislation to date. Designed to strengthen cyber resilience across critical sectors, NIS2 establishes a common baseline for cybersecurity risk management, incident reporting, governance, and supply chain security throughout the EU.
As cyber threats continue to evolve in scale and sophistication, organizations are increasingly expected to demonstrate that they can prevent, detect, respond to, and recover from cybersecurity incidents. NIS2 expands the scope of cybersecurity obligations far beyond the original NIS Directive and introduces stronger supervisory powers, enforcement mechanisms, and management accountability requirements.
For many organizations, NIS2 represents a shift from viewing cybersecurity as an IT issue to recognizing it as a strategic business and governance responsibility.
What Is the NIS2 Directive?
The NIS2 Directive was adopted by the European Union in December 2022, replacing the original NIS Directive introduced in 2016.
The Directive entered into force in January 2023, with Member States required to transpose its provisions into national legislation. Throughout 2025 and 2026, countries across Europe have continued implementing and refining their national frameworks, resulting in increasing regulatory scrutiny and enforcement activities.
NIS2 aims to achieve a higher common level of cybersecurity across the European Union by improving the resilience of organizations that provide essential and important services to society and the economy.
Key objectives include:
- Strengthening cybersecurity risk management
- Improving incident reporting and response
- Enhancing supply chain security
- Increasing management accountability
- Improving information sharing and cooperation
- Raising the overall cybersecurity maturity of organizations
Why Was NIS2 Introduced?
The original NIS Directive was developed at a time when digital transformation was less advanced and cyber threats were less sophisticated.
Since then, organizations have become increasingly dependent on:
- Cloud services
- Digital supply chains
- Remote working environments
- Connected operational technologies
- Artificial intelligence
- Third-party service providers
At the same time, ransomware, supply chain attacks, data breaches, and nation-state cyber activities have become more frequent and impactful.
The European Commission recognized that the original framework no longer provided sufficient protection against emerging cyber threats. NIS2 was therefore developed to address the realities of today's interconnected digital economy.
Which Organizations Are Covered under NIS2?
One of the most significant changes introduced by NIS2 is the expansion of the number of organizations that fall within scope.
The Directive categorizes organizations into two groups:
Essential Entities
Essential entities are organizations operating in highly critical sectors where disruptions could have significant societal or economic consequences. Examples include:
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Wastewater
- Digital infrastructure
- ICT service management
- Public administration
- Space
These entities are generally subject to proactive supervision by regulators.
Important Entities
Important entities operate in sectors that are also considered critical but may present a lower level of systemic risk. Examples include:
- Postal and courier services
- Waste management
- Chemicals
- Food production and distribution
- Manufacturing
- Digital providers
- Research organizations
These organizations may be subject to reactive supervisory activities and enforcement actions.
The overall result is that the number of organizations expected to comply with cybersecurity requirements has increased significantly compared with the original Directive.
Core NIS2 Requirements
NIS2 requires organizations to implement appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks.
While the exact implementation may vary depending on the organization's size, sector, and risk profile, several key requirements apply across the board.
Cybersecurity Risk Management
Organizations must establish a structured approach to identifying, assessing, and managing cybersecurity risks.
This includes:
- Risk assessments
- Security policies
- Governance frameworks
- Continuous monitoring activities
- Improvement programs
Cybersecurity should be integrated into enterprise risk management processes rather than managed as a standalone technical function.
Incident Management and Reporting
NIS2 introduces strict reporting requirements for significant cybersecurity incidents.
Organizations must establish procedures to:
- Detect incidents quickly
- Assess impact and severity
- Escalate incidents appropriately
- Communicate with relevant authorities
- Document response activities
Incident reporting timelines are significantly shorter than many organizations have historically operated under, requiring mature incident response capabilities and clear internal responsibilities.
Business Continuity and Crisis Management
Organizations are expected to maintain operational resilience during disruptive events.
This includes:
- Backup management
- Disaster recovery planning
- Crisis management procedures
- Recovery testing
- Communication plans
Cyber resilience is increasingly measured not only by an organization's ability to prevent incidents, but also by its ability to recover from them.
Supply Chain Security
Supply chain security has become one of the most important focus areas under NIS2.
Organizations must evaluate cybersecurity risks associated with:
- Suppliers
- Service providers
- Cloud providers
- Outsourcing arrangements
- Software vendors
Recent high-profile supply chain attacks have demonstrated how vulnerabilities within third parties can impact multiple organizations simultaneously.
Organizations are expected to implement structured supplier assurance and monitoring processes.
Secure Development and Vulnerability Management
Organizations must ensure security is considered throughout the lifecycle of information systems.
Requirements include:
- Secure acquisition processes
- Secure development practices
- Vulnerability management procedures
- Patch management activities
- Security testing
The objective is to reduce vulnerabilities before they can be exploited by attackers.
Identity and Access Management
NIS2 emphasizes the protection of user identities and access privileges.
Organizations are increasingly expected to implement:
- Multi-factor authentication (MFA)
- Privileged access controls
- Role-based access management
- Strong authentication mechanisms
- Access review processes
Identity-related attacks continue to be one of the most common causes of security breaches.
Security Awareness and Training
Human behavior remains a critical factor in cybersecurity.
Organizations are expected to implement:
- Cybersecurity awareness programs
- Employee training initiatives
- Management awareness activities
- Role-specific security education
Training helps reduce risks associated with phishing, social engineering, credential theft, and insider threats.
Board and Management Responsibilities
One of the most significant changes introduced by NIS2 is the increased accountability of senior management.
Management bodies are expected to:
- Approve cybersecurity risk management measures
- Oversee implementation efforts
- Understand cybersecurity risks
- Participate in cybersecurity training
- Ensure adequate resources are allocated
Cybersecurity governance can no longer be delegated entirely to technical teams.
Regulators increasingly expect boards and executive leadership to demonstrate active involvement in cybersecurity oversight.
Failure to meet obligations may result in significant regulatory consequences and reputational damage.
Common NIS2 Compliance Challenges
Many organizations underestimate the effort required to achieve regulatory readiness.
Common gaps include:
- Lack of formal reporting procedures
- Limited board engagement
- Inadequate supplier assurance processes
- Weak incident response capabilities
- Insufficient evidence and documentation
- Incomplete risk management frameworks
- Limited cybersecurity awareness programs
A common misconception is:
"We are ISO 27001 certified, therefore we are NIS2 compliant."
While ISO/IEC 27001 provides a strong foundation, NIS2 includes additional regulatory obligations relating to incident reporting, supervision, management accountability, and national requirements that must be addressed separately.
How ISO 27001 Supports NIS2 Compliance
Many organizations use ISO/IEC 27001 as the foundation for their cybersecurity governance framework.
An effective Information Security Management System (ISMS) helps establish:
- Governance structures
- Risk management processes
- Security controls
- Internal audit programs
Continuous improvement mechanisms
These capabilities align closely with NIS2 expectations.
However, organizations should conduct a dedicated NIS2 gap assessment to identify additional requirements that fall outside traditional ISO certification scopes.
How Intertek Can Help
Intertek supports organizations throughout their NIS2 readiness journey by combining cybersecurity expertise, auditing experience, and regulatory knowledge.
Our services include:
NIS2 Gap Assessments
Evaluate current cybersecurity maturity and identify gaps against NIS2 requirements.
Information Security Management Systems
Support implementation and improvement of ISO/IEC 27001-based management systems that provide a strong foundation for compliance.
Cybersecurity Risk Assessments
Identify and prioritize cybersecurity risks across technology, processes, and supply chains.
Supplier Assurance Reviews
Strengthen third-party risk management and supply chain security programs.
Incident Response Readiness
Assess and improve incident management, reporting, and crisis response capabilities.
Internal Audits
Evaluate effectiveness of cybersecurity controls and governance processes.
Cybersecurity Awareness Training
Provide role-based training for employees, management teams, and boards.
Preparing for the Future
NIS2 represents a significant milestone in Europe's cybersecurity landscape. Organizations that proactively strengthen governance, resilience, and risk management capabilities will be better positioned to comply with regulatory requirements while reducing exposure to evolving cyber threats.
Rather than treating NIS2 as a compliance exercise, organizations should view it as an opportunity to build sustainable cybersecurity resilience that supports business continuity, stakeholder confidence, and long-term digital growth.
Talk to Intertek
Whether your organization is determining whether it falls within scope, assessing current readiness, or strengthening cybersecurity capabilities, Intertek can help you navigate NIS2 requirements with confidence.
Contact our cybersecurity specialists to discuss your NIS2 readiness journey and identify the next steps toward compliance and resilience.
