NIS2: What Companies Need to Know About the New Cybersecurity Directive

· Updated on · By Aymeric GuyardAymeric Guyard · 4 min read

NIS2: What Companies Need to Know About the New Cybersecurity Directive

1. What is the NIS 2 directive?

The NIS2 directive (Network and Information Security 2) is a European text adopted to strengthen the cybersecurity of public and private entities in Europe. It replaces the NIS 1 directive of 2016 and significantly expands the scope of the entities concerned, while imposing stricter requirements regarding information systems security.

2. What are the differences between NIS 1 and NIS 2?

Criterion NIS 1 NIS 2
Number of entities concerned A few hundred Several thousand
Sectors covered 10 critical sectors 18 sectors + supply chains
Obligations Incident reporting Cybersecurity measures + training + governance
Sanctions Not clearly defined Enhanced legal liability

3. Why is the NIS 2 directive strategic for the EU?

  • Increase in cyberattacks targeting SMEs and subcontracting chains
  • Standardization of cybersecurity across all Member States
  • Creation of a European crisis management network (CyCLONe)
  • Securing the economic fabric and essential services

4. Is my company affected by NIS 2?

✔️ You are concerned if:

  • You belong to one of the 18 sectors listed in Annexes I and II (e.g.: health, energy, digital, telecoms, water, finance, public administration, etc.)
  • Your company exceeds the following thresholds:
    • ≥ 50 employees
    • OR > €10 million in revenue or annual balance sheet
  • You provide a critical service (even below the thresholds, upon designation by the State)

5. What if my company is multinational or has multiple legal entities?

Each entity is assessed separately according to:

  • Its place of establishment (subsidiary, branch, office)
  • Its cybersecurity governance (main establishment)
  • The sector concerned
  • The country in which it provides services

The group is not legally considered as a single entity.

6. Are local authorities concerned by NIS 2?

Yes, potentially. Each Member State can choose to include certain local authorities in the NIS2 scope. In France, this scope is currently being defined, but ANSSI strongly recommends that local authorities prepare now.

7. How to register as an entity regulated by NIS 2?

  • Go to the Mon Espace NIS 2 portal (ANSSI)
  • Fill in the mandatory information:
    • Name, contact details, exposed IP addresses
    • Sector and subsector of activity
    • Member States served
  • Report any changes within 2 weeks to 3 months depending on your status

8. What are the new cybersecurity obligations imposed by NIS 2?

Essential and important entities must implement the following 10 pillars (Article 21):

  1. Risk analysis and IS security
  2. Incident management
  3. Business continuity (backups, recovery)
  4. Supply chain security
  5. Software development security
  6. Assessment of the effectiveness of measures
  7. Cyber hygiene and employee training
  8. Use of cryptography
  9. Human resources security
  10. Strong authentication and secure communication systems

Management is legally responsible for implementation.

9. Which information systems are concerned by NIS2?

All of the entity's information systems are concerned, not only those related to critical services. A partial exclusion is possible if a risk analysis demonstrates that certain systems have no potential impact on activities.

10. How to determine if an incident is "significant" and must be reported?

An incident is qualified as significant if it:

  • Seriously disrupts services
  • Causes major financial losses
  • Affects third parties (customers, partners, etc.)

ANSSI will publish a decree specifying the criteria and reporting procedure.

11. Can you freely choose your service provider to achieve compliance?

Yes. Regulated entities are free to choose their cybersecurity provider. It is recommended to select a provider with expertise in NIS2 regulation, risk management and IT security audits.

12. How does NIS 2 interact with GDPR, DORA and CRA?

  • NIS 2 & GDPR: complementary obligations (data protection vs system security)
  • NIS 2 & DORA: DORA takes precedence for financial entities (lex specialis)
  • NIS 2 & CRA: NIS 2 targets service operators, the CRA concerns digital products sold on the market

13. What are the financial thresholds and staffing levels to be considered?

Criterion Small enterprise Medium enterprise (min. NIS 2)
Workforce < 50 employees ≥ 50 employees
Turnover < €10M ≥ €10M
Annual balance sheet < €10M ≥ €10M

Companies exceeding one of the three thresholds are potentially regulated by NIS 2.

14. Which sectors are covered by NIS 2?

Annex I – Essential Entities (Highly Critical Sectors)

  1. Energy:
    • Electricity (generation, transmission, distribution)
    • District heating and cooling
    • Oil (production, refining, storage, transport)
    • Gas (supply, transport, distribution, storage)
    • Hydrogen
  2. Transport:
    • Air
    • Rail
    • Water (maritime and inland)
    • Road
  3. Banking: Credit institutions
  4. Financial market infrastructures:
    • Trading venue operators
    • Central counterparties
  5. Health:
    • Healthcare providers
    • EU reference laboratories
    • Manufacturers of essential medical devices and pharmaceuticals
  6. Drinking water
  7. Wastewater
  8. Digital infrastructures:
    • Providers of Internet exchange points, DNS, cloud, etc.
  9. ICT service management: MSP, MSSP
  10. Central public administration
  11. Space: Operators of space-related services

Annex II – Important Entities (Critical Sectors)

  1. Postal and courier services
  2. Waste management
  3. Chemicals
  4. Food and beverage
  5. Manufacturing (medical equipment, computer equipment, vehicles, etc.)
  6. Digital providers (online marketplaces, search engines, social networks)
  7. Research organisations