What are the main differences from NIS1?

NIS2 significantly widens the scope (from ~2,000 to ~10,000 entities in France), makes senior management personally liable, harmonises penalties across the EU and imposes supply chain security requirements.

When does NIS2 apply?

The directive had to be transposed in each Member State before 17 October 2024. In France, the transposition law was adopted on 30 April 2025.

What happens if I don't comply?

Financial penalties of up to €10M (2% of global turnover) for essential entities, personal liability for senior management, and a possible temporary suspension of activity.

Is an outsourced CISO enough to achieve compliance?

An outsourced CISO is an essential building block (steering, expertise, reporting), but NIS2 compliance also requires a risk management platform, deployed technical measures and staff awareness training.

Regulation NIS2

Everything you need to know about the directive NIS2

The NIS2 directive strengthens cybersecurity across European businesses and public administrations. It significantly widens the scope of entities covered and toughens penalties. With Data Comply One, manage your NIS2 compliance in an integrated way.

Book a call Discover NIS2 software

Oct. 2024

Transposition deadline

~10 000

French entities in scope

€10M

or 2% of worldwide turnover (max)

10 measures

mandatory security measures

What is the NIS2 directive?

The NIS2 directive (Network and Information Security 2) is the revision of the 2016 NIS directive. Adopted in 2022 and transposed in France by the law of 30 April 2025, it imposes strengthened cybersecurity obligations on a far larger number of entities than before. Its objective: to raise the European Union's level of cyber resilience in the face of a growing number of attacks.

What's new in NIS2 vs NIS1

Wider scope: more than 10,000 French entities now in scope

Personal liability of senior management is engaged

European harmonisation of penalties and notifications

Supply chain: obligations to secure ICT suppliers

Who is in scope of NIS2?

NIS2 distinguishes two categories of entities: essential and important. General criterion: more than 50 employees OR €10M in turnover, in one of the sectors listed by the directive.

Essential entities: energy, transport, health, water, digital infrastructure, finance, space, public administrations

Important entities: postal services, waste management, chemicals, food, manufacturing, digital services

SMEs included in critical sectors from 50 employees or €10M in turnover

Critical suppliers of essential entities (supply chain)

The 10 mandatory security measures

NIS2 imposes 10 minimum cybersecurity risk-management measures (Article 21). They cover governance, technical and operational aspects.

Formalised information systems security policy (ISSP)

Incident management and response plan

Business continuity and crisis management

Supply chain security (ICT supply chain)

Secure acquisition, development and maintenance

Effectiveness of measures: periodic audits, penetration testing

Cyber hygiene and training for staff

Encryption and cryptography

Access control and asset management

Multi-factor authentication (MFA)

Incident notification

In the event of a significant incident, NIS2 entities must notify ANSSI according to a strict timeline.

Early warning within 24 hours: as soon as the incident is detected

Notification within 72 hours: preliminary assessment

Final report within 1 month: causes, corrective measures

Obligation to inform recipients if services are affected

Penalties and governance

The NIS2 directive makes senior management personally liable. Financial penalties are harmonised across Europe.

Essential entities: up to €10M or 2% of worldwide turnover

Important entities: up to €7M or 1.4% of worldwide turnover

Individual liability of senior management (Article 20)

Temporary suspension of activity possible in the event of a serious breach

Governance: management accountability

Management bodies must approve cyber risk-management measures

They must oversee their implementation

They must undergo training to acquire the necessary knowledge

Simplifiez votre conformité NIS2 avec Data Comply One

NIS2 software

Asset register, risk analysis, incident management, ICT supply chain, NIS2 dashboards.

Discover the software

Outsourced CISO

A cyber expert who steers your NIS2 compliance and your operational resilience.

Schedule a call

Cybersecurity training

Mandatory awareness training on NIS2 issues for senior management and staff.

View the programme

Maturity audit

Assess your NIS2 compliance level in 30 minutes and identify your priorities.

Start an audit

FAQ NIS2

Any organisation with more than 50 employees or €10M in turnover in one of the 18 sectors listed by the directive. A scoping audit is recommended to confirm your status (essential or important entity).