The rules, in plain words
NIS2
Network and Information Security Directive 2 · Directive (EU) 2022/2555 · EU
Medium and large organisations across 18 sectors must manage cybersecurity risk properly, report significant incidents fast, and hold their management personally accountable for it.
Who it applies to. Medium and large organisations in eighteen sectors - energy, transport, banking, health, water, digital infrastructure, manufacturing, food, waste, digital providers and more. Some categories are caught regardless of size.
In plain words
NIS2 replaced an earlier directive that covered too few organisations and asked too little. It widens the net considerably and raises the bar on what counts as adequate.
Because it is a directive rather than a regulation, it does not apply directly. Each member state writes it into national law, which means the detail - and the penalties - vary by country. What you actually comply with is your national transposition.
Two things make it bite. Incidents have to be reported on a short clock, starting from when you became aware rather than when you finished investigating. And the management body has to approve and oversee the security measures, with personal liability attached - it cannot be delegated to IT and forgotten.
A worked example. Bulgaria transposed NIS2 through an amending act to its Cybersecurity Act (Закон за киберсигурност, ЗКС), promulgated in State Gazette issue 17 of 13 February 2026. It is a concrete look at what "your national transposition" turns into: the same directive, with national scope, timing and accountability attached. The explainer is in Bulgarian.
Timing
When it applies.
- 17 October 2024
- Deadline for member states to transpose NIS2 into national law. Several missed it, so national timing varies.
- Varies by country
- Your actual obligations start when your country's transposing law takes effect.
What it means for your architecture
The part that is decided at design time.
- You cannot report an incident in 24 hours if you cannot detect it. That is a telemetry and logging problem, decided long before the incident.
- Logging has to be good enough to reconstruct what happened, and retained long enough to be useful.
- Access control, segmentation and supply-chain security move from good practice to evidenced obligation.
- Business continuity and recovery have to be tested, with the test producing evidence someone else will accept.
Read the real thing
This is an engineering explainer, not legal advice. How the rules apply to your organisation is a question for your counsel and your compliance function. What your architecture can evidence against them is the question Northkeep answers.
Also worth knowing
The other rules in play.
-
DORA
Financial firms must prove they can keep running when their technology fails - including when the failure is at a supplier like AWS.
-
US CLOUD Act
US authorities can compel a US-based provider to hand over data it controls, even when that data is stored on servers in Europe.
-
EU AI Act
AI systems are sorted by how much harm they could do, and the riskier ones carry real obligations - documentation, human oversight, logging and data governance.