NIS2 Directive
Directive (EU) 2022/2555 (NIS2)
NIS2 is the EU's cybersecurity directive raising security and incident-reporting obligations for essential and important entities across many critical sectors. Member States had to transpose it by 17 October 2024 and apply the measures from 18 October 2024, but many missed the deadline: the Commission sent reasoned opinions to 19 Member States in May 2025 and on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice. It significantly expands the scope of the original 2016 NIS Directive.
Who it applies to
Medium and large entities operating in sectors deemed essential or important, such as energy, transport, banking, health, digital infrastructure, and ICT service management. Some entities are covered regardless of size, and the rules can reach non-EU providers serving the EU.
Identity requirements
- Adopt risk management measures including access control policies and authentication mechanisms
- Implement multi-factor or continuous authentication where appropriate as a baseline measure
- Govern and secure privileged and administrative access to network and information systems
- Report significant incidents to the CSIRT or competent authority, with an early warning within 24 hours
- Ensure management accountability for cybersecurity risk-management measures
- Manage supply chain and identity-related risks from ICT third parties
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Names multi-factor or continuous authentication among the baseline cybersecurity risk-management measures. |
| Privileged access (PAM) | Requires control and protection of privileged and administrative access to critical systems. |
| Breach notification | Requires an early warning within 24 hours and follow-up reporting for significant incidents. |
| Audit, logging & accountability | Holds management accountable and expects logging and oversight of security measures and incidents. |
| Identity governance (IGA) | Drives access control policies and identity-related supply chain risk management. |
Upcoming deadlines
- April 17, 2027 NIS2: Member States review entity lists and notify the Commission
- October 17, 2027 NIS2: first Commission review of the Directive
Penalties
Member States must set maximum administrative fines of at least 10 million euros or 2 percent of total worldwide annual turnover, whichever is higher, for essential entities that breach the risk-management (Article 21) or reporting (Article 23) duties, and at least 7 million euros or 1.4 percent for important entities.
Status and dates last verified against primary sources on 2026-10-31.
NIS2 Directive: frequently asked questions
- Who must comply with NIS2?
- Medium and large entities in essential or important sectors such as energy, health, banking, digital infrastructure, and ICT services, plus certain entities covered regardless of size.
- Does NIS2 require multi-factor authentication?
- Yes, NIS2 lists the use of multi-factor or continuous authentication solutions among the baseline cybersecurity risk-management measures where appropriate.
- How fast must incidents be reported under NIS2?
- Affected entities must submit an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident, followed by further reporting.
- Has every Member State transposed NIS2?
- Not on time. The Commission opened infringement procedures against most Member States after the October 2024 deadline, issued reasoned opinions to 19 of them in May 2025, and on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice. Check the national law in each country where you operate, because obligations apply through national transposition.