The NIS2 (Network and Information Security Directive) establishes a fundamental framework for cybersecurity across critical sectors. It builds on the original NIS1 Directive, adopted in 2016 as the first EU-wide effort to standardise cybersecurity within the legal systems of Member States. In December 2022, the EU Council and the European Parliament adopted NIS2, revising and strengthening cybersecurity requirements throughout the EU.
Since NIS2 is a directive and not a formal regulation, it is not directly applicable in Member States until it is transposed into national legislation. As a result, national legislators must update their information security laws to comply with the directive by the deadline set by the EU: 17 October 2024.
NIS2‘s primary aim is to strengthen cybersecurity requirements across the EU. It broadens its scope to cover more sectors and entities while introducing measures such as:
Additionally, NIS2 seeks to streamline incident reporting obligations, making compliance more transparent and efficient.
NIS2 replaces the original NIS Directive introduced in 2016, the EU’s first legislative act on cybersecurity. The updated directive significantly expands the original framework, introducing key changes, including:
NIS2 directly impacts companies across various sectors, including energy, transport, healthcare, and financial services. Complying with NIS2 requirements can offer the following key benefits:
An organisation is subject to the NIS2 Directive if:
*Critical entities:
Critical entities are typically medium- or large-sized organisations considered essential to the economy and operating in a sector listed in the left-hand column of the sectoral scope.
**Essential entities:
Essential entities are typically medium- or large-sized organisations that, while important to the economy, are not classified as critical. They operate in a sector listed in the right-hand column of the sectoral scope.
Exceptions: Companies that are the sole providers of a given service in an EU Member State or whose service disruption could significantly impact may be classified as essential or critical entities, regardless of size.
Criteria for classification as a large organisation:
Note: Specific thresholds for these criteria are still to be defined in Portuguese legislation.
Criteria for classification as a medium-sized organisation:
Note: Specific thresholds for these criteria are still to be defined in Portuguese legislation.
Small and micro-enterprises are not automatically excluded from the scope of NIS2. Member States may extend NIS2 obligations to smaller entities if they meet specific criteria, such as playing a key role in society, the economy, or particular sectors or service types.
and embrace the digital transformation with Eurotux.
