DirectiveEuropean Union

NIS2 Directive (NIS2)

Raises the common level of cybersecurity across the EU.

Request an Assessment

Verify current status

As a Directive, NIS2 binds via national implementing laws — check the specific member state. Transposition has lagged in several states.

Classification

Directive

Issuing authority

European Union (Directive (EU) 2022/2555)

Jurisdiction

European Union · Sector: Essential/important entities

Status / edition

In force; transposed into national law (dates vary by member state)

Key dates

Entered into force January 2023; member-state transposition deadline 17 October 2024

Mandatory or voluntary

Mandatory (sector-specific)

Who it applies to

'Essential' and 'important' entities in listed sectors — exact obligations arise under each member state's implementing law.

Purpose

Raises the common level of cybersecurity across the EU.

Major requirements / obligations

  • Cyber risk-management measures
  • Incident reporting
  • Governance accountability
  • Supply-chain security

Control domains

GovernanceRisk assessmentIncident responseSupplier management

Official reference

https://eur-lex.europa.eu/eli/dir/2022/2555/oj ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.