NIS 2 Directive: A Comprehensive Compliance Guide

Posted on by Bogdan Tiron
REGULATIONS NIS 2 Directive EU Network and Information Security — Comprehensive Compliance Guide 1 Risk Management Cybersecurity measures 2 Incident Handling 24h notification requirement 3 Supply Chain Third-party security 4 Governance Board accountability Essential Entities Important Entities Digital Infra Public Admin Healthcare fortbridge.co.uk

The NIS 2 Directive is the EU’s updated cybersecurity law for critical infrastructure. It expands the scope of the original NIS Directive, tightens security requirements, and introduces direct penalties for non-compliance. This article covers what NIS 2 requires, how penetration testing supports compliance, and what the penalties look like for essential and important entities.

Table of contents

What NIS 2 Is

The NIS 2 Directive, officially Directive (EU) 2022/2555, was published on December 14, 2022. It required all 27 EU Member States to transpose its provisions into national law by October 18, 2024. NIS 2 replaces the original NIS Directive (2016/1148) and applies to a much wider range of organizations.

Compliance depends on three factors: location (any organization providing services within the EU), size (more than 50 employees and over 10 million euros in annual revenue), and industry (energy, transport, banking, healthcare, digital infrastructure, and others). Organizations are classified as either essential entities (over 250 employees or over 50 million euros revenue in critical sectors, plus trust service providers, DNS providers, and public administration) or important entities (all others meeting the baseline criteria).

Security Requirements

NIS 2 Chapter IV sets out specific obligations. Article 20 requires top management to approve and oversee cybersecurity risk management. Article 21 mandates risk management measures including incident handling, supply chain security, network security, and business continuity. Article 22 focuses on supply chain risk assessments and third-party security. Article 23 requires incident reporting to competent authorities within 24 hours for initial notification and 72 hours for detailed analysis.

NIS 2 Directive – 10-Step Compliance Roadmap 1 Determine if your organization is in scope (Essential vs Important) ◉ 2 Conduct risk assessment Identify threats & gaps ◉ 3 Implement security measures Network, access, encryption ◉ 4 Establish incident response procedures Detection & escalation ◉ 5 Supply chain security controls Third-party risk ◉ 6 Business continuity planning Recovery & resilience ◉ 7 Penetration testing & vulnerability assessments Regular testing cycles ◉ 8 Train staff on cybersecurity awareness All personnel levels ◉ 9 Report incidents to national CSIRT Within 24 hours ◉ 10 Maintain documentation & demonstrate compliance Audit readiness ✓ NIS 2 COMPLIANCE ACHIEVED Continuous monitoring & improvement required Steps 1-5: Foundation & Implementation Steps 6-10: Assurance & Governance Ongoing: Continuous Compliance

Pentesting for NIS 2

Penetration testing supports NIS 2 compliance across several requirements. It provides evidence for the risk management measures mandated by Article 21, validates that technical controls like multi-factor authentication and encryption are working as intended, and tests incident detection and response mechanisms. Pentesting can also extend to third-party systems and supply chain integrations, helping satisfy Article 22’s supply chain security requirements.

Penalties

NIS 2 imposes significant fines. Essential entities face penalties up to 10 million euros or 2% of total annual turnover. Important entities face up to 7 million euros or 1.4% of total annual turnover. Top management can be held personally liable for non-compliance, making executive involvement in cybersecurity governance non-optional.

NIS 2 Directive – Penalty Comparison Administrative fines by entity classification E ESSENTIAL ENTITIES Maximum Administrative Fine €10 Million Or % of Annual Worldwide Turnover 2% whichever is higher ! Management Liability Personal accountability of C-level Temporary ban from management roles I IMPORTANT ENTITIES Maximum Administrative Fine €7 Million Or % of Annual Worldwide Turnover 1.4% whichever is higher ! Management Liability Senior management personal accountability Supervisory measures & compliance orders VS Member states may impose additional sanctions including public disclosure of non-compliance and periodic penalty payments
NIS 2 Directive – Framework Relationships Intersection with complementary regulatory and standards frameworks NIS 2 Directive (EU) 2022/2555 ISO 27001 ISMS Standard Information security management system HIGH GDPR Data Protection Personal data processing & breach notification MODERATE DORA Financial Sector Resilience Digital operational resilience for financial entities MODERATE CER Directive Critical Entities Resilience Physical & cyber resilience of critical infrastructure HIGH PCI DSS Payment Card Security Payment card industry data security standard PARTIAL High overlap Moderate overlap Partial overlap

Relationship with Other Frameworks

NIS 2 overlaps with several other regulations. ISO 27001 is referenced as a framework for implementing cybersecurity risk management measures, though not required. GDPR differs in scope – it covers any organization processing personal data, while NIS 2 targets essential and important entities for cybersecurity. DORA focuses specifically on financial institutions’ operational resilience. The CER Directive (Critical Entities Resilience) addresses broader resilience and business continuity for critical entities. PCI DSS applies to organizations handling payment card information.

How FORTBRIDGE Can Help

At FORTBRIDGE, our senior consultants deliver penetration testing aligned with NIS 2’s requirements. We test your technical controls, supply chain security, and incident response readiness, providing actionable reports that support your compliance obligations. Accredited by DESC and CREST, we help organizations meet the directive’s standards and reduce their exposure to penalties. Contact us to discuss your NIS 2 compliance needs.

About Post Author

Bogdan Tiron

Cloud Application Security Consultant/ Pentester

OSCP/CRT/GCP Architecture/GCP Security/DevSecOps

See author's posts