Question 1

Who is subject to NIS2 in the United Kingdom?

Accepted Answer

NIS2 as an EU directive does not directly apply in the UK following Brexit; the UK has its own Network and Information Systems (NIS) Regulations 2018, which are under review. However, UK entities operating in the EU or part of groups with EU subsidiaries may be indirectly affected. EU NIS2 applies to entities in 18 defined sectors (energy, transport, health, banking, digital infrastructure, water, food, manufacturing, etc.) that exceed certain size thresholds. Essential entities are large organisations (more than 250 employees or more than €50 million turnover) in highly critical sectors listed in Annex I. Important entities cover medium-sized organisations (more than 50 employees or more than €10 million turnover) across all covered sectors.

Question 2

When did NIS2 come into effect?

Accepted Answer

Directive (EU) 2022/2555, known as NIS2, was published in the Official Journal of the European Union on 27 December 2022. EU Member States had until 17 October 2024 to transpose it into national law and begin applying it. This date therefore marks the effective entry into force of NIS2 across the EU. The NCSC in the UK monitors EU cybersecurity developments and advises UK organisations on maintaining equivalent standards. Organisations with EU operations should already be assessing compliance with the national transpositions of NIS2 applicable in each EU country where they operate.

Question 3

What are the NIS2 sanctions?

Accepted Answer

NIS2 establishes two levels of administrative sanctions depending on the category of the entity. For essential entities, the maximum fine is €10,000,000 or 2% of total global annual turnover of the preceding financial year, whichever is higher. For important entities, the cap is €7,000,000 or 1.4% of total global annual turnover. Beyond financial penalties, national authorities can issue compliance orders, temporarily suspend certifications or authorisations, and make infringements public. Senior management can also be held personally liable for failures to implement required cybersecurity measures.

Question 4

Does NIS2 apply to subcontractors?

Accepted Answer

Yes, NIS2 has an extended reach across the supply chain. Subject entities (both essential and important) are obliged to ensure that their suppliers and service providers who access their information systems or process critical data maintain an adequate level of security. In practice, this means that IT subcontractors and suppliers of NIS2-subject entities will have security requirements imposed via contractual clauses, security questionnaires, and potentially audits. Even if a company is not directly subject to NIS2, it may need to comply with security requirements to retain its regulated clients.

Question 5

How to notify an incident to the NCSC?

Accepted Answer

Under EU NIS2, the notification process involves several steps. Within 24 hours of detecting a significant incident, the entity must submit an early warning to the competent authority indicating whether the incident appears to result from a malicious act and whether it has a cross-border impact. Within 72 hours, a full notification must follow with an initial assessment of the incident, its severity and likely impacts. Within one month of resolution, a final report must be submitted with root cause analysis and corrective measures adopted. UK organisations should report significant cyber incidents to the NCSC and their relevant sector regulator through established channels.

Question 6

What is the difference between essential and important entities?

Accepted Answer

The distinction between essential entities (EE) and important entities (IE) rests primarily on two criteria: the sector of activity and the size of the organisation. Essential entities operate in highly critical sectors listed in Annex I of the directive (energy, transport, health, water, digital infrastructure, etc.) and exceed large-enterprise thresholds. Important entities cover both medium-sized organisations in Annex I sectors and organisations in the additional sectors of Annex II (food, chemicals, manufacturing, etc.). The main practical difference concerns the supervision regime: EEs are subject to regular proactive controls, while IEs are subject to reactive supervision triggered by an incident or complaint. Sanctions are also higher for EEs.

Question 7

Does NIS2 replace GDPR?

Accepted Answer

No, NIS2 does not replace the GDPR. These two regulations are complementary and coexist. The GDPR (General Data Protection Regulation) concerns the protection of personal data and applies to any organisation processing data of European residents, regardless of size or sector. NIS2 concerns the security of networks and information systems of entities operating in critical sectors. The two frameworks mutually reinforce each other: good NIS2 cybersecurity practices contribute to the personal data security required by GDPR. In the event of a cyber incident resulting in a data breach, an organisation may simultaneously be subject to NIS2 notification obligations (to the competent NIS2 authority) and GDPR notification obligations (to the relevant data protection authority).

Question 8

Is my hosting provider responsible for my NIS2 compliance?

Accepted Answer

No, your hosting provider cannot be held responsible for your NIS2 compliance. Responsibility for compliance lies with the subject entity itself, meaning your organisation. It is a shared responsibility: if you use cloud or hosting services, you must ensure that your providers maintain adequate security levels (this is the supply chain security obligation), but overall compliance remains your responsibility. This includes governance, risk management, incident notification, and business continuity. In practice, you will need to structure your contractual relationships with IT providers to incorporate security clauses meeting NIS2 requirements.

Question 9

Does NIS2 apply to very small businesses?

Accepted Answer

As a general rule, NIS2 does not apply to micro and small enterprises (fewer than 50 employees and less than €10 million turnover). The directive was designed to target entities whose failure would have a significant impact on society or the economy. However, there are important exceptions: certain types of entities are subject to NIS2 regardless of size, including operators of public electronic communications networks, DNS service providers, top-level domain name registries, and qualified trust service providers. Furthermore, even a micro-enterprise may be indirectly affected if it is a subcontractor of a subject entity.

Question 10

What is the deadline for NIS2 compliance?

Accepted Answer

The NIS2 entry into force date was 17 October 2024; obligations are therefore theoretically applicable since that date across the EU. Each EU Member State has transposed the directive at its own pace, and national authorities are progressively identifying and notifying subject entities. It is strongly recommended to begin compliance preparations without waiting for official notification, as full compliance requires several months of work: asset mapping, risk analysis, implementation of technical and organisational measures, and staff training. Organisations that delay risk sanctions once national authorities begin their supervisory activities.

Question 11

How to prove NIS2 compliance?

Accepted Answer

NIS2 does not provide for a single mandatory certification, but proof of compliance rests on comprehensive documentation and regular audits. A compliant entity should have a security policy documented and approved by management, an up-to-date risk analysis, an incident register, a tested business continuity plan, evidence of training, supplier contracts including security clauses, and internal or external audit reports. National authorities may request these documents as part of their supervisory activities. Using recognised frameworks such as ISO 27001, Cyber Essentials (UK), or the NIST Cybersecurity Framework can facilitate demonstrating compliance, even if not an explicit directive requirement.

Question 12

Does NIS2 concern associations and nonprofits?

Accepted Answer

Associations and nonprofits may be subject to NIS2 if they carry out activities in one of the 18 covered sectors and exceed size thresholds (50 employees or €10 million budget). For example, an association managing a water distribution network, a healthcare establishment in associative form, or a scientific research foundation could be subject to the directive. The legal form (association, foundation, charity, etc.) is not the determining criterion: it is the nature of the activity and the size thresholds that matter. Small associations operating outside critical sectors are generally not affected. When in doubt, consult your national NIS2 authority or a specialist lawyer.

Question 13

What is the NIS2 supply chain?

Accepted Answer

Supply chain security is one of the 10 core obligations under NIS2. It requires subject entities to assess and manage cybersecurity risks arising from their relationships with suppliers and service providers, particularly those who access their information systems, process critical data, or supply software components integrated into their products. In practice, this translates into mapping critical suppliers, conducting security questionnaires, incorporating contractual clauses imposing minimum security levels, and establishing audit rights. This obligation responds to the proliferation of supply chain attacks (such as SolarWinds) that bypass an organisation's defences by targeting its suppliers.

Question 14

Does the NCSC already supervise companies under NIS?

Accepted Answer

Yes, the NCSC and sector regulators already exercise supervisory powers under the UK NIS Regulations 2018, which applied to operators of essential services and relevant digital service providers. Under those regulations, designated authorities can carry out assessments, issue improvement notices, and apply financial penalties for serious failures. The UK government is reviewing its NIS framework to align with the enhanced requirements of the EU's NIS2, which significantly extends the scope and strengthens supervisory powers. UK organisations should engage proactively with their sector regulator and the NCSC to understand current expectations and upcoming regulatory changes.

Question 15

Does NIS2 apply across Europe?

Accepted Answer

Yes, NIS2 is a European directive that applies to all 27 EU Member States. However, as a directive (rather than a regulation), it requires transposition into the national law of each Member State. This means that practical implementation details (entity identification, notification processes, effective sanctions) may vary between countries, even though the substantive requirements are harmonised. For international groups, this means tracking transposition in each relevant country. The supervision mechanism is organised around the principle of the main establishment: an entity operating in several Member States is generally supervised by the authority of the country where its main establishment is located for cross-border services.

Frequently asked questions about NIS2

Frequently asked questions about NIS2