NIS2 Directive

NIS2 (Directive 2022/2555) regulates operators, not manufacturers: roughly 160,000 "essential" and "important" entities across 18 sectors, from hospitals to cloud providers.

It requires ten minimum risk-management measures and a three-stage incident cascade (24 hours, 72 hours, one month), plus personal liability for management who fail to oversee compliance. Fines reach 10 million euros or 2% of turnover.

Where the Cyber Resilience Act (see R-01) reaches the manufacturer who builds the product, NIS2 reaches the organization that runs it.

Discussion prompts

• Is your organization an "essential" or "important" entity under NIS2, and does leadership know which?
• What changes if your executives face personal liability for a compliance failure?
• How does regulating operators create different incentives than regulating manufacturers?