NIS2 guide: What the directive means for your organisation
Is your organization covered by NIS2?
NIS2 is the EU's cybersecurity directive, covering 18 sectors from energy and health to manufacturing and digital infrastructure. If you're in scope, you face new requirements for risk management, incident reporting, management accountability and supply chain security.
And even if you're not directly covered, your customers may still require you to meet NIS2-level security.
This free NIS2 guide gives you a clear answer, and a practical overview of what to do next.
What you'll get in the NIS2 guide
Who NIS2 applies to
Understand which organisations may be directly covered by NIS2 and why others may still be affected through their customers, suppliers or wider supply chain.
A practical NIS2 decision tree
Not sure whether NIS2 applies to your organisation? The guide includes a decision tree to help you work through the key questions and get a clearer picture of where you stand.
The minimum NIS2 requirements
Security measures, training and incident reporting deadlines explained in plain language.
Management responsibilities
NIS2 makes cybersecurity a management responsibility, not simply an IT issue. The guide explains what this means for management involvement, oversight and accountability.
Training and awareness
Explore the role of cybersecurity training for management, board members and key employees, and why awareness needs to extend beyond the security team.
Incident reporting
Understand the requirements for reporting significant incidents and why clear processes and responsibilities matter before an incident occurs.
Supply chain security
Your organisation’s security does not stop at its own systems. The guide looks at the role suppliers play under NIS2 and what organisations need to consider when managing supply chain risk.
Why NIS2 matters beyond compliance
NIS2 is not only about meeting regulatory requirements. The Directive is designed to strengthen cybersecurity and resilience across organisations and their supply chains.
A structured approach can help you understand your risks, establish clearer responsibilities and become better prepared to respond when something goes wrong.
And even if your organisation is not directly covered by NIS2, your customers or partners may increasingly expect you to demonstrate how you manage cybersecurity risk.
The result is a stronger foundation for compliance, resilience and trust.
FAQ
Does NIS2 apply to my organisation?
That depends on factors including your organisation’s sector, size and activities. The guide explains the scope of NIS2 and includes a decision tree to help you assess whether your organisation may be directly covered.
Can NIS2 affect us even if we are not directly covered?
Yes. Organisations can be indirectly affected through customers, suppliers and other business relationships. Companies that are directly covered may place additional cybersecurity requirements on their suppliers.
What areas does NIS2 cover?
NIS2 covers areas including cybersecurity risk management, incident handling, business continuity, supply chain security, management responsibility, training and incident reporting.
Is NIS2 only an IT responsibility?
No. NIS2 places clear responsibilities on management. Cybersecurity therefore needs to be considered as an organisational and business issue, rather than something managed solely by IT or security teams.
