This article provides general educational information about NIS2 requirements. It is not legal advice. Businesses with specific compliance questions should consult a qualified legal adviser in the relevant EU member state.
The Most Important Question: Does NIS2 Apply to Your Business?
The EU NIS2 Directive (Directive 2022/2555 on the Security of Network and Information Systems) has been active across EU member states since October 2024. It applies to approximately 160,000 entities across 18 sectors — a tenfold expansion from the roughly 15,000 covered under the original NIS Directive.
The first question every small business needs to answer is whether it falls within NIS2’s scope directly. The honest answer for most small businesses: probably not directly, because NIS2’s size thresholds exclude micro-enterprises (under 10 employees and under €2 million turnover) and small enterprises (under 50 employees and under €10 million turnover) in most sectors.
But the second question — which many small businesses miss — is whether they supply goods or services to a business that is covered. If you do, NIS2’s supply chain security requirements may pull your organisation into compliance obligations indirectly, through the contractual terms your client imposes on you. In 2026, this indirect route affects far more small businesses than direct NIS2 scope does.
This guide explains who is covered directly, what the requirements are, what the penalties are, and what small businesses below the thresholds need to understand about the supply chain implications.
What NIS2 Is and Why It Matters
The NIS2 Directive is the EU’s primary cybersecurity legislation for network and information systems. It replaced the original NIS Directive (2016/1148) and entered into force on 16 January 2023. Member states were required to transpose it into national law by 17 October 2024, with obligations applying from that date.
In practice, transposition was uneven. Only a small number of member states met the October 2024 deadline. The European Commission opened infringement procedures against 23 member states in November 2024 and issued reasoned opinions to 19 states in May 2025. By 2026, most member states have either fully transposed NIS2 or are in the final stages of implementation, and enforcement is underway in the transposing states. The Netherlands’ Cybersecurity Act, for example, entered into effect on 15 August 2026.
The key point: NIS2 obligations are real and enforcement is active in the states that have transposed. Businesses in those states cannot defer compliance pending other member states’ timelines.
On 20 January 2026, the European Commission proposed targeted amendments to NIS2 as part of a broader cybersecurity package. These amendments aim to increase legal clarity and reduce compliance burden — particularly for the estimated 6,200 micro and small enterprises affected. The amendments are proposals, not yet in force, and the core NIS2 obligations covered in this article remain the applicable framework.
Who NIS2 Covers: The Sector and Size Test
NIS2 applies to organisations that meet both of two criteria:
Criterion 1 — Sector: The organisation operates in one of the 18 sectors covered by NIS2.
Criterion 2 — Size: The organisation qualifies as a medium or large enterprise.
Both must be met to be in direct scope. Being a large business in an uncovered sector is not enough. Operating in a covered sector as a micro-business is not enough (with specific exceptions).
The 18 Covered Sectors
NIS2 divides covered sectors into two annexes with different oversight levels:
Annex I — Highly Critical Sectors (Essential Entities):
- Energy (electricity, oil, gas, hydrogen, district heating and cooling)
- Transport (air, rail, water, road)
- Banking
- Financial market infrastructure
- Health (hospitals, EU reference laboratories, pharmaceutical manufacturers, medical device manufacturers)
- Drinking water
- Wastewater
- Digital infrastructure (internet exchange points, DNS service providers, TLD name registries, cloud computing services, data centre services, content delivery networks, trust service providers, public electronic communications networks and services)
- ICT service management (managed service providers, managed security service providers — in scope regardless of size)
- Public administration
- Space
Annex II — Other Critical Sectors (Important Entities):
- Postal and courier services
- Waste management
- Manufacture, production, and distribution of chemicals
- Food production, processing, and distribution
- Manufacturing (medical devices, computers and electronics, machinery, motor vehicles, other transport equipment)
- Digital providers (online marketplaces, online search engines, social networking platforms)
- Research organisations
The Size Thresholds
In most covered sectors, NIS2 applies to:
Essential entities: Large enterprises in Annex I sectors — 250 or more employees, OR annual turnover exceeding €50 million and balance sheet total exceeding €43 million.
Important entities: Medium enterprises in Annex I or Annex II sectors — 50 or more employees, OR annual turnover and balance sheet total both exceeding €10 million.
Micro-enterprises (fewer than 10 employees AND under €2 million turnover) and small enterprises (fewer than 50 employees AND under €10 million turnover) are excluded from NIS2 direct scope in most sectors.
The Exceptions to the Size Rule
Several categories of organisations fall within NIS2 regardless of size:
- Trust service providers
- Top-level domain name registries and DNS service providers
- Managed service providers (MSPs) and managed security service providers (MSSPs)
- Organisations that are the sole provider of a service essential to societal or economic activities in a member state
- Organisations where a disruption to services could have a significant impact on public safety, security, or health
If your business is a managed IT or security service provider operating in the EU, NIS2 applies to you regardless of headcount. This is one of the most significant scope expansions in NIS2 relative to the original directive.
The Two Categories: Essential vs Important Entities
NIS2 distinguishes between essential entities and important entities. Both must implement the same Article 21 security measures. The difference is in supervision.
Essential entities are subject to proactive, continuous supervision — regular audits, on-site inspections, security scans, and targeted audits even without evidence of a specific violation.
Important entities are subject to reactive supervision — triggered by incidents, complaints, or evidence of non-compliance. Supervisory authorities may conduct audits and inspections but are not required to proactively monitor in the same way.
The distinction matters operationally: essential entities are more likely to face audit activity and must be ready to demonstrate compliance at any time. Important entities are more likely to face scrutiny following a specific incident or notification.
The 10 Article 21 Security Measures: What You Must Implement
Article 21 of NIS2 is the compliance core. All in-scope entities — both essential and important — must implement risk management measures covering at least these 10 areas. The measures must be “appropriate and proportionate” to the risks, based on an “all-hazards” approach covering cyber, physical, environmental, and human threats.
1. Risk Analysis and Information System Security Policies
Establish and maintain documented policies for assessing and managing cybersecurity risks across your network and information systems. Risk assessments must be current and regularly reviewed. This is the foundation of everything else — without a documented understanding of your risks, none of the downstream measures can be proportionate.
In practice: Conduct and document an information security risk assessment. Identify your critical systems and data. Document threats, vulnerabilities, and risk treatment decisions. Review annually and after significant changes.
2. Incident Handling
Implement processes to detect, respond to, manage, and recover from security incidents. The incident handling requirement is directly linked to the reporting obligation under Article 23 (the 24-hour / 72-hour / 1-month reporting timeline). You cannot meet the reporting requirement if you don’t have detection and response processes in place.
In practice: A documented incident response plan. Detection capabilities (EDR, SIEM, monitoring, or the equivalent appropriate to your risk profile). Defined incident severity levels and escalation paths. An incident log. Tested response procedures — a plan that has never been exercised will fail under pressure.
3. Business Continuity and Crisis Management
Implement strategies for maintaining or resuming critical operations during and after a significant incident. This includes backup management, disaster recovery, and emergency mode operation.
In practice: Regular, tested backups of critical systems and data. A documented disaster recovery plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Manual workarounds for critical functions when systems are unavailable. Business impact analysis identifying which services must be restored first.
4. Supply Chain Security
Assess, monitor, and manage cybersecurity risks across the supply chain — including relationships with direct suppliers and service providers. NIS2 is explicit that supply chain security covers both the security practices of suppliers and the contractual and technical arrangements between entities and their suppliers.
In practice: Inventory of critical suppliers and service providers with access to your systems or data. Security assessments of those suppliers. Contractual clauses requiring suppliers to implement appropriate security measures. Process for addressing supplier security incidents that affect your environment.
This measure has the most significant implications for small businesses below the NIS2 thresholds. See the supply chain section below.
5. Security in Network and Information Systems Acquisition, Development, and Maintenance
Include security requirements in the procurement, development, and maintenance of networks, systems, and applications. Security must be designed in, not bolted on.
In practice: Security requirements in vendor and software procurement. Secure development practices for any internally developed software. Vulnerability management for acquired and developed systems. Security review of significant system changes before deployment.
6. Policies and Procedures for Assessing the Effectiveness of Cybersecurity Risk Management Measures
Evaluate whether your security measures are actually working. This is not just about having controls — it’s about testing and measuring them.
In practice: Regular security assessments and penetration testing. Vulnerability scanning. Monitoring of key security metrics. Internal audit of security controls. Documentation of findings and remediation.
7. Basic Cyber Hygiene Practices and Cybersecurity Training
Maintain baseline security practices across the organisation and ensure all personnel are trained. Training must extend to management — Article 20 establishes personal accountability for management bodies, and NIS2 requires that management members receive cybersecurity training.
In practice: Employee security awareness training covering phishing, password hygiene, incident reporting, and data handling. Management training on cybersecurity risks and governance. Documented training completion. Patch management, MFA, endpoint protection, and access control as core hygiene baseline.
8. Policies and Procedures Regarding the Use of Cryptography and Encryption
Implement encryption and cryptographic controls appropriate to your risk profile and the sensitivity of data you process.
In practice: Encryption of data at rest on critical systems and storage containing sensitive data. Encryption of data in transit using current TLS standards. Documented cryptography policy. Encryption of backup media.
9. Human Resources Security, Access Control Policies, and Asset Management
Manage the security of your people and their access to systems. This covers the full employee lifecycle — vetting before hire, security responsibilities during employment, and access revocation on departure.
In practice: Background checks appropriate to role sensitivity. Defined access control policies implementing least privilege. Unique user identifiers — no shared accounts. MFA on critical systems and remote access. Prompt deprovisioning on departure. Asset inventory of hardware and software.
NIS2 explicitly lists multi-factor authentication among the minimum expected controls in Article 21. It is not optional for covered entities.
10. Use of Multi-Factor Authentication, Continuous Authentication, and Secure Communications
Specifically addressed in Article 21 as a minimum expectation. MFA must be implemented across systems handling significant data or providing critical services. Secure communications systems for emergency use within the organisation are also expected.
In practice: MFA on all systems with internet-facing access, privileged accounts, cloud services, and email. Documented MFA policy. Secure channels for internal emergency communications during incidents.
The Incident Reporting Timeline: 24 Hours — 72 Hours — 1 Month
NIS2’s incident reporting obligations under Article 23 are one of the most operationally demanding requirements. When a significant incident occurs — one that causes or could cause serious disruption to the provision of services or significant financial losses — the reporting timeline is:
Within 24 hours: Submit an early warning to the relevant national Computer Security Incident Response Team (CSIRT) and competent authority. This report must state whether the incident is suspected to be malicious or unlawful in nature, and whether it could have cross-border impact. The 24-hour timeline requires detection to firing-to-notification in under a day — this is not achievable without pre-built detection and notification processes.
Within 72 hours: Submit a formal incident notification updating the early warning with an initial assessment of severity, likely impact, and indicators of compromise.
Within 1 month: Submit a final incident report including a full description of the incident, its root cause, remediation taken, and cross-border impact.
The 24-hour early warning is the operationally hardest requirement. It means that detection must fire within hours of an incident beginning, alert an on-call person promptly, be triaged as a significant incident within hours, and trigger a notification workflow to the relevant national authority — all before a day has elapsed.
For small and medium businesses covered by NIS2, this means:
- Detection capabilities must be in place (you cannot report what you haven’t detected)
- Incident severity classification must be pre-defined
- Reporting templates must be prepared in advance
- The national CSIRT for your sector and jurisdiction must be identified before an incident
- Someone must be on-call or reachable at all hours to make the notification decision
What counts as a “significant” incident? NIS2’s criteria include: incidents causing significant disruption to the provision of services; incidents causing significant financial losses to the entity; incidents affecting other persons by causing considerable material or non-material damage; incidents caused by malicious action that is unlawful. Member states’ national implementations may specify additional criteria.
Management Body Personal Liability: Article 20
This is one of NIS2’s most distinctive provisions, and one that surprises many organisations. Article 20 establishes direct personal liability for management bodies — board members, directors, and senior managers — for cybersecurity compliance failures.
Management bodies must:
- Approve the cybersecurity risk management measures implemented under Article 21
- Oversee their implementation
- Complete cybersecurity training
- Be personally accountable for non-compliance
In addition to fines on the organisation, NIS2 allows competent authorities to temporarily prohibit a natural person from exercising managerial functions in an essential entity where that person bears personal responsibility for a serious NIS2 violation.
For small businesses covered by NIS2: this means cybersecurity cannot be delegated entirely to an IT provider or technical staff and forgotten. Management must approve the security programme, understand the key risks, and demonstrate active oversight. The training requirement specifically addresses this — management must be trained, not just technical staff.
Penalties: What Non-Compliance Costs
NIS2 establishes a two-tier penalty structure:
Essential entities: Fines up to €10 million or 2% of total global annual turnover for the preceding financial year, whichever is higher.
Important entities: Fines up to €7 million or 1.4% of total global annual turnover for the preceding financial year, whichever is higher.
These are maximum figures — national regulators apply proportionality. But the basis (global annual turnover, not EU revenue) makes the potential penalties material even for businesses with modest EU operations if their global turnover is significant.
Beyond fines, regulators can: impose binding instructions requiring specific remediation actions; increase supervision frequency and intensity; require public disclosure of non-compliance; and (for essential entities) temporarily suspend services pending compliance remediation.
The Supply Chain Implications for Small Businesses Below the Thresholds
This is the section most NIS2 guides for small businesses omit, and it is where the most practical impact for micro and small enterprises lies.
Article 21 requires in-scope entities to implement supply chain security — assessing and managing security risks from their suppliers. When a covered entity (say, a large manufacturer, a hospital network, or a cloud platform) implements this requirement, they typically do so by:
- Assessing the security practices of their suppliers
- Requiring suppliers to meet specific security standards
- Imposing contractual security obligations on suppliers
- Potentially excluding suppliers who cannot demonstrate adequate security
If your small business supplies goods or services to a NIS2-covered entity — as a software vendor, IT service provider, component manufacturer, logistics provider, professional services firm, or any other role — you may receive contractual security requirements from your clients as a result of their NIS2 compliance programme.
These contractual requirements are not legally compelled by NIS2 itself — they’re imposed by the covered entity on its supply chain through commercial contracts. But the commercial reality is the same: fail to meet the requirements and you may lose the contract.
What supply chain obligations from covered clients typically include:
- Information security questionnaire completion and attestation
- Requirement to implement specific security controls (MFA, encryption, patching)
- Right to audit your security practices
- Contractual notification obligations if you experience a security incident that could affect their systems
- Requirement to maintain a named security contact
- ISO 27001 certification or equivalent evidence of security management (increasingly requested)
For a small business supplying NIS2-covered clients: even if you are below the NIS2 size thresholds, implement the core security controls — MFA, encryption, endpoint protection, patch management, documented policies — that your clients are likely to require in their vendor security programmes. This protects the commercial relationship and reduces breach risk simultaneously.
NIS2 and the UK
The UK left the EU before NIS2 came into force. NIS2 does not directly apply to UK-based businesses unless they operate or provide services within the EU.
The UK has its own network security legislation — the Network and Information Systems (NIS) Regulations 2018, based on the original NIS Directive. The UK government consulted on updating these regulations (the proposed Cyber Resilience Act approach) but a UK equivalent of NIS2 has not been enacted as of August 2026.
UK businesses with no EU presence or customers are not directly affected by NIS2. UK businesses that operate in the EU, have an EU establishment, or provide services to EU-based customers in covered sectors may fall within NIS2 scope — the directive applies based on where services are provided, not where the organisation is headquartered.
UK businesses supplying EU companies in covered sectors may face indirect supply chain obligations through their clients’ NIS2 compliance programmes, as described above.
NIS2 and Non-EU Businesses
NIS2’s reach extends beyond EU-headquartered businesses. The directive applies to any entity that:
- Provides services in the EU within a covered sector
- Has a designated representative in an EU member state if based outside the EU and providing services there
A US-based managed service provider with EU clients operating in covered sectors, for example, may fall within NIS2 scope. The operative test is where services are provided, not where the organisation is based.
Non-EU organisations providing services to EU-based covered entities should assess:
- Whether they provide services within covered sectors to EU customers
- Whether the size thresholds apply to their EU operations
- Whether their EU clients will require security attestation through supply chain requirements regardless of direct scope
How NIS2 Relates to Other Frameworks
NIS2 and ISO 27001: There is significant overlap between NIS2’s Article 21 requirements and ISO 27001:2022 Annex A controls. Organisations with an existing ISO 27001-certified ISMS will find that many NIS2 requirements are already addressed. ISO 27001 certification has become the most widely accepted method of demonstrating NIS2 compliance in practice. Remaining gaps include NIS2’s specific incident reporting timelines, the supply chain security provisions, and the management body accountability and training requirements.
NIS2 and GDPR: NIS2 and GDPR coexist and are complementary — they address different aspects of security and data protection. GDPR’s 72-hour breach notification requirement to supervisory authorities applies to personal data breaches. NIS2’s 24-hour early warning applies to significant incidents affecting the provision of services, which may or may not involve personal data. Both may apply simultaneously to a single incident. Incident response processes must address both timelines.
NIS2 and DORA: The Digital Operational Resilience Act (DORA) applies to financial entities and their critical third-party ICT service providers. DORA acts as lex specialis for financial entities — financial sector organisations covered by DORA are exempt from certain NIS2 requirements where DORA imposes equivalent or stricter obligations. An IT service provider serving financial entities may need to understand both.
NIS2 and Cyber Essentials (UK): Cyber Essentials covers the five foundational technical controls and is a UK-specific scheme. It does not satisfy NIS2’s broader requirements, which include supply chain security, incident reporting obligations, and management accountability provisions that Cyber Essentials does not address.
NIS2 Compliance Checklist
Use this checklist as a starting point for in-scope organisations. It does not replace a full gap analysis against Article 21.
Governance:
- ☐ Confirm whether your organisation is in direct NIS2 scope (sector and size test)
- ☐ Confirm classification as essential or important entity with national competent authority
- ☐ Register with national competent authority where required by national implementation
- ☐ Management body has approved the cybersecurity risk management programme
- ☐ Management body members have completed cybersecurity training
- ☐ Designated security contact or CISO role with clear responsibility
Risk Management:
- ☐ Information security risk assessment completed and documented
- ☐ Asset inventory of critical systems and data
- ☐ Risk treatment plan addressing identified risks
- ☐ Annual review cycle established
Incident Handling:
- ☐ Incident response plan documented and tested
- ☐ National CSIRT and competent authority contact details identified
- ☐ 24-hour early warning notification template prepared
- ☐ Incident severity classification criteria defined
- ☐ On-call arrangement ensuring 24/7 incident response capability
- ☐ Incident log maintained
Business Continuity:
- ☐ Backup policy implemented and tested
- ☐ Disaster recovery plan with defined RTO and RPO
- ☐ Business continuity plan for critical services
Supply Chain Security:
- ☐ Critical supplier inventory completed
- ☐ Supplier security assessments conducted
- ☐ Security clauses in supplier contracts
- ☐ Process for managing supplier security incidents
Technical Controls:
- ☐ MFA implemented on all internet-facing systems, privileged accounts, and cloud services
- ☐ Encryption at rest on critical data and backup media
- ☐ Encryption in transit using current TLS standards
- ☐ Endpoint protection on all devices
- ☐ Patch management with defined timelines
- ☐ Unique user identifiers — no shared accounts
- ☐ Access provisioning and deprovisioning processes
- ☐ Vulnerability scanning programme
Training:
- ☐ Security awareness training for all staff — completion documented
- ☐ Specialised training for security and technical staff
- ☐ Management cybersecurity training documented
Documentation:
- ☐ All policies documented in writing and reviewed annually
- ☐ Security controls evidenced for audit
- ☐ Incident log maintained even for minor incidents
What to Avoid
Don’t assume micro or small enterprise exclusion applies without checking. The size exclusion removes most micro and small businesses from direct NIS2 scope. But managed service providers and managed security service providers are in scope regardless of size. Trust service providers are in scope regardless of size. If your business provides IT management or security services to other businesses, the size exclusion may not apply.
Don’t ignore supply chain obligations from covered clients. Even if your business is below the NIS2 thresholds, your clients who are covered entities have supply chain security obligations under Article 21. Those obligations flow down to you through commercial contracts. Implementing foundational security controls — MFA, encryption, endpoint protection, documented policies, tested backup — protects the commercial relationship and reduces breach risk simultaneously.
Don’t treat the incident reporting timeline as aspirational. The 24-hour early warning is a legal obligation for in-scope entities that experience significant incidents, not a suggested best practice. Meeting it requires detection capabilities, pre-defined severity criteria, prepared notification templates, and an on-call arrangement — all built before any incident occurs. Organisations that discover a significant incident and then start thinking about how to notify are already behind the deadline.
Don’t conflate NIS2 with GDPR. Both may apply to the same incident, but they require different notifications to different authorities on different timelines. NIS2 requires early warning within 24 hours to the CSIRT and competent authority. GDPR requires breach notification within 72 hours to the relevant data protection authority when personal data is involved. Incident response processes must address both.
Final Verdict
NIS2 directly covers medium and large businesses in 18 sectors across the EU and all managed service providers regardless of size. Its requirements — risk management, incident response, supply chain security, MFA, encryption, and management accountability — are the most comprehensive mandatory cybersecurity obligations in the EU and represent a genuine compliance programme, not a checkbox exercise.
For small businesses below the thresholds: the direct compliance obligation likely does not apply. The indirect supply chain obligation likely does — through the contractual requirements your covered clients will impose as they implement their own NIS2 compliance programmes. Implementing foundational security — MFA everywhere, encryption, endpoint protection, documented policies, tested backup, patch management — addresses both the commercial risk of losing covered clients who require vendor security attestation, and the security risk of being a soft target in your clients’ supply chains.
For businesses in scope: the four priorities that determine compliance readiness are risk documentation, incident response (specifically the 24-hour notification capability), supply chain security programme, and management body accountability and training. Everything else flows from those.
Frequently Asked Questions
Does NIS2 apply to my small business?
It depends on two things: your sector and your size. NIS2 applies to organisations in 18 specific sectors (energy, transport, health, banking, digital infrastructure, manufacturing, and others) that qualify as medium enterprises (50+ employees or €10M+ turnover). Micro-enterprises (under 10 employees AND under €2M turnover) and small enterprises (under 50 employees AND under €10M turnover) are generally excluded in most sectors. However, managed service providers and trust service providers are in scope regardless of size. Even if your business is below the thresholds, your clients who are covered entities may impose security requirements on you through supply chain compliance programmes. Check your sector, your size, and whether any of the size-independent exceptions apply to your business model.
What is the difference between essential entities and important entities under NIS2?
Both categories must implement the same Article 21 security measures. The difference is in supervisory oversight. Essential entities — large organisations in the most critical sectors such as energy, health, transport, banking, and digital infrastructure — are subject to proactive, continuous supervision including regular audits and security inspections. Important entities — medium enterprises in Annex I sectors and organisations in Annex II sectors — are subject to reactive supervision, triggered by specific incidents or evidence of non-compliance. Essential entities face higher maximum fines (€10M or 2% of global turnover) than important entities (€7M or 1.4% of global turnover).
What is the 24-hour incident reporting requirement?
When a significant incident occurs — one that causes or could cause serious service disruption or significant financial loss — in-scope entities must submit an early warning to their national CSIRT (Computer Security Incident Response Team) and competent authority within 24 hours of becoming aware of it. This early warning must note whether the incident is suspected to be malicious and whether it has potential cross-border impact. A full notification follows within 72 hours, and a final report within one month. Meeting the 24-hour timeline requires pre-built detection capability, incident severity classification criteria, notification templates, and on-call arrangements — all established before any incident. Organisations that lack these when an incident occurs cannot realistically meet the 24-hour deadline.
Does NIS2 apply to UK businesses?
NIS2 is an EU directive and does not directly apply to UK-headquartered businesses unless they operate or provide services within the EU in a covered sector. The UK has its own NIS Regulations (2018) based on the original NIS Directive, which remain the applicable UK framework. UK businesses with EU operations or EU customers in covered sectors should assess their NIS2 position based on their EU activities. UK businesses below the EU scope may still face indirect obligations through supply chain requirements from covered EU clients.
What are the penalties for NIS2 non-compliance?
Maximum fines are €10 million or 2% of total global annual turnover for essential entities, and €7 million or 1.4% of total global annual turnover for important entities — whichever is higher. Regulators can also impose binding remediation requirements, increase supervisory intensity, require public disclosure of non-compliance, temporarily suspend services, and (for essential entities) temporarily prohibit individual managers from exercising their functions where they bear personal responsibility for a serious violation. Penalties are calculated on global turnover, not EU-only revenue.
This article provides general educational information about NIS2 requirements. NIS2 has been transposed into national law at different times and with variations across EU member states. The applicable requirements in any specific jurisdiction depend on national implementing legislation. Businesses with compliance questions should consult a qualified legal adviser in the relevant EU member state and verify their status with the national competent authority for their sector. For the official EU directive text, see Directive (EU) 2022/2555 on EUR-Lex. For sector-specific guidance, see ENISA’s NIS2 resources.
Related reading on SmallBiz Defense: