NIS2, answered

NIS2 is an EU directive, so it takes legal effect through each member state's national transposition law. Your concrete obligations come from that national law — which must meet, and may go beyond, the directive's minimum standard.

NIS2 widens the sectors and entities in scope, standardises the risk-management and reporting requirements, adds strict incident-reporting deadlines, introduces management accountability, and raises penalties significantly.

Generally the rules target medium and large entities (50 or more staff, or above €10 million turnover or balance sheet) in covered sectors. But some providers are in scope regardless of size, and you may still be affected as part of a larger entity’s supply chain.

One that causes or could cause severe operational disruption or financial loss to the entity, or affects others through considerable material or non-material damage. National guidance adds specific thresholds.

Yes. Management bodies must approve and oversee the cybersecurity measures and can be held liable for breaches. Serious cases can lead to temporary bans from management functions.

To your national CSIRT or the competent authority designated in your country's transposition law, following the 24-hour, 72-hour and one-month reporting stages.