NIS2 Compliance Requirements: What Essential and Important Entities Must Do, Step by Step

These obligations bind essential entities and important entities in 18 sectors, 11 listed in Annex I and 7 in Annex II of the Directive. Both categories carry the same duties under Articles 20, 21 and 23 and differ in supervision and in the maximum fine. The Directive is addressed to the 27 Member States, and how the law is built is explained under NIS2 Directive on the home page.

This page sets out the seven steps of a NIS2 compliance programme with the article behind each step, from scope and registration to the evidence a supervisor requests. It then gives the dated public-record cost estimates of the European Commission (2020), the German government (2025) and ENISA (2025), the seven kinds of compliance services, and the status of the EU procedures as of 23 October 2026.

What Does NIS2 Compliance Mean?

NIS2 compliance is the state in which an essential or important entity meets every obligation that its national NIS2 law sets for governance, risk-management measures, incident reporting, registration and cooperation with the supervisor, and can prove it. Proof carries as much weight as the measures themselves, because supervisors under Articles 32 and 33 of Directive (EU) 2022/2555 request documented policies, audit results and the evidence behind them. Compliance therefore has two sides: the measures an entity runs and the records that show those measures work.

The Directive applies through national law. Member States had to adopt and publish their transposing measures by 17 October 2024 and apply them from 18 October 2024 (Article 41(1)), after the Directive entered into force on 16 January 2023 (Article 45). Companies are bound only by the national act, such as the BSIG 2025 in Germany or the NISG 2026 in Austria.

Essential and important entities carry the same Article 20, 21 and 23 obligations. They differ in supervision: essential entities are supervised ex ante and ex post (Article 32), important entities ex post only, when evidence, an indication or information points to non-compliance (Article 33(1)). They also differ in the maximum fine under Article 34, and who counts as one of the essential entities is set out on its own page.

Directive or National Law: Which Rules Does an Entity Comply With?

An entity complies with the national law of the Member State that has jurisdiction over it, because the Directive is addressed to Member States (Article 46) and binds companies only once it is transposed. The Directive is never "directly applicable" to an organisation: the national act sets the duties, names the authority and fixes the penalties.

National laws may go further than the Directive. Article 5 makes NIS2 a minimum-harmonisation act, so Member States may adopt or maintain provisions that ensure a higher level of cybersecurity. The one directly applicable act is Commission Implementing Regulation (EU) 2024/2690, in force since 7 November 2024, and it binds only the 11 digital entity types listed in its Article 1, such as DNS service providers, cloud computing service providers, managed security service providers and trust service providers. That list differs from the 11 types of Article 26(1)(b) of the Directive, which include domain name registration services but not trust service providers.

NIS2 Compliance Requirements Step by Step

NIS2 compliance runs in seven steps: confirm scope and category, register, have the management body approve and oversee the measures, implement the Article 21 measures, prepare incident reporting, keep evidence for supervision, and correct gaps while tracking national changes. Table 1 lists each step with what the entity does, its legal basis in Directive (EU) 2022/2555 and the page that explains it in full. The order follows the law: scope decides whether the later steps apply at all, and registration gives the authority the data it needs to supervise the entity.

Step 1: Confirm Scope, Entity Category and the Supervising Member State

Step 1 is to check whether the entity is of an Annex I or Annex II type and at least medium-sized, which category applies, and which Member State supervises it. The size-cap rule in Article 2(1) refers to Article 2 of the Annex to Recommendation 2003/361/EC: an entity of a listed type is in scope when it qualifies as a medium-sized enterprise or exceeds those ceilings.

The size test counts 50 or more persons, or an annual turnover above EUR 10 million and a balance sheet total above EUR 10 million. Group data change the result: partner enterprises (holdings of 25 % or more) are added pro rata and linked enterprises at 100 %, so the figures of the entity alone do not decide. How partner and linked enterprises count under the size-cap rule is explained separately.

Five types are essential at any size: qualified trust service providers, top-level domain name registries and DNS service providers (Article 3(1)(b)), central government public administration entities (Article 3(1)(d)) and critical entities under the CER Directive (Article 3(1)(f)). Jurisdiction follows the Member State of establishment (Article 26(1)). Telecoms providers fall under every Member State where they provide services, and the 11 digital types of Article 26(1)(b), such as cloud computing service providers and online marketplaces, fall under the Member State of their main establishment in the Union.

Step 2: Register and Keep the Entity Data Current

Step 2 is to submit the Article 3(4) data to the competent authority or the national registration channel: name, address and contact details including email, IP ranges and telephone numbers, sector and subsector, and the Member States served. The national law names the channel and the deadline; in Germany, for example, entities register within three months of first qualifying (§ 33(1) BSIG).

Changes to the Article 3(4) data reach the authority within two weeks. The same Article 26(1)(b) types also had to submit registry data under Article 27(2) by 17 January 2025 and report changes within three months (Article 27(3)). Entities register nationally and the single point of contact forwards the Article 27 data to ENISA, so no entity registers with ENISA directly. Penalties for failing to register are national, set under Article 36, and are not the Article 34 fines.

Step 3: Get Board Approval and Oversight of the Measures

Step 3 is a board decision: under Article 20(1) the management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements. Approval and oversight are two separate duties, so the role of the management body continues after the first sign-off for as long as the measures run.

Members of the management body are required to follow training under Article 20(2), and entities are encouraged to offer similar training to their employees on a regular basis. The Directive sets no frequency, duration or exam for this training. Liability rules are national, and the rules on personal accountability and temporary bans differ by Member State.

The Directive sets no personal fines for managers: Article 34 fines the entity, and recital 128 creates no EU requirement of civil or criminal liability of natural persons towards third parties. The strongest measure against an individual is a temporary ban on managerial functions at chief executive officer or legal representative level. That ban applies to essential entities only, after other enforcement measures have failed (Article 32(5)(b)).

Step 4: Put the Ten Minimum Measures in Place

Step 4 is to put in place appropriate and proportionate technical, operational and organisational measures that cover at least the 10 points (a) to (j) of Article 21(2) on an all-hazards basis. Proportionality rests on four factors in Article 21(1): the entity's degree of exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact. The measures take into account the state of the art, relevant European and international standards and the cost of implementation.

The detailed rulebook depends on the entity type. The 11 entity types of Implementing Regulation (EU) 2024/2690 follow the technical and methodological requirements in its Annex. No implementing act under Article 21(5) exists for other sectors, so every other entity follows its national list, for example § 30(2) BSIG in Germany. The Annex fixes four review intervals: the security policy at least annually (point 1.1.2), the risk assessment and risk treatment plan at least annually (point 2.1.4), role assignments at least annually (point 10.1.3) and a check for recurring incidents every quarter (point 3.4.2(b)). Each interval is a binding point of the Annex to Implementing Regulation (EU) 2024/2690, not a recommendation.

For these entity types, a "where appropriate" requirement that the entity does not apply is documented "in a comprehensible manner" (Article 2(2) of Regulation (EU) 2024/2690). ENISA's Technical Implementation Guidance, version 1.0 of 26 June 2025, explains the Annex point by point but is non-binding, and following it does not by itself establish compliance.

Step 5: Prepare the Three Incident Reports

Step 5 is to be able to send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report not later than one month after the notification (Article 23(4)(a), (b) and (d)). The three mandatory reports and the one report on request are listed below.

1. Send the early warning within 24 hours of becoming aware of the significant incident (Article 23(4)(a)).
2. Send the incident notification within 72 hours of becoming aware of it (Article 23(4)(b)).
3. Send an intermediate report when the CSIRT or competent authority requests one (Article 23(4)(c)).
4. Send the final report not later than one month after the incident notification (Article 23(4)(d)).

Only significant incidents must be reported (Article 23(1)). A significant incident is one that has caused or is capable of causing severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others (Article 23(3)(a) and (b)). Other incidents, cyber threats and near misses can be notified voluntarily (Article 30(1)(a)), and the thresholds for a significant incident are explained separately.

Reports go to the CSIRT or, where applicable, the competent authority (Article 23(1)), never to ENISA. Trust service providers have 24 hours instead of 72 hours for the incident notification on significant incidents that affect their trust services (Article 23(4), second subparagraph). The national act names the CSIRT, the authority and the reporting channel.

Step 6: Keep Evidence for Supervision, Audits and Fines

Step 6 is to keep the evidence a supervisor can request: documented cybersecurity policies, audit results and the underlying evidence (Article 32(2)(e) and (g), Article 33(2)(f)). The same records serve an internal review, an external audit and a dispute over a fine, so one evidence set covers all three uses.

Essential entities are subject to regular and targeted security audits carried out by an independent body or a competent authority, and to ad hoc audits (Article 32(2)(b) and (c)); important entities are subject to targeted audits only (Article 33(2)(b)). The costs of a targeted security audit carried out by an independent body are paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise (Article 32(2), third subparagraph; Article 33(2), third subparagraph). Audit findings feed enforcement and fines, and the maximum NIS2 fines under Article 34 apply to the entity.

Article 34(4) sets, for essential entities, a maximum of at least EUR 10,000,000 or at least 2 % of the total worldwide annual turnover in the preceding financial year, whichever is higher. Article 34(5) sets, for important entities, a maximum of at least EUR 7,000,000 or at least 1.4 %, whichever is higher. These are floors for the national maximum, so national caps differ: Germany applies the turnover-based cap only to undertakings with a total turnover above EUR 500 million (§ 65(6) and (7) BSIG).

Step 7: Correct Gaps and Track National Changes

Step 7 is continuous: an entity that finds it does not comply takes corrective measures without undue delay (Article 21(4)) and follows changes in its national law and at EU level. The Directive sets no fixed number of days for the correction. Corrective work closes the gaps found in steps 4 and 6, from a missing policy to an audit finding, and for the entity types of Regulation (EU) 2024/2690 it runs alongside that Regulation's annual reviews.

At EU level the Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026, a targeted amendment that includes a proposed cyber posture certificate and a small mid-cap category. As of 23 October 2026 the proposal is pending, with the European Parliament procedure at "Awaiting committee decision", and the Commission estimates in press release IP/26/105 that it would ease compliance for 28,700 companies, including 6,200 micro and small enterprises. None of it is law yet, and the pending changes are tracked under NIS2 amendments and review.

How Much Does NIS2 Compliance Cost?

No official price for NIS2 compliance exists; the dated public-record estimates are the Commission's 2020 impact assessment, the German government's 2025 estimate of compliance effort and ENISA's 2025 survey of cybersecurity spending. The three sources measure different things. The Commission estimated the rise in ICT security spending per company before the Directive was adopted, the German government estimated hours and material costs per entity for its national law, and ENISA asked organisations what they spend. None of them is a quote for a specific organisation.

The Commission's 2020 Estimate by Sector

The Commission estimated in 2020 that newly covered companies would raise ICT security spending by up to 22 % in the first years and companies already under NIS1 by 12 % (SWD(2020) 344). After three to four years, ICT security spending was expected to reach 0.63 % of turnover in newly covered sectors and 0.58 % in existing ones, against a 2020 baseline of 9.14 % of ICT spending, about 0.52 % of turnover (impact assessment SWD(2020) 345, section 7.1).

The same impact assessment puts the average NIS1 implementation project at EUR 175,000 across 251 organisations and reports that 65 % of EU enterprises used external suppliers for ICT security in 2019 (Eurostat). Table 2 shows the Commission's 2020 estimate of the spending increase per medium or large company over three to four years, by sector, based on 2018 Eurostat data.

Table 2: the Commission's 2020 estimate for the proposal (SWD(2020) 345, section 7.1), not current prices.

The German Government's Estimate per Entity

The German government estimated in Bundestag Drucksache 21/1501 of 8 September 2025 that each besonders wichtige Einrichtung spends 2,752 hours and EUR 60,700 in material costs a year on compliance, and each wichtige Einrichtung 1,100 hours and EUR 24,300. The two German terms correspond to the Directive's essential and important entities (§ 28 BSIG), and the figures form the bill's compliance-effort estimate (Erfüllungsaufwand).

For the economy as a whole the bill estimates EUR 2.3 billion a year and EUR 2.2 billion one-off (section E.2), based on about 8,250 besonders wichtige and 21,600 wichtige Einrichtungen (Vorgabe 4.2.1). The bill became the NIS2UmsuCG (BGBl. 2025 I Nr. 301), in force in Germany since 6 December 2025, and the law behind these figures is covered under NIS2 in Germany.

Three line items show where the effort goes. Management and staff training costs about EUR 165 million a year (Vorgabe 4.2.4), a newly obliged entity needs 6.75 hours per incident report (Vorgabe 4.2.2), and the estimate assumes about 24 BSI proof requests a year (Vorgabe 4.2.5).

What ENISA's 2025 Investment Survey Shows

ENISA's NIS Investments 2025 survey of 1,080 professionals found that cybersecurity takes 9 % of IT budgets, with a median spend of EUR 1.5 million, and that 70 % name compliance as the main driver. The sample leans towards large organisations (83 %, against 17 % SMEs), the survey ran from May to August 2025, and ENISA published the report, its sixth edition, on 8 December 2025.

The survey also measures gaps. In total, 30 % of respondents had no cybersecurity assessment in the past 12 months, and among SMEs the share is 63 % (Insight 5). Vulnerabilities and patch management is the NIS2 requirement respondents find hardest, named by 50 % (Figure 10).

Cost Drivers That Shape a Quote

Six factors drive what a NIS2 programme costs an entity, listed below.

• Entity category: essential entities face regular, targeted and ad hoc audits (Article 32(2)(b) and (c)), important entities targeted audits only (Article 33(2)(b)), and the audited entity pays, as a rule, for targeted audits by an independent body.
• Applicable rulebook: the 11 entity types of Regulation (EU) 2024/2690 implement its detailed Annex; other entities follow their national list.
• Member States and laws: each Member State with jurisdiction under Article 26 adds a national law, a registration and a reporting channel.
• Existing frameworks: an ISMS under ISO/IEC 27001 or a national framework sets the starting point of the gap analysis.
• Supply chain: Article 21(2)(d) covers security in the relationships with direct suppliers and service providers, so each supplier adds contract and assessment work.
• Management training: Article 20(2) requires training for members of the management body, and the national law decides how often.

Price itself is the quote factor that no official source covers. No dated public-record range exists for consultant day rates, NIS2 software licences or the size of the market, so any "typical NIS2 budget" comes from a provider, not from an authority.

NIS2 Compliance Services and Tools: From Checklist to Software

NIS2 compliance services fall into seven kinds, a checklist, a gap analysis, audits, certification, training, consultants and software, and no authority approves or lists any provider of them (technology neutrality, Article 25(1)). No EU-wide NIS2 certificate for organisations exists either: Article 24(1) only allows Member States to require the use of certified ICT products, ICT services and ICT processes under European cybersecurity certification schemes. Table 3 maps each service to the question it answers and its legal hook. Whichever service an entity buys, the entity itself stays responsible for compliance.

Where NIS2 Compliance Stands on 2026-10-23

As of 23 October 2026, NIS2 has applied through national law since 18 October 2024, the Article 27 registry data was due by 17 January 2025, Member States had to list their entities by 17 April 2025, and the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026. The referrals concern the failure to notify measures transposing NIS2, with a request for a lump sum and daily penalties (Commission press release IP/26/1499). They followed letters of formal notice sent on 28 November 2024 to 23 Member States (Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, the Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden) and reasoned opinions on 7 May 2025 (INF/24/5988).

Read against the national act, these dates show whether registration, measures and reporting are already due. Member States review their entity lists at least every two years (Article 3(3)), and every date is listed in the NIS2 timeline.

Two EU proposals are pending as of 23 October 2026. COM(2026) 13 (2026/0012(COD)) is at "Awaiting committee decision" in the European Parliament, with the ITRE draft report dated 24 September 2026. The Digital Omnibus COM(2025) 837 of 19 November 2025 (2025/0360(COD)) is pending after the Council mandate agreed by Coreper on 21 October 2026. The Commission reviews the functioning of the Directive by 17 October 2027 and every 36 months after that (Article 40).

What NIS2 Compliance Does Not Mean

NIS2 compliance is not a certificate, a product or a control catalogue: it is an ongoing legal duty under national law that each entity meets with measures proportionate to its risks. Article 21(1) ties those measures to exposure, size and the likelihood and severity of incidents, so two compliant entities can run different measures.

What Is the NIS2 Framework?

The NIS2 framework is the set of Article 21 measures, Implementing Regulation (EU) 2024/2690 for the digital types and the national lists, not a standard of its own. No body certifies an organisation against it. Version 1.2 of the ENISA mapping table maps the Annex of the Regulation to ISO/IEC 27001:2022, NIST CSF 2.0 and other standards, and the overlaps are compared under NIS2 vs ISO/IEC 27001.

Do Suppliers Have to Be NIS2 Compliant?

No: NIS2 obliges the entity to address security in its relationships with direct suppliers and service providers (Article 21(2)(d)), and suppliers are not directly obliged by NIS2. Supply chain security reaches suppliers indirectly, through the requirements an in-scope customer sets. A supplier that is itself of an Annex I or II type and at least medium-sized has obligations of its own.

Does NIS2 Compliance Replace Other EU Rules?

No: DORA displaces the NIS2 rules on risk-management measures, reporting and supervision for financial entities as lex specialis (Article 4), and critical entities under the CER Directive are essential entities under NIS2 regardless of size (Article 2(3)). DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025, while NIS2 provisions such as the national strategy (Article 7) and crisis management (Articles 9 and 16) still reach financial entities.

Standards such as ISO/IEC 27001, NIST CSF and IEC 62443 keep their own scope and their own owners. Each overlap is compared under NIS2 and other laws and standards. Product security for hardware and software falls under the Cyber Resilience Act, covered on cyberresilienceactguide.net.