NIS2

Key requirements

What NIS2 requires.

• ✓Risk management and cybersecurity policies
• ✓Incident handling and reporting (within 24h/72h/1 month)
• ✓Business continuity and crisis management
• ✓Supply chain security
• ✓Access control and multi-factor authentication

NIS2 Directive (EU) 2022/2555

Map NIS2 articles to your organizational scope and define applicable security measures.

Implement and evidence all required cybersecurity measures across affected systems.

Manage incident response plans, BIA for critical services, supply chain risk.

Track incident reports, KPIs, and prepare evidence for competent authority reviews.

NIS2 applies to essential entities (energy, transport, banking, health, water, digital infrastructure) and important entities (postal, waste, chemicals, food, manufacturing, digital providers) with 50+ employees or 10M+ turnover in the EU.

NIS2 requires an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month.

Acuna's integrated Supplier Shield module manages third-party risk assessments and continuous monitoring, directly addressing NIS2 Article 21 supply chain security obligations.

Yes. NIS2 and ISO 27001 have significant overlap. Acuna's cross-framework mapping reuses controls across both frameworks without duplicated work.

Essential entities face stricter supervision including proactive audits. Important entities face reactive supervision triggered by incidents or complaints. Both must implement the same security measures under Article 21.