Why it matters
The NIS2 Directive expands EU cybersecurity obligations across energy, transport, water, health and other critical sectors. It places accountability on management bodies and sets tight incident-reporting timelines.
NIS2 makes senior management accountable and requires risk management measures across governance, incident handling, business continuity and supply chain security. Member states transpose it into national law, so details vary by country.
By the numbers
51%of incidents recorded by ENISA in 2025 were low-impact DDoS attacks 1
40%of cybercrime events analysed were ransomware, the most disruptive type in the short term 1
60%of intrusions with an identifiable entry point exploited a vulnerability 1
Public administration
Business services
Transport
Manufacturing
Finance and banking
Source: ENISA, Threat Landscape 2026, 22 September 2026
What's changing
- More organisations are in scope, including many mid-sized operators.
- Management bodies must approve and oversee cybersecurity risk measures.
- Significant incidents require an early warning within 24 hours.
How leaders are responding
- Confirming which entities and services are in scope in each member state.
- Briefing boards on their responsibilities.
- Strengthening security requirements for suppliers.
What good looks like
- Board members briefed and trained, as NIS2 requires
- Incident reporting that meets the 24-hour early-warning deadline
- Supplier security clauses aligned with NIS2 supply chain duties
What to watch
- National transposition and supervisory guidance in each member state.
- Registration requirements for in-scope entities.
- Supervisory inspections and enforcement actions.
Where to start
Run a gap assessment against the national requirements in your largest market, and brief the board on its accountability.
Questions for your leadership team
- Which of our entities are in scope, and in which category?
- Is our board equipped to oversee cyber risk?
- Could we meet the reporting timelines?
Sources
- ENISA, Threat Landscape 2026, 22 September 2026
