News

Why NIS2 finally brings more Cyber Resilience European Organizations

By Gradum Team•Dec 3, 2025•13 min read

WHEN “COMPLIANT” WASN’T ENOUGH ANYMORE

The alert hit at 02:17.
A European energy operator watched its control-room screens freeze, one by one, as ransomware rippled through an aging OT network. The company was fully “NIS-compliant” on paper. Policies existed. Audits were passed. Yet in the first 30 minutes that mattered, nobody knew which systems were truly critical, which supplier link had been abused, or who had authority to shut what down.

This is the gap NIS2 is designed to close.

NIS2 is not just “NIS with higher fines.” It is Europe’s attempt to hard‑wire cyber resilience into how essential and important organizations are run, day to day. Here is why, this time, the shift is real—and what it demands from you.

What you’ll learn

How NIS2 fixes the biggest weaknesses of the original NIS Directive and legacy, audit-first compliance.
Which organizations are in scope (and why size is no longer a safe hiding place).
The four core resilience pillars NIS2 enforces: risk management, reporting, continuity, and governance.
Concrete steps to turn NIS2 from a regulatory burden into a strategic security upgrade.
Why the real benefit of NIS2 is not fewer incidents, but faster recovery and smaller blast radius.
How concepts like CSIRTs, live risk registers, and supply-chain security translate into daily operations.

NIS2 in a Nutshell: Europe’s New Cyber Resilience Baseline

NIS2 is the EU’s upgraded cybersecurity directive (Directive (EU) 2022/2555), in force since January 2023, with national laws due by 17 October 2024.
It radically broadens scope and strengthens requirements so that critical services—energy, healthcare, transport, digital infrastructure, public administration and more—can withstand modern cyber threats, not just document them.

Where the original NIS left large gaps, NIS2 introduces a “size‑cap rule”: almost all medium and large entities in covered sectors are automatically in scope. It also formalizes tough incident reporting timelines, continuous risk management, and direct board accountability, backed by fines up to €10M or 2% of global turnover for essential entities.

Who NIS2 actually applies to

Under NIS2, entities fall into two main categories based on their size and sector criticality:

Essential entities – typically large organizations (≥250 employees) in high-criticality sectors (Annex I, e.g., energy, health).
Important entities – typically medium organizations in high-criticality sectors, or medium/large organizations in other critical sectors (Annex II).

Member States can treat smaller organizations as essential/important if they are sole providers of a critical service (for example, the only water utility in a region). Combined with the size‑cap rule, this eliminates the patchy, member‑state‑by‑member‑state scoping of NIS1.

NIS2 also adds entire sectors that were previously in a grey zone:

Public administration
Space
Cloud computing and data centres
Online marketplaces and search engines
Postal and courier services
Waste and wastewater management
Certain manufacturing (e.g., chemicals, food, medical devices, vehicles)

Key Takeaway
If you are a medium or large organization in any critical or digital infrastructure sector, assume you are in scope and confirm with national guidance—do not wait to be told.

Why Earlier Approaches Failed to Deliver Real Resilience

NIS1 and traditional compliance regimes created documentation and periodic audits—but not necessarily resilience.
Organizations could pass an annual check while still being unable to answer basic questions during an actual incident: What are our crown jewels? Who are our riskiest suppliers? What is our maximum tolerable downtime?

NIS2 is a reaction to three structural failures of the previous era.

1. Static, box‑ticking security

Security was often treated as a project: write policies, run a penetration test, pass an audit, repeat next year.

In a world of ransomware‑as‑a‑service, APTs, and constantly shifting supply‑chain attack paths, this tempo is dangerously slow. Threat actors iterate weekly; annual governance cycles cannot keep up.

NIS2 instead requires continuous risk management:

Live asset and risk registers, updated at least quarterly.
Ongoing vulnerability identification and mitigation.
Evidence that controls are not only defined but operating in practice.

2. Fragmented rules and exploitable gaps

Under NIS1, Member States decided for themselves which operators counted as “essential services”. This created:

Inconsistent scoping across borders.
Weak links in the EU chain (attackers go where defenses are lowest).
Compliance arbitrage for organizations operating in multiple countries.

NIS2 corrects this through:

Harmonized sectors defined at EU level.
The size‑cap rule that pulls in most medium/large entities automatically.
Minimum common requirements for risk management and incident reporting.

3. Security not owned by leadership

Previously, cybersecurity could be buried several layers down the org chart. Many boards saw it as a technical problem, not a business risk.

NIS2 explicitly makes senior management legally accountable for compliance and risk oversight. They can be held personally responsible for serious failures and are expected to approve, oversee, and periodically review cybersecurity measures.

Mini‑Checklist – Signs Your Organization Is Still in “NIS1 Mode”

Security policies updated only before audits

No single, current inventory of critical assets (IT and OT)

Supplier security clauses are generic or missing

Board sees cyber as “IT cost” rather than enterprise risk

Incident reporting is ad‑hoc, not rehearsed

The Four Pillars of Cyber Resilience Under NIS2

NIS2 is best understood as four mutually reinforcing obligations: risk management, incident reporting, business continuity, and governance/accountability.
Together, they shift organizations from “we have controls” to “we can prove our systems will survive a serious incident”.

1. Continuous Risk Management

Organizations must implement “appropriate and proportionate” technical, operational, and organizational measures using an all‑hazards approach.

In practice, this means:

Maintaining dynamic risk registers with owners, likelihood/impact ratings, and mitigating controls.
Comprehensive asset inventories, including Operational Technology (OT), legacy systems, and cloud services.
Documented supply‑chain security assessments (for vendors, managed services, cloud, and software providers).
Implementing controls aligned with recognized frameworks (ISO 27001, NIST CSF, ISA/IEC 62443 for OT, CIS Controls, etc.).

Several Member States are explicitly referencing or building on these standards (e.g., Belgian CyFun based on NIST CSF, ISO 27001 and IEC 62443).

Pro Tip
Don’t reinvent the wheel: use existing frameworks (ISO 27001, NIST CSF) as your NIS2 “control catalogue” and map directive requirements onto controls you already understand.

2. Strict Incident Reporting and Response

NIS2 mandates a multi‑stage incident reporting regime to national CSIRTs (Computer Security Incident Response Teams):

Early warning within 24 hours of becoming aware of a significant incident.
Incident report within 72 hours, including initial impact assessment.
Interim reports on request while the incident is ongoing.
Final report within 1 month of the incident report.
For long‑running incidents, a progress report after one month and final report within a month of resolution.

This forces organizations to have:

Clear internal escalation paths and on‑call models.
Playbooks for classifying and triaging incidents.
Pre‑agreed communication flows with regulators and partners.

Key Takeaway
NIS2’s timelines are impossible to meet if you decide everything manually during an incident. Automate detection, classification, and notification triggers wherever you can.

3. Business Continuity and Operational Resilience

Resilience is not just about preventing incidents; it’s about continuing to function when they happen.

NIS2 requires:

Documented business continuity and disaster recovery plans.
Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical services.
Regular testing through exercises, simulations, and red‑/purple‑team activity.
Lessons‑learned loops feeding back into risk registers and controls.

This is particularly crucial in sectors like energy, healthcare, and transport, where downtime directly impacts safety and society.

4. Governance, Accountability and Supervision

Under NIS2:

Senior management must approve and oversee cybersecurity measures.
Entities are obliged to register with national authorities, providing company details, sector classification, and other metadata.
Supervisory agencies and CSIRTs gain the right to conduct spot checks and demand real‑time evidence of controls in action.
Non‑compliance can lead to:
- Up to €10M or 2% of worldwide turnover in fines for essential entities.
- Up to €7M or 1.4% of turnover for important entities.

Bullet Summary – What Regulators Now Expect to See

Live risk and asset registers (not a static spreadsheet from last year)

Evidence of supplier due diligence and contract clauses

Training and awareness records for staff and key suppliers

Documented, tested incident response and continuity plans

Board minutes or documentation showing cyber risk oversight

Turning NIS2 Compliance into a Strategic Advantage

NIS2 can be approached in two ways: as a minimum legal hurdle—or as a catalyst to modernize security and operations.
Organizations that choose the second path gain better visibility, faster decision‑making, and higher trust from customers and partners.

Step 1: Start with a Gap Assessment, Not a Policy Rewrite

Begin by mapping where you stand today against NIS2’s requirements and recognized frameworks:

Scope: Which parts of the business are in NIS2 sectors? In which Member States?
Governance: Who currently owns cyber risk at executive and board level?
Controls: What do you already have via ISO 27001, SOC 2, or sector regulations?
Reporting: How mature are your incident detection and response processes?

From there, prioritize initiatives that:

Reduce risk and
Produce evidence regulators care about and
Deliver business value (e.g., fewer outages, improved asset visibility).

Step 2: Build an Evidence‑First Operating Model

Because authorities can conduct live spot checks, your processes must naturally generate evidence as a by‑product of normal operations:

Use ticketing and GRC tools to tie risks to controls, owners, and actions.
Centralize logs, alerts, and incident data; standardize how incidents are classified.
Maintain training registers automatically via your LMS.
Add NIS2 clauses to supplier contracts and keep due‑diligence reports accessible.

Pro Tip
“If it isn’t written down, it didn’t happen” now applies to cybersecurity. Design processes so that every security‑relevant action leaves an auditable digital trace.

Step 3: Integrate Cybersecurity into Business Planning

To turn NIS2 into advantage:

Engage product, operations, and finance in cyber discussions.
Align resilience investments with revenue‑critical services and regulatory priorities.
Communicate externally: demonstrate NIS2‑aligned security posture to customers, investors, and insurers.

Early, visible NIS2 maturity can:

Shorten sales cycles with security‑sensitive customers.
Improve terms with cyber insurers.
Strengthen your position in supply‑chain security assessments.

Key Takeaway
The same capabilities that satisfy NIS2—asset visibility, supply‑chain control, fast incident response—also reduce downtime, support cloud/OT modernization, and increase customer trust.

The Counter-Intuitive Lesson Most People Miss

Most discussions frame NIS2 as a way to prevent more cyberattacks.
The more important, counter‑intuitive outcome is that NIS2 is designed to ensure organizations can survive attacks that inevitably succeed.

Attack frequency and sophistication are outside any single organization’s control. What NIS2 changes is how predictable and bounded the impact becomes.

From “We Hope It Won’t Happen” to “We Know How It Will Play Out”

Under NIS2, resilience means:

When a supplier is compromised, you already know where they connect, what data they access, and how to isolate them.
When ransomware hits a plant network, you know which OT segments can be disconnected without cascading failures.
When an APT lurks in your environment, monitoring and logging give you a forensics trail instead of blind spots.

This is not about promising zero incidents. It is about:

Reducing blast radius – knowing which systems and partners will be affected.
Reducing time to recovery – having tested playbooks and continuity plans.
Reducing uncertainty – having clear roles, authorities, and communication lines.

Why This Matters for Boards and Regulators

Boards are used to thinking in terms of financial and operational risk, not malware signatures. NIS2 translates cyber into that language:

Quantified impacts: downtime, safety, regulatory exposure.
Structured obligations: risk registers, RTOs, exposure to fines.
Clear accountability: who signs off, who answers regulators, who approves budgets.

Regulators, in turn, shift focus from whether an incident occurred (which is often inevitable) to how responsibly it was prepared for, detected, handled, and learned from.

Key Takeaway
The real promise of NIS2 is not a perfectly secure EU—an impossible goal—but a Europe whose critical services remain available and trustworthy even when attackers get in.

Key Terms: NIS2 Mini‑Glossary

NIS2 Directive – Directive (EU) 2022/2555, the EU law that sets common cybersecurity and resilience requirements for essential and important entities.
Essential Entity (EE) – A large organization (typically ≥250 employees) in a high-criticality sector (Annex I) subject to the strictest NIS2 supervision and highest fines.
Important Entity (IE) – A medium organization in a high-criticality sector, or a medium/large organization in another critical sector (Annex II), with slightly lower penalties.
Size‑Cap Rule – NIS2 principle that all medium and large entities in covered sectors are automatically in scope, reducing national discretion and gaps.
CSIRT (Computer Security Incident Response Team) – National or organizational team responsible for receiving incident reports, coordinating response, and sharing threat information.
Incident Reporting Timeline – NIS2’s staged reporting deadlines: 24‑hour early warning, 72‑hour incident report, interim/progress updates, and final report within one month.
Risk Register – A structured log of cyber risks, each with an owner, likelihood/impact assessment, and defined mitigating controls.
Supply‑Chain Security – Measures to assess and manage cybersecurity risks posed by suppliers, service providers, and software vendors.
Business Continuity Plan (BCP) – Documented procedures to keep critical services running during disruptions, including cyber incidents.
Operational Technology (OT) – Hardware and software that directly monitors or controls physical processes (e.g., SCADA, ICS in energy and manufacturing), distinct from traditional IT.

FAQ: NIS2 and Cyber Resilience

1. Who exactly falls under NIS2?

NIS2 applies to most medium and large entities in specified sectors such as energy, transport, health, digital infrastructure, public administration, and certain manufacturing and services.
Additionally, smaller organizations can be designated essential or important if they are sole providers of a critical service in a Member State.

2. How is NIS2 different from the original NIS Directive?

NIS2:

Broadens sector coverage (including public administration, space, cloud, marketplaces).
Uses a size‑cap rule instead of case‑by‑case national designation.
Imposes stricter, harmonized incident reporting and risk‑management duties.
Grants regulators stronger supervisory powers and introduces higher, tiered fines.
Makes senior management explicitly accountable.

3. How does NIS2 relate to GDPR?

GDPR protects personal data, while NIS2 protects the availability and security of essential and digital services more broadly.
A single incident (e.g., ransomware on a hospital system) can trigger both: GDPR for data breach notification and NIS2 for service disruption and cyber incident reporting.

4. Is having ISO 27001 certification enough for NIS2 compliance?

ISO 27001 is an excellent foundation but not a guarantee of full NIS2 compliance.
NIS2 adds specific obligations (e.g., incident reporting timelines, sector scope, board accountability, registration with authorities) that must be addressed on top of any generic ISMS.

5. What should organizations below the size thresholds do?

Legally, many micro and small entities are out of scope.
Practically, if they operate in high‑risk supply chains (energy, healthcare, public services), large customers will increasingly expect NIS2‑aligned controls through contracts and assessments. Adopting key elements voluntarily can become a business enabler.

6. What happens if we miss the NIS2 deadline?

Member States must transpose NIS2 by 17 October 2024, but some will enforce actively in 2025 and beyond.
Missing the deadline exposes organizations to enforcement actions: corrective orders, audits, reputational damage, and, for serious or persistent failures, significant fines.

7. What are the first three practical steps to get ready?

Confirm scope (entity type, sectors, Member States) and designate executive ownership.
Run a NIS2 gap assessment against your current controls and frameworks (ISO 27001, NIST CSF, etc.).
Prioritize and launch initiatives that enhance detection/response, supply‑chain security, and evidence generation (risk registers, training, incident documentation).

Conclusion: From Midnight Panic to Managed Disruption

Return to that frozen control room at 02:17.

Under a mature NIS2 regime, the story unfolds differently.
Critical OT assets are mapped; network segments can be isolated without guessing. The SOC knows which suppliers might be involved and has their contracts—and security contacts—at hand. An incident commander triggers a rehearsed response, informs leadership, and files an early‑warning report to the national CSIRT within the first 24 hours.

Operations may still be disrupted, but chaos is replaced by controlled execution.

That is what NIS2 is ultimately about. Not creating an illusion of perfect security, but forcing European organizations to:

Understand their true digital dependencies.
Plan for failure as rigorously as they plan for success.
Turn cybersecurity from a compliance checkbox into a living, board‑level discipline.

Organizations that embrace this shift early will not only meet the directive—they will emerge stronger, more trusted, and genuinely more resilient in the face of whatever the next 02:17 incident looks like.