NIS 2

The NIS 2 directive requires organisations in critical sectors to put robust cybersecurity measures in place. This page explains what the directive asks for, how to check whether it applies to you, and how to complete the assessment in Stoïk Protect.

Understanding NIS 2

What the directive is

NIS 2 (Directive (EU) 2022/2555) replaces the first NIS directive of 2016. It was adopted in December 2022, and Member States were required to transpose it into national law by 17 October 2024.

Two things changed significantly compared to NIS 1:

• The scope widened. Roughly 18 sectors are now covered — 11 highly critical sectors in Annex I, and 7 other critical sectors in Annex II. Thousands of mid-sized and large organisations are in scope for the first time, along with public administrations.

• Management became accountable. Under Article 20, the management body must approve the cybersecurity measures, oversee their implementation, and can be held personally liable. Executives are also required to follow cybersecurity training.

NIS 2 is a directive, not a regulation. It sets the objectives; each Member State writes its own law. Your exact deadlines, your registration procedure and any stricter national requirements come from your country, not from the European text.

The three core obligations

Obligation	What it means
Register with your national authority	Once you have established that you are in scope, you must declare your entity to the competent authority in your country
Manage your cyber risk	Put in place the technical, operational and organisational measures of Article 21
Report significant incidents	Notify your authority within 24 hours (early warning), 72 hours (incident notification) and one month (final report)

Failure to comply exposes you to administrative fines of up to €10M or 2% of global annual turnover for essential entities, and €7M or 1.4% for important entities — whichever is higher in each case.

Article 21(2): the ten measures

Article 21 is the heart of the directive, and the basis for the assessment in Stoïk Protect.

Article 21(1) sets the principle: measures must be appropriate and proportionate, follow an all-hazards approach, and be scaled to your size, your exposure and the severity of the incidents you could suffer. A 60-person manufacturer is not expected to build the same programme as a national energy operator.

Article 21(2) then lists ten minimum measures. The ten areas of the assessment:

	Measure	What the directive asks for
(a)	Risk analysis and information system security policies	A documented view of your risks, and written security policies approved at the right level
(b)	Incident handling	The ability to detect, qualify, respond to and report incidents
(c)	Business continuity	Backup management, disaster recovery and crisis management
(d)	Supply chain security	Security in your relationships with direct suppliers and service providers
(e)	Security in acquisition, development and maintenance	Including vulnerability handling and disclosure
(f)	Assessing the effectiveness of your measures	Policies and procedures to verify that what you put in place actually works
(g)	Basic cyber hygiene practices and cybersecurity training	For all staff, not only the IT team
(h)	Cryptography and encryption	A policy on where and how encryption is used
(i)	HR security, access control and asset management	Onboarding and offboarding, least privilege, an asset inventory
(j)	MFA and secured communications	Multi-factor or continuous authentication, secure voice, video and text, emergency communications

The directive deliberately names themes, not controls. It does not tell you which EDR to buy, how often to patch, or what a password policy should contain. That is why an assessment like the one in Stoïk Protect works at the level of concrete actions — it translates each of the ten themes into things you can actually confirm or put in place.

Where more detail exists

Two sources go further than the directive:

• Commission Implementing Regulation (EU) 2024/2690 sets detailed technical and methodological requirements for the Article 21 measures, and the criteria for what counts as a significant incident. It applies to specific cross-border digital entities: DNS providers, TLD registries, cloud and data centre providers, CDNs, managed service and managed security service providers, online marketplaces and search engines, social networks and trust service providers. If you are one of those, this regulation is your reference rather than your national baseline.

• National referentials. Member States publish their own set of measures. In France, ANSSI publishes the Référentiel Cyber France (ReCyF), which breaks the directive down into 20 security objectives with separate requirements for important and essential entities. These referentials are more granular than the ten areas, and they are what an audit will be based on.

Step 1: Eligibility check

Open the Compliance tab and go to the NIS 2 card. Three fields determine your outcome:

Field	Options
Activity sector	The sectors listed in Annex I and Annex II of the directive, plus None of the above
Headcount	Less than 50 · Between 50 and 250 · More than 250
Aggregated turnover	Less than €10M · Between €10M and €50M · More than €50M

Fields already known from your insurance contract are pre-filled. You can change them at any time with the Edit button.

If your sector is Digital infrastructure or Managed ICT services, you are also asked for your specific activity (DNS provider, TLD registry, domain name registrar, trust service provider, public electronic communications, cloud computing, data centre, CDN, MSP/MSSP). Some of these activities place you in scope regardless of your size.

Only your turnover is requested, not your balance-sheet total. The directive applies the size thresholds of Commission Recommendation 2003/361/EC, which considers either one, so we ask for the simpler of the two.

Understanding your outcome

	Essential entity	Important entity	Not concerned
Supervision	Proactive audit by the authority	Audit triggered on incident	No NIS 2 supervision
Management	Personal liability (suspension from office)	Personal liability	No NIS 2 management liability
Max sanctions	€10M or 2% of global revenue — whichever is higher	€7M or 1.4% of global revenue — whichever is higher	No NIS 2 administrative sanctions
Incident notification	24h / 72h / 1 month	24h / 72h / 1 month	No NIS 2 notification duty
Deadlines	Set by your country's transposition	Set by your country's transposition	No NIS 2 registration deadline

Essential and Important entities can then open the full assessment with Complete the full assessment.

The outcome is indicative. It is based on your sector, your size and your digital activity. It does not account for national specifics such as a designation under the CER directive, a previous status as an Operator of Essential Services, or additional sectors added by your Member State. Confirm your final status with your national authority or your legal counsel.

Step 2: The assessment

The assessment turns the ten measures of Article 21(2) into 40 concrete actions, four per area. Tick what you already have in place.

Area	Article
Risk analysis and security policies	21(2)(a)
Incident handling and notification	21(2)(b)
Business continuity and crisis management	21(2)(c)
Supply chain security	21(2)(d)
Lifecycle security and vulnerability handling	21(2)(e)
Effectiveness assessment	21(2)(f)
Cyber hygiene and training	21(2)(g)
Cryptography and encryption	21(2)(h)
HR security, access control and assets	21(2)(i)
MFA and secured communications	21(2)(j)

Actions covered by your Stoïk tools

These five actions are ticked automatically when the corresponding tool is active:

Action	Covered by
Run regular vulnerability scans on internal and external systems	External Scan · AD Scan · Cloud Scan
Monitor for leaked credentials tied to company accounts	Credentials
Run phishing simulation campaigns	Simulation
Roll out regular cybersecurity awareness training for all staff	Learning
Set up detection tooling to catch incidents early	Stoïk MDR

Disclaimer

This NIS2 tool is provided for general informational and orientation purposes only. It is intended to give brokers and clients a preliminary indication of whether a company may fall within the scope of the NIS2 Directive and its related obligations.

The results generated by this tool are based on the information provided by the user and Stoïk's current understanding of the applicable legislation, which may be subject to change or differing interpretation at national level. The tool does not constitute legal advice and should not be relied upon as a substitute for a qualified legal assessment.

Stoïk makes no representation or warranty, express or implied, as to the accuracy, completeness, or currentness of the information or results provided, and accepts no liability for any decisions made or actions taken based on the use of this tool.

Official resources

European texts

Source	What it covers
Directive (EU) 2022/2555	The directive itself: scope criteria (Art. 2, 3), management accountability (Art. 20), risk-management measures (Art. 21), reporting obligations (Art. 23), sanctions (Art. 34) and the sector lists (Annex I and II)
Commission Implementing Regulation (EU) 2024/2690	Detailed technical requirements for Article 21, and the criteria for a significant incident, for cross-border digital entities
Commission Recommendation 2003/361/EC	The definition of micro, small and medium-sized enterprises used to determine your size category
NIS 2 Directive — European Commission	Overview, FAQ and the state of national transpositions
ENISA — NIS Directive	Guidance and technical implementation material from the EU cybersecurity agency

National authorities

Country	Authority
France	ANSSI
Germany	BSI
Belgium	Centre for Cybersecurity Belgium
Netherlands	Digital Trust Center
Spain	INCIBE

Registration with your national authority, and the deadlines that apply to you, are set by your country's transposition. Check your national authority's page for the current status.