> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/onboarding/compliance/nis-2.md).

# NIS 2

The NIS 2 directive requires organisations in critical sectors to put robust cybersecurity measures in place. This page explains what the directive asks for, how to check whether it applies to you, and how to complete the assessment in Stoïk Protect.

## Understanding NIS 2

### What the directive is

NIS 2 ([Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)) replaces the first NIS directive of 2016. It was adopted in December 2022, and Member States were required to transpose it into national law by **17 October 2024**.

Two things changed significantly compared to NIS 1:

* **The scope widened.** Roughly **18 sectors** are now covered: 11 highly critical sectors in Annex I, and 7 other critical sectors in Annex II. Thousands of mid-sized and large organisations are in scope for the first time, along with public administrations.
* **Management became accountable.** Under [Article 20](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), the management body must approve the cybersecurity measures, oversee their implementation, and can be held personally liable. Executives are also required to follow cybersecurity training.

{% hint style="info" %}
NIS 2 is a **directive**, not a regulation. It sets the objectives; each Member State writes its own law. Your exact deadlines, your registration procedure and any stricter national requirements come from your country, not from the European text.
{% endhint %}

### The three core obligations

<table><thead><tr><th width="242.62109375">Obligation</th><th>What it means</th></tr></thead><tbody><tr><td><strong>Register with your national authority</strong></td><td>Once you have established that you are in scope, you must declare your entity to the competent authority in your country</td></tr><tr><td><strong>Manage your cyber risk</strong></td><td>Put in place the technical, operational and organisational measures of Article 21</td></tr><tr><td><strong>Report significant incidents</strong></td><td>Notify your authority within <strong>24 hours</strong> (early warning), <strong>72 hours</strong> (incident notification) and <strong>one month</strong> (final report)</td></tr></tbody></table>

Failure to comply exposes you to administrative fines of up to **€10M or 2% of global annual turnover** for essential entities, and **€7M or 1.4%** for important entities, whichever is higher in each case.

### Article 21(2): the ten measures

Article 21 is the heart of the directive, and the basis for the assessment in Stoïk Protect.

[Article 21(1)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) sets the principle: measures must be **appropriate and proportionate**, follow an **all-hazards approach**, and be scaled to your size, your exposure and the severity of the incidents you could suffer. A 60-person manufacturer is not expected to build the same programme as a national energy operator.

[Article 21(2)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) then lists ten minimum measures. The ten areas of the assessment:

<table><thead><tr><th width="77.8984375"></th><th width="282.796875">Measure</th><th>What the directive asks for</th></tr></thead><tbody><tr><td><strong>(a)</strong></td><td>Risk analysis and information system security policies</td><td>A documented view of your risks, and written security policies approved at the right level</td></tr><tr><td><strong>(b)</strong></td><td>Incident handling</td><td>The ability to detect, qualify, respond to and report incidents</td></tr><tr><td><strong>(c)</strong></td><td>Business continuity</td><td>Backup management, disaster recovery and crisis management</td></tr><tr><td><strong>(d)</strong></td><td>Supply chain security</td><td>Security in your relationships with direct suppliers and service providers</td></tr><tr><td><strong>(e)</strong></td><td>Security in acquisition, development and maintenance</td><td>Including vulnerability handling and disclosure</td></tr><tr><td><strong>(f)</strong></td><td>Assessing the effectiveness of your measures</td><td>Policies and procedures to verify that what you put in place actually works</td></tr><tr><td><strong>(g)</strong></td><td>Basic cyber hygiene practices and cybersecurity training</td><td>For all staff, not only the IT team</td></tr><tr><td><strong>(h)</strong></td><td>Cryptography and encryption</td><td>A policy on where and how encryption is used</td></tr><tr><td><strong>(i)</strong></td><td>HR security, access control and asset management</td><td>Onboarding and offboarding, least privilege, an asset inventory</td></tr><tr><td><strong>(j)</strong></td><td>MFA and secured communications</td><td>Multi-factor or continuous authentication, secure voice, video and text, emergency communications</td></tr></tbody></table>

{% hint style="warning" %}
The directive deliberately names **themes, not controls**. It does not tell you which EDR to buy, how often to patch, or what a password policy should contain. That is why an assessment like the one in Stoïk Protect works at the level of concrete actions: it translates each of the ten themes into things you can actually confirm or put in place.
{% endhint %}

### Where more detail exists

Two sources go further than the directive:

* [**Commission Implementing Regulation (EU) 2024/2690**](https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj) sets detailed technical and methodological requirements for the Article 21 measures, and the criteria for what counts as a significant incident. It applies to specific cross-border digital entities: DNS providers, TLD registries, cloud and data centre providers, CDNs, managed service and managed security service providers, online marketplaces and search engines, social networks and trust service providers. If you are one of those, this regulation is your reference rather than your national baseline.
* **National referentials.** Member States publish their own set of measures. In France, [ANSSI](https://cyber.gouv.fr/reglementation/cybersecurite-systemes-dinformation/directives-nis-nis2-et-dispositif-saiv/directive-nis-2/) publishes the *Référentiel Cyber France* (ReCyF), which breaks the directive down into 20 security objectives with separate requirements for important and essential entities. These referentials are more granular than the ten areas, and they are what an audit will be based on.

## Step 1: Eligibility check

Open the **Compliance** tab and go to the **NIS 2** card. Three fields determine your outcome:

<table><thead><tr><th width="198.828125">Field</th><th>Options</th></tr></thead><tbody><tr><td><strong>Activity sector</strong></td><td>The sectors listed in Annex I and Annex II of <a href="https://eur-lex.europa.eu/eli/dir/2022/2555/oj">the directive</a>, plus <em>None of the above</em></td></tr><tr><td><strong>Headcount</strong></td><td>Less than 50 · Between 50 and 250 · More than 250</td></tr><tr><td><strong>Aggregated turnover</strong></td><td>Less than €10M · Between €10M and €50M · More than €50M</td></tr></tbody></table>

Fields already known from your insurance contract are pre-filled. You can change them at any time with the **Edit** button.

If your sector is **Digital infrastructure** or **Managed ICT services**, you are also asked for your specific activity (DNS provider, TLD registry, domain name registrar, trust service provider, public electronic communications, cloud computing, data centre, CDN, MSP/MSSP). Some of these activities place you in scope regardless of your size.

{% hint style="info" %}
Only your turnover is requested, not your balance-sheet total. The directive applies the size thresholds of [Commission Recommendation 2003/361/EC](https://eur-lex.europa.eu/eli/reco/2003/361/oj), which considers either one, so we ask for the simpler of the two.
{% endhint %}

### Understanding your outcome

|                           | Essential entity                                  | Important entity                                   | Not concerned                     |
| ------------------------- | ------------------------------------------------- | -------------------------------------------------- | --------------------------------- |
| **Supervision**           | Proactive audit by the authority                  | Audit triggered on incident                        | No NIS 2 supervision              |
| **Management**            | Personal liability (suspension from office)       | Personal liability                                 | No NIS 2 management liability     |
| **Max sanctions**         | €10M or 2% of global revenue, whichever is higher | €7M or 1.4% of global revenue, whichever is higher | No NIS 2 administrative sanctions |
| **Incident notification** | 24h / 72h / 1 month                               | 24h / 72h / 1 month                                | No NIS 2 notification duty        |
| **Deadlines**             | Set by your country's transposition               | Set by your country's transposition                | No NIS 2 registration deadline    |

Essential and Important entities can then open the full assessment with **Complete the full assessment**.

{% hint style="warning" %}
The outcome is indicative. It is based on your sector, your size and your digital activity. It does not account for national specifics such as a designation under the CER directive, a previous status as an Operator of Essential Services, or additional sectors added by your Member State. Confirm your final status with your national authority or your legal counsel.
{% endhint %}

## Step 2: The assessment

The assessment turns the ten measures of Article 21(2) into **40 concrete actions**, four per area. Tick what you already have in place.

| Area                                          | Article  |
| --------------------------------------------- | -------- |
| Risk analysis and security policies           | 21(2)(a) |
| Incident handling and notification            | 21(2)(b) |
| Business continuity and crisis management     | 21(2)(c) |
| Supply chain security                         | 21(2)(d) |
| Lifecycle security and vulnerability handling | 21(2)(e) |
| Effectiveness assessment                      | 21(2)(f) |
| Cyber hygiene and training                    | 21(2)(g) |
| Cryptography and encryption                   | 21(2)(h) |
| HR security, access control and assets        | 21(2)(i) |
| MFA and secured communications                | 21(2)(j) |

### Actions covered by your Stoïk tools

These five actions are ticked automatically when the corresponding tool is active:

| Action                                                           | Covered by                           |
| ---------------------------------------------------------------- | ------------------------------------ |
| Run regular vulnerability scans on internal and external systems | External Scan · AD Scan · Cloud Scan |
| Monitor for leaked credentials tied to company accounts          | Credentials                          |
| Run phishing simulation campaigns                                | Simulation                           |
| Roll out regular cybersecurity awareness training for all staff  | Learning                             |
| Set up detection tooling to catch incidents early                | Stoïk MDR                            |

{% hint style="info" icon="eye" %}
**Disclaimer**<br>

This NIS2 tool is provided for general informational and orientation purposes only. It is intended to give brokers and clients a preliminary indication of whether a company may fall within the scope of the NIS2 Directive and its related obligations.<br>

The results generated by this tool are based on the information provided by the user and Stoïk's current understanding of the applicable legislation, which may be subject to change or differing interpretation at national level. The tool does not constitute legal advice and should not be relied upon as a substitute for a qualified legal assessment.<br>

Stoïk makes no representation or warranty, express or implied, as to the accuracy, completeness, or currentness of the information or results provided, and accepts no liability for any decisions made or actions taken based on the use of this tool.
{% endhint %}

## Official resources

### European texts

| Source                                                                                                   | What it covers                                                                                                                                                                                                        |
| -------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)                               | The directive itself: scope criteria (Art. 2, 3), management accountability (Art. 20), risk-management measures (Art. 21), reporting obligations (Art. 23), sanctions (Art. 34) and the sector lists (Annex I and II) |
| [Commission Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj) | Detailed technical requirements for Article 21, and the criteria for a significant incident, for cross-border digital entities                                                                                        |
| [Commission Recommendation 2003/361/EC](https://eur-lex.europa.eu/eli/reco/2003/361/oj)                  | The definition of micro, small and medium-sized enterprises used to determine your size category                                                                                                                      |
| [NIS 2 Directive: European Commission](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) | Overview, FAQ and the state of national transpositions                                                                                                                                                                |
| [ENISA: NIS Directive](https://www.enisa.europa.eu/topics/nis-directive)                                 | Guidance and technical implementation material from the EU cybersecurity agency                                                                                                                                       |

### National authorities

<table><thead><tr><th width="163.39453125">Country</th><th>Authority</th></tr></thead><tbody><tr><td>France</td><td><a href="https://cyber.gouv.fr/reglementation/cybersecurite-systemes-dinformation/directives-nis-nis2-et-dispositif-saiv/directive-nis-2/">ANSSI</a></td></tr><tr><td>Germany</td><td><a href="https://www.bsi.bund.de/">BSI</a></td></tr><tr><td>Belgium</td><td><a href="https://ccb.belgium.be/">Centre for Cybersecurity Belgium</a></td></tr><tr><td>Netherlands</td><td><a href="https://www.digitaltrustcenter.nl/">Digital Trust Center</a></td></tr><tr><td>Spain</td><td><a href="https://www.incibe.es/">INCIBE</a></td></tr></tbody></table>

{% hint style="info" %}
Registration with your national authority, and the deadlines that apply to you, are set by your country's transposition. Check your national authority's page for the current status.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/onboarding/compliance/nis-2.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.