--- title: "The NIS2 Directive | Pitch" description: "Who falls under NIS2, what the directive requires, how the 24-hour, 72-hour and one-month incident reports work and how they relate to GDPR breach notification." url: https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Information Technology](https://www.pitch.law/academy/topics/information-technology) # The NIS2 Directive Who falls under NIS2, what the directive requires, how the 24-hour, 72-hour and one-month incident reports work and how they relate to GDPR breach notification. - By By Bart Lieben, Attorney-at-Law - Published 14 March 2023 ## The legal framework Directive (EU) 2022/2555 (NIS2) replaced the first NIS Directive and sets cybersecurity obligations for a much wider group of organisations. Member states had to transpose it into national law by 17 October 2024, and each country decides who supervises and how the details work. If you operate in several countries, you deal with several national laws built on the same directive. ### Who is in scope NIS2 applies to medium-sized and large entities in the sectors listed in two annexes. Annex I (sectors of high criticality) includes energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space. Annex II (other critical sectors) includes postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers (such as online marketplaces, search engines and social networks) and research. Size is judged under the Commission's SME Recommendation: broadly, medium-sized means at least 50 employees or an annual turnover or balance sheet total above EUR 10 million. Some entities, such as DNS and top-level domain providers, are covered whatever their size. Entities are classified as essential or important. The classification determines the supervision: essential entities face proactive supervision, important entities mostly supervision after an incident or indication of non-compliance. Entities in scope usually have to register with their national authority, but how and by when differs per country. ### What is required - **Risk-management measures (Article 21).** Appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. The directive lists areas: risk analysis and security policies, incident handling, business continuity and backups, supply chain security, secure acquisition and development, vulnerability handling, use of cryptography, access control and multi-factor authentication, and basic cyber hygiene and training. - **Governance (Article 20).** Management bodies approve the measures, oversee implementation, follow training and can be held liable for infringements. - **Incident reporting (Article 23).** Significant incidents are reported in stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. The report goes to the national CSIRT or competent authority. - **Supply chain.** Entities must address the cybersecurity of direct suppliers. This will appear in your contracts and in your processor register. - **Proof of compliance.** Member states can ask entities to prove compliance, for example through certification. This differs per country, for example certification against a recognised standard or an inspection. Check the national rules that apply to you. ### Sanctions The directive provides administrative fines of up to EUR 10 million or 2% of worldwide annual turnover for essential entities, and up to EUR 7 million or 1.4% for important entities, whichever is higher. Supervisory measures, such as binding instructions and temporary measures against management, are also available. ### Relationship with the GDPR NIS2 protects network and information systems. The GDPR protects personal data. One incident can trigger both: a ransomware attack on a hospital is a significant incident for the NIS2 authority and, if personal data were compromised, a [personal data breach](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) for the data protection authority. The addressees, content and deadlines differ, so two notifications are normally needed, prepared from one set of facts. ## In practice A medium-sized logistics company with 180 employees operates in transport, which is in Annex I. It registers with its national authority, classifies itself as essential or important after analysis, and starts a gap assessment against Article 21. It finds that backups are not tested, administrator accounts lack multi-factor authentication and its software suppliers are not covered by security clauses. The board approves a plan. Eight months later, a phishing attack takes over a dispatcher's account and the attackers encrypt a file server. The company's NIS2 contact informs the authority within 24 hours that a significant incident is in progress and has been caused by a likely malicious act. Because the server held driver data, the company also treats it as a personal data breach and notifies the data protection authority within 72 hours. It files the final report within one month. A small web agency with 12 employees is outside the thresholds. It may still be a supplier to an in-scope entity, and will receive security requirements in its contracts. ## Frequently asked questions ### Is my company in scope? Check the sector, the size and the activity against the annexes and the national law of each country where you operate. Services to in-scope customers do not by themselves bring you into scope, but they bring contractual requirements. ### Does NIS2 replace the GDPR breach notification? No. They apply side by side, with different authorities and deadlines. ### Who is personally exposed? Members of management bodies can be held liable for infringements under the directive's governance rules, and must follow cybersecurity training. ### Is NIS2 the same in every country? The directive harmonises the basics, but national laws differ, for instance on registration, proof of compliance and reporting platforms. A group with entities in several countries needs to check each national law. ## How this connects Our [data breach response](https://www.pitch.law/solutions/data-breach-response-enforcement) service handles the GDPR side and coordinates the reporting that runs alongside. The [breach workflow](https://www.pitch.law/technologies/breach-response-workflow) keeps the timeline of an incident in one record, and requests from affected individuals are handled through [data subject requests](https://www.pitch.law/technologies/dsar-handling). See also [the 72-hour rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown). ## In short - Directive (EU) 2022/2555 and national laws - Essential and important entities - 24-hour, 72-hour and one-month reporting ## Related solutions - [Solutions](https://www.pitch.law/solutions/data-breach-response-enforcement) ### [Data Breach Response](https://www.pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://www.pitch.law/solutions/data-breach-response-enforcement) ## Technology we use - [Technology](https://www.pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - [Technology](https://www.pitch.law/technologies/dsar-handling) ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) ## More in Information Technology - ### [Database Rights and Trade Secrets](https://www.pitch.law/academy/database-rights-and-trade-secrets) [How the EU database right, copyright and trade secret law protect data and databases, what each requires, and where contracts must fill the gaps.](https://www.pitch.law/academy/database-rights-and-trade-secrets) - ### [The EU Data Act](https://www.pitch.law/academy/eu-data-act) [What Regulation (EU) 2023/2854 requires of makers and users of connected products, data holders, cloud providers and anyone who contracts about data, and when each part applies.](https://www.pitch.law/academy/eu-data-act) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)