Skip to content

NIS2 Directive (EU) 2022/2555 — Customer Guide

Last updated: 2026-05-14 (Plan 131 v1)

What is NIS2, and why does it matter to you?

NIS2 is the EU's cyber rulebook for essential and important entities — banks, energy, transport, water, digital infrastructure, public administration, manufacturers of critical products, and a long list of others. If you sit inside one of those sectors and you operate in the EU, NIS2 applies to your organisation. The fines reach EUR 10 million or 2% of worldwide turnover, and under Article 20 the management body itself can be held personally liable. The quickest way to take pressure off your team is to have the evidence your national competent authority asks for ready before they ask.

What NIS2-specific features does Secruna ship?

End-to-end (Plan 131) — every item below is wired in the deployed system:

  • Rule book v1 — 22 IGP YAMLs at rule_book/nis2/v1/ covering NIS2 Articles 20, 21 (the ten cybersecurity risk-management measure groups), 23 (incident notification — 24h early warning, 72h notification, 1-month final report), 24 (European cybersecurity certification schemes), 28 (DNS / domain name registration data), 29 (information-sharing arrangements) plus the Annex I / II sector-scoping IGP. Loader picks it up via KNOWN_FRAMEWORKS["nis2"] in packages/rekognise-core/src/rekognise/agent/rule_book/registry.py.
  • Evidence pack export — PDF / CSV / HTML at /exports/nis2-evidence-pack. Backend renderer in packages/rekognise-core/src/rekognise/cp/export/regulation_evidence_pack.py; API at GET /export/nis2-evidence-pack?format={pdf,csv,html} mounted by apps/cp-api/src/cp_api/main.py.
  • Tenant subscription — platform admins enable nis2 per tenant via enabled_frameworks (the same Plan 103 path used for every other framework). The evidence-pack endpoint gates on require_framework_subscription(db, tenant.id, "nis2").
  • Sidebar entry — /exports/nis2-evidence-pack is registered in the framework feature manifest (packages/rekognise-core/src/rekognise/cp/framework_features/manifest.py) as the nis2_evidence_pack feature. The Plan 109 dynamic sidebar surfaces the entry automatically when a tenant has nis2 enabled.
  • Counsel review (Plan 97) — every rule YAML carries pending_counsel_review: true so verdicts route through the same counsel pipeline as DS 05-138 / NCSC CAF / DORA rules.
  • Cross-framework signal share — NIS2 Article 21 measure groups reuse the same tenant_cyber_posture artifact-metadata kind that powers DS 05-138 / NCSC CAF / DORA. No new connector signals required for v1.
  • Verdict taxonomy — Partially Compliant / Applicable / Fully Compliant / Not Applicable. See FRAMEWORK_CATEGORY_TAXONOMY["nis2"] in packages/rekognise-core/src/rekognise/agent/rule_book/loader.py.
  • Operator surface — /admin/regulations lists NIS2 under shipped frameworks; /admin/tenants/{id}/framework-subscriptions accepts nis2 as a subscription target.
  • Audit event — successful exports emit evidence_pack.nis2.exported for the audit log.

Limitations (v1)

  • No automatic incident classification against the NIS2 substantial / significant thresholds — Article 23 requires the entity to determine whether an incident crosses the substantial-incident threshold (and therefore triggers the 24h/72h/1-month notification cycle). v1 lets the tenant tag incidents manually; the auto-classifier is scaffolded under Plan 133 (multi-framework incident classifier, also covering DORA major-incident classification).
  • No per-Member-State refinement — Plan 131 targets the Directive text on EUR-Lex. National transposition (Germany's NIS2UmsuCG, Poland's national act, France's LPM extension, etc.) sometimes adds Member-State-specific obligations; v1.1 will land per-Member-State refinements once a national-transposition customer demands it.
  • No live national CSIRT submission integration — the 24h / 72h / 1-month reports flow to the national CSIRT or competent authority through national channels. Secruna ships the evidence pack; the entity files it.
  • Supply-chain register limited to AI vendors — Article 21(2)(d) supply-chain security partially overlaps with the Secruna AI vendor inventory. v1 reuses the AI inventory as a partial register; full ICT third-party coverage (cloud, SaaS, telecoms, hardware, payment processors) is scaffolded under Plan 134 (ICT third-party register beyond AI, shared with DORA Art. 28).

What NIS2 is

The NIS2 Directive (Directive (EU) 2022/2555 of 14 December 2022) is the EU's successor to the original NIS Directive (2016/1148). NIS2 entered force on 16 January 2023 + the national transposition deadline was 17 October 2024 — most Member States have a national act in force from 2024-Q4 onwards (the laggards from 2025-Q1).

NIS2 applies to:

  • Essential entities (Annex I) — banks, energy, transport, drinking water, digital infrastructure (including DNS providers, TLD registries, cloud service providers, data centre service providers), public administration entities, ICT service management (B2B), etc.
  • Important entities (Annex II) — postal + courier services, waste management, manufacture + distribution of chemicals, manufacture of medical devices, food production + processing, manufacture of motor vehicles, digital providers (online marketplaces, online search engines, social networking platforms), research organisations.

The exact in-scope test combines sector membership + size threshold (typically 50+ employees or EUR 10M turnover, with sector-specific exceptions). Each Member State maintains the registry.

NIS2 has three structural elements relevant to Secruna:

  1. Article 20 governance — the management body must approve the Art. 21 measures + can be held personally liable for infringement.
  2. Article 21 risk-management measures — the ten measure groups every essential / important entity must implement.
  3. Article 23 incident notification — 24h early warning, 72h notification, 1-month final report to the national CSIRT or competent authority.

What Secruna covers

Secruna ships NIS2 as a live rule book — rule_book/nis2/v1/. Each Article becomes one or more Secruna rules with a NIS2 citation, a connector signal match, and a customer_description body explaining what the obligation means and what evidence the supervisor expects.

The v1 rule book covers:

  • Article 20 — Governance — management-body approval of Art. 21 measures + management-body cybersecurity training.
  • Article 21 — Risk-management measures — all ten measure groups: risk analysis policies, incident handling, business continuity, supply-chain security, vulnerability handling + disclosure, effectiveness assessment, cyber hygiene + training, cryptography, HR security, MFA + secure communications, plus a cross-cutting network-security baseline.
  • Article 23 — Incident notification — 24h early warning, 72h notification, 1-month final report, recipient-notification playbook for significant cyber threats.
  • Article 24 — Certification schemes — European cybersecurity certification scheme usage.
  • Article 28 — Domain name registration data — TLD + registrar data accuracy.
  • Article 29 — Information sharing — sectoral ISAC / CSIRT participation.
  • Annex I / II — Sector scoping — entity classification posture.

How verdicts map to NIS2 measure groups

Secruna verdict NIS2 outcome What it means
partially_compliant Measure applies; partially evidenced Highest severity — the supervisor sees explicit half-evidence as worse than absence because the entity knows the measure applies but has not closed the gap.
applicable Measure applies; evidence pending Finding seam at competent-authority assessment.
fully_compliant Measure applies + fully evidenced Informational.
not_applicable Measure out of scope for the tenant Residual fallback (e.g. Article 28 DNS data on a bank that does not operate a TLD).

Severity ordering (highest first): partially_compliant > applicable > fully_compliant > not_applicable.

Using the evidence pack at competent-authority assessment time

The NIS2 Evidence Pack is generated from the dashboard under Exports → NIS2 Evidence Pack (org_admin role required). The file is a tenant-level PDF / CSV bundle:

  • Cover — tenant name, framework metadata, generation timestamp, document ID.
  • §1. Assessment summary — counts of IGPs at each verdict.
  • §2. Per-IGP evidence by Article — one section per Article (20, 21, 23, 24, 28, 29, Annex I/II), one row per IGP with the verdict and a short evidence summary.
  • §3. Gaps surfaced for assessment — partially-compliant + applicable IGPs surfaced separately so the supervisor sees the remediation list at a glance.
  • §4. Audit trail — last 90 days of platform activity material to the evidence pack.

Filename: secruna-nis2-evidence-{tenant_slug}-{date}.pdf (or .csv).

Submitting

The national competent authority + the national CSIRT use national submission channels. Hand the evidence pack to the supervisor alongside the standard supervisory file (Member-State template). The file is structured Article → IGP so the supervisor walks the Directive in natural order.

Re-running after remediation

Verdicts re-evaluate on every discovery run. Refresh the evidence pack the same way the NCSC CAF + DS 05-138 packs work:

  1. Trigger a discovery run (Connections → Run discovery now) or wait for the scheduled run.
  2. Confirm the verdict has flipped to fully_compliant under the IGP detail page.
  3. Generate a fresh evidence pack — the new gap count appears on the cover.

What Secruna does NOT cover

  • Live national CSIRT submission integration. NIS2 evidence flows through national channels; Secruna ships the evidence pack, not the submission portal.
  • NIS2 substantial-incident auto-classification. v1 lets the tenant tag incidents; the auto-classifier is scaffolded under Plan 133.
  • Full ICT third-party register. v1 reuses the AI inventory as a partial supply-chain register; full ICT coverage is scaffolded under Plan 134.
  • Per-Member-State transposition refinements. v1 targets the Directive text; v1.1 will refine per Member State.

Frequently asked

Q. We're a UK-based bank with EU operations. Does NIS2 apply? NIS2 applies to entities established in the EU + entities providing services in the EU regardless of establishment (under specific conditions). UK groups with EU subsidiaries / branches should map per-entity. The Secruna multi-tenant model supports a per-EU-entity NIS2 subscription if that's how the supervision sits.

Q. We're already shipping DORA. Do we need NIS2 too? DORA is the lex specialis for EU financial entities. Where DORA covers an obligation, DORA wins. NIS2 covers a wider sector scope (energy, transport, water, digital infrastructure, public admin, manufacturing, etc.) — if your entity sits in one of those non-financial sectors, NIS2 applies directly. Many corporate groups subscribe to both: DORA for the regulated financial entity, NIS2 for the holding / non-financial subsidiaries.

Q. Who is the management body for personal liability purposes? National transposition varies. Typically the management board (Vorstand / zarząd / conseil d'administration) or the equivalent executive committee. The Art. 20(1) obligation is on the body that approves the entity's Art. 21 cybersecurity risk-management measures — usually a board-level resolution.