Cyber Security & Regulatory Readiness
The NIS2 Directive raises the standard for cyber security and operational resilience across the European Union. Its impact extends beyond traditional critical infrastructure, with important implications for organisations, suppliers and businesses operating across borders.
The Network and Information Security Directive 2 (NIS2), formally Directive (EU) 2022/2555, is European Union legislation designed to strengthen cyber security and resilience across essential and important sectors.
It replaces the original NIS Directive and introduces a wider scope, stronger risk-management requirements, more consistent incident reporting and increased regulatory oversight. It also places greater responsibility on senior management to understand and oversee cyber security risks.
NIS2 entered into force in January 2023. EU Member States were required to transpose it into national law by 17 October 2024, with the new regime applying from 18 October 2024. Implementation is through national legislation, so organisations must check the rules and guidance applicable in each relevant country.
NIS2 is not simply an IT compliance exercise. It is about protecting the services, systems, information and supply chains on which businesses and society depend.
The original EU implementation deadline has passed. Most Member States have introduced national NIS2 legislation, although implementation has not been uniform across every country.
On 8 July 2026, the European Commission announced that it had referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify complete transposition measures.
Organisations operating across several EU countries should not assume that one national implementation or interpretation automatically covers every jurisdiction. Check the current national requirements relevant to each operation.
Important: NIS2 is an EU Directive. The detailed legal obligations applying to an organisation depend on the relevant national implementing legislation and the organisation’s activities.
NIS2 expands the sectors covered by the original NIS framework. It identifies entities as either essential or important, depending on their sector, size and other criteria set out in the Directive and national legislation.
Organisations that may fall within scope include medium-sized and large businesses operating in relevant sectors. Certain smaller organisations may also be covered where specific criteria or exceptions apply.
Being active in one of these sectors does not automatically mean every organisation is covered. The applicable size thresholds, service definitions, national rules and specific exemptions must be considered.
Following the UK’s departure from the EU, NIS2 does not automatically apply to every UK organisation simply because it trades internationally or supplies a European customer.
However, a UK-based business may have NIS2 obligations where it falls within the Directive’s territorial and sectoral scope. For example, certain digital service providers established outside the EU but offering relevant services within the EU may need to appoint an EU representative and meet applicable requirements.
UK businesses may also face NIS2-related requirements through customer contracts, supply-chain assurance, procurement processes or the services they provide to regulated European organisations.
The UK has its own Network and Information Systems Regulations 2018. These apply to specified operators of essential services and relevant digital service providers, with obligations around appropriate and proportionate security measures and incident notification.
The UK Government introduced the Cyber Security and Resilience (Network and Information Systems) Bill to Parliament on 12 November 2025. The proposed reforms would update the existing UK NIS regime, including expanding its scope to cover additional services such as relevant managed service providers and data centres, strengthening incident reporting and improving regulatory powers.
As at November 2026, the Bill is progressing through Parliament. Its proposals should not be confused with requirements already in force. Businesses should monitor its progress and check the legislation and commencement provisions before treating proposed changes as current legal duties.
Article 21 of NIS2 requires in-scope entities to take appropriate and proportionate technical, operational and organisational measures to manage risks to the security of their network and information systems.
The measures should address risks to the systems and services an organisation relies on, rather than focusing solely on individual security products.
Identify cyber risks, assess their potential impact and establish appropriate security controls.
Establish procedures to detect, manage, contain and recover from cyber security incidents.
Prepare for disruption with appropriate backup, disaster recovery and crisis management arrangements.
Assess the cyber security risks associated with suppliers, service providers and business partners.
Identify and address weaknesses in systems, software and infrastructure.
Manage access rights, user accounts, authentication and privileged access.
Evaluate whether security measures are effective through appropriate testing and review.
Improve staff awareness and ensure management understands its cyber security responsibilities.
Other areas addressed by the Directive include cryptography, encryption, human resources security and the security of network and information systems. The exact measures should reflect the organisation’s risk profile and applicable national requirements.
For significant incidents affecting the provision of services, NIS2 introduces a staged reporting process to the relevant national CSIRT or competent authority.
24 hours
An early warning indicating whether the significant incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact.
72 hours
A more detailed notification, including an initial assessment of the incident, its severity and impact, and available indicators of compromise.
1 month
A final report is generally required no later than one month after the incident notification, subject to the Directive’s reporting provisions.
These are NIS2 reporting stages for significant incidents, not a universal reporting timetable for every cyber event. National implementation and applicable sector-specific rules should be checked.
NIS2 brings cyber security firmly into the boardroom. Management bodies of in-scope entities must approve and oversee the implementation of cyber security risk-management measures. Members must also undertake relevant training so they can understand cyber risks and assess their impact on the organisation.
This means cyber security cannot be treated solely as the responsibility of the IT department. Senior leaders need visibility of key risks, business continuity arrangements, supplier dependencies and the effectiveness of security controls.
Clear accountability, documented decisions and regular reviews help connect cyber security with wider business risk management.
Whether your organisation is directly regulated, part of a supplier chain or simply looking to improve its cyber resilience, a structured review is a useful starting point.
A gap assessment can help identify where controls need improvement. It should be tailored to the relevant legal requirements and should not be confused with a formal certification or independent compliance audit.
NIS2 gives national authorities stronger supervisory and enforcement powers. Depending on the entity’s classification and national implementation, these can include requests for information, inspections, audits, instructions to address deficiencies and administrative fines.
The Directive sets maximum fine levels for serious infringements, with different thresholds for essential and important entities. National legislation determines how the enforcement framework operates in practice.
There are also wider business consequences to consider. Weak cyber security can increase the likelihood and impact of service disruption, data loss, reputational damage, contractual disputes and loss of customer confidence.
Taking a risk-based approach to security is therefore valuable whether or not a particular organisation is directly within NIS2 scope.
Form IT Solutions works with businesses to support their IT environments and improve their approach to cyber security. We can discuss your existing technology, security priorities and areas where additional protection or expertise may be appropriate.
Depending on your requirements, relevant areas of support may include:
Explore security technologies and services to help protect business systems, users and networks.
Access technical support and assistance with the day-to-day operation of your IT environment.
Discuss technology risks, infrastructure requirements and practical improvement plans.
Use an indicative self-assessment to help identify areas of cyber security risk that may need attention.
The Cyber-Risk Scorecard is an indicative self-assessment. It is not a formal NIS2 assessment, legal opinion, audit, penetration test or compliance certification. NIS2 applicability and compliance should be confirmed with suitably qualified legal and regulatory advisers.
Cyber security is an ongoing business priority. Whether you are reviewing your security arrangements, responding to customer requirements or planning improvements, Form IT Solutions can help you explore the technology and support options available.
Call us on 01582 572727
NIS2 entered into force on 16 January 2023. EU Member States had until 17 October 2024 to transpose it into national law, with the new framework applying from 18 October 2024.
No. NIS2 applies to entities operating in specified sectors and meeting relevant criteria. Size thresholds, national legislation and specific exceptions affect whether an organisation is in scope.
Not automatically. A UK company may be covered where it falls within NIS2’s territorial and sectoral scope, including certain providers offering relevant services in the EU. UK organisations also need to consider the separate UK NIS Regulations 2018 and the proposed UK Cyber Security and Resilience Bill.
Requirements cover risk analysis, incident handling, business continuity, supply-chain security, vulnerability management, security testing, access control, cryptography and cyber security training, among other measures.
For significant incidents, the Directive establishes an early warning within 24 hours, an incident notification within 72 hours and a final report generally within one month of the notification. The relevant national reporting process should always be checked.
No general IT service or security product can guarantee compliance. Responsibility depends on the organisation’s legal status, risk-management measures, governance, processes and applicable national requirements. IT providers can help improve technical and operational security, while legal and regulatory advice should be obtained where needed.
A supplier is not automatically directly subject to NIS2 just because it serves a regulated organisation. However, in-scope entities must address supply-chain security risks, so customers may impose security requirements through contracts, procurement and supplier assurance processes.
Disclaimer: This article provides general information and is not legal, regulatory or compliance advice. NIS2 obligations depend on the applicable national implementing legislation, an organisation’s activities and its circumstances. The status of legislation and regulatory guidance can change. Obtain appropriate professional advice to determine your organisation’s obligations.
Form IT Solutions provides IT support, consultancy and cyber security services. Any specific service scope, deliverables and responsibilities are subject to agreement.
Get an estimate, general enquiries or request a call.
