NIS2 Directive Practical Guide: Cybersecurity Obligations for Essential and Important Entities

The Network and Information Security Directive 2 significantly expands the scope of EU cybersecurity regulation, bringing an estimated one hundred and sixty thousand additional organisations under mandatory cybersecurity requirements. This practical guide provides a structured approach to NIS2 compliance for both essential and important entities, addressing the key challenge many organisations face: translating directive requirements into concrete technical and organisational measures.

The guide begins with a comprehensive scope assessment methodology, helping organisations determine whether they fall within NIS2's expanded scope — which now covers sectors including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. The distinction between essential and important entities is clarified, along with the implications for supervision and enforcement.

Core cybersecurity risk management measures required under Article 21 are mapped to practical controls, including policies on risk analysis and information system security, incident handling procedures, business continuity and crisis management, supply chain security, security in network and information systems acquisition and development, policies for assessing effectiveness of measures, cybersecurity hygiene and training, cryptographic controls, human resources security, and multi-factor authentication requirements.

The paper provides particular depth on supply chain security requirements, reflecting the directive's recognition that supply chain attacks represent one of the most significant and growing threats to organisational cybersecurity. Practical approaches to vendor risk assessment, contractual security requirements, and ongoing supplier monitoring are detailed, drawing on experience managing third-party risk across complex financial services supply chains.