The NIS 2 Directive drastically expands the perimeter of companies obligated to raise their digital security standards. The main distinction is based on company size and the criticality of the sector.
-
Size requirement (minimum threshold)
In general, NIS 2 applies to all entities operating in the listed sectors that have:
- at least 50 employees
- or an annual turnover/balance sheet total exceeding 10 million euros
Note: Some entities (such as Public Administrations and electronic communications network providers) are included regardless of their size.
-
Comparative table: sectors of high criticality vs other critical sectors
| Scope of Operations | ESSENTIAL Entities (High Criticality) | IMPORTANT Entities (Other Sectors) |
|---|---|---|
| Energy & Transport | Electricity, Oil, Gas, Hydrogen, Air, Rail, Maritime. | – |
| Health & Environment | Healthcare providers, Laboratories, Pharma manufacturing. | Waste management. |
| Digital Infrastructure | Cloud, Data centers, Content Delivery Networks (CDN), Trust Services. | Digital service providers (Marketplaces, Search engines, Social networks). |
| Public Services | Drinking water, Waste water, Public Administration. | Postal and courier services. |
| Production & Logistics | – | Food, Chemicals, Manufacturing (Electronics, Machinery, Vehicles). |
| Space & Research | Ground-based space infrastructure. | Research organizations. |
-
The 3 key deadlines and obligations
Concrete actions required:
- Governance: management is directly responsible for cybersecurity (risk of personal sanctions).
- Incident reporting: obligation to provide an “early warning” notification within 24 hours of a critical event.
- Supply chain security: the company must ensure that its suppliers also comply with minimum security standards.
Deep dive: what does NIS 2 compliance involve for a business?
Being classified as an “Essential Entity” or “Important Entity” is not just a matter of labeling: it implies a profound transformation in how the company manages digital risk.
Compliance is not optional: the cybersecurity criteria and deadlines for European companies are defined in the full text of Directive (EU) 2022/2555 (NIS 2), which aims to establish a common high level of cybersecurity across the Union.
-
Sanctions: the cost of non-compliance
One of the reasons NIS 2 is called the “GDPR of Cybersecurity” is the scale of the penalties.
- For Essential Entities: fines up to 10 million euros or 2% of total worldwide annual turnover.
- For Important Entities: fines up to 7 million euros or 1.4% of turnover.
- Management liability: the directive introduces direct responsibility for management bodies (Boards and directors) in case of gross negligence in risk management.
-
The 10 mandatory security measures
We have listed the minimum NIS 2 measures:
- Policies on risk analysis and information system security.
- Incident handling (prevention, detection, and response).
- Business Continuity: crisis management and disaster recovery.
- Supply chain security: assessment of IT suppliers.
- Security in network and information systems acquisition and maintenance (vulnerability management).
- Policies to assess the effectiveness of security measures.
- Cyber hygiene practices and staff training.
- Use of cryptography and multi-factor authentication (MFA) solutions.
- Human resources security and access control.
- Use of secured communications (video, voice, data).
-
Supply Chain management: the “contagion” of compliance
Even if a company is below the 50-employee threshold, it might be forced to comply if it is a supplier to an Essential Entity.
Practical example: a small software house that manages data for a hospital (Essential Entity) must guarantee NIS 2 standards so as not to cause its client to lose compliance.
-
Compliance timeline: the NIS 2 deadline in Italy
- October 17, 2024: deadline for transposition by Member States.
- First quarter of 2025: full operation of controls and sanctions in Italy.
- Periodic review: the list of critical entities will be updated every two years.
Compliance with NIS 2 should not be seen as a mere bureaucratic obligation, but as an opportunity to make your company resilient in a market where digital downtime is the number one risk. A network infrastructure with guaranteed SLAs and redundancy is the first concrete step toward this resilience.
Frequently Asked Questions about NIS 2
Q: What is the difference between Essential and Important Entities in NIS 2?
A: The difference lies in the criticality of the sector and the size of the company. Essential Entities (e.g., Energy, Healthcare) are subject to “ex-ante” (preventive) supervision and higher sanctions. Important Entities (e.g., Logistics, Manufacturing) are subject to “ex-post” supervision (in case of an incident) and slightly lower sanctions, although they must comply with the same security standards.
Q: Are SMEs excluded from the NIS 2 Directive?
A: Generally, companies with fewer than 50 employees and a turnover of less than 10 million euros are excluded. However, NIS 2 also applies to micro-enterprises if they play a critical role (e.g., providers of electronic communications networks or public services) or if they are strategic suppliers to Essential Entities.
Q: What are the risks for a company director in case of non-compliance?
A: NIS 2 introduces the direct responsibility of management bodies. Directors can be held personally liable for the failure to approve risk management measures and may face administrative sanctions or temporary suspension from management functions.
Q: Why are SLAs fundamental for NIS 2 compliance?
A: The directive mandates Business Continuity (operational continuity). Having a contract with guaranteed SLAs (Service Level Agreements) ensures that the network infrastructure is resilient and that recovery times in the event of an attack are certain, thereby reducing the impact of cyber incidents.