NIS 2 Directive

Article 1 Subject matter

The Directive establishes measures to strengthen cybersecurity standards uniformly across the EU in order to enhance internal market operations. It requires Member States to define cybersecurity strategies, establish oversight bodies and incident response teams, and imposes security and reporting requirements on designated entities and critical entities, while setting out rules for information sharing and supervisory responsibilities.

Article 2 Scope

The Directive applies to medium-sized and larger entities in Annexes I or II, electronic communications providers, trust service providers, domain name registries regardless of size, sole providers of essential services, entities whose service disruption would significantly impact public safety or health, those posing systemic risks or critical at national or regional level, and central government public administration; Member States may extend it to local administration and education institutions. Public administration entities in national security, defence, law enforcement and criminal investigation are excluded; Member States may exempt specific such entities from reporting obligations and, where exclusively providing such services, from risk-management and other obligations with supervision not applying, though this exclusion does not apply to trust service providers.

Article 3 Essential and important entities

Essential entities are those in Annex I exceeding medium-sized thresholds, qualified trust service providers, top-level domain registries and DNS providers of any size, medium-sized electronic communications providers, central government public administration entities, other Annex I or II entities identified by Member States under certain criteria, those identified as critical under a separate directive, or essential service operators identified before 16 January 2023; important entities are those in Annexes I or II not meeting essential criteria. Competent authorities must notify the Commission about identified entities, their sectors, service types, and applicable identification provisions; until 17 April 2025, Member States may notify the Commission of essential and important entity names upon request.

Article 4 Sector-specific Union legal acts

Where sector-specific Union laws require cybersecurity measures or incident notification at least equivalent to this Directive's obligations, this Directive and its supervision and enforcement provisions do not apply to those entities. Requirements are equivalent if they cover measures at least as effective as those specified or if the law provides immediate access to incident notifications by relevant authorities and notification requirements matching this Directive's standards. The Commission must issue equivalence guidelines by 17 July 2023 and review them regularly, consulting the Cooperation Group and ENISA.

Article 5 Minimum harmonisation

Member States may adopt or maintain provisions establishing higher cybersecurity levels, provided they comply with other Union law obligations.

Article 6 Definitions

Article 6 defines network and information systems, cybersecurity-related terms (security, cybersecurity, strategy, incident, risk, threat, vulnerability), ICT and digital service terminology (product, service, process, standard, technical specification), domain name and trust service infrastructure (DNS, registry, domain registration, trust services), digital platform operators (digital services, online marketplace, search engine, social networking, content delivery network, data centre, cloud computing), electronic communications entities and arrangements (network, service, internet exchange point, public administration), and supporting roles (representative, managed service provider, managed security service provider, research organisation).

Article 7 National cybersecurity strategy

Member States must adopt a national cybersecurity strategy setting out strategic objectives, required resources, and policy and regulatory measures, including governance frameworks for coordination between authorities, mechanisms to identify assets and assess risks, incident preparedness and response measures, and awareness-raising plans. The strategy must address supply chain cybersecurity, cybersecurity requirements in public procurement, vulnerability management, internet infrastructure protection, advanced technologies, education and training, information-sharing tools, support for small and medium-sized enterprises, and active cyber protection. Member States must notify the Commission within three months of adoption, assess the strategy at least every five years using key performance indicators, and update it as necessary, with ENISA assistance available upon request.

Article 8 Competent authorities and single points of contact

Each Member State must appoint one or more authorities to oversee cybersecurity implementation, and must appoint a single point of contact to coordinate cross-border and cross-sectoral cooperation. These authorities must have sufficient resources, and Member States must notify the Commission of their identities and notify the public, with the Commission maintaining a public list of contact points.

Article 9 National cyber crisis management frameworks

Each Member State must designate authorities responsible for managing large-scale cybersecurity incidents and ensure they have adequate resources and coordinate with general crisis management. Member States must adopt response plans detailing objectives, responsibilities, procedures, preparedness measures, stakeholder involvement, and arrangements for participating in coordinated management at EU level, notifying the Commission within three months and submitting plan details within the same timeframe.

Article 10 Computer security incident response teams (CSIRTs)

Each Member State must designate or establish one or more CSIRTs covering the sectors and entities in the Annexes and complying with specified requirements. CSIRTs must have adequate resources, secure communication infrastructure for exchanging information with relevant entities, and must cooperate through a CSIRTs network and participate in peer reviews. CSIRTs may establish cooperation with third countries' incident response teams and exchange relevant information including personal data under Union data protection law.

Article 11 Requirements, technical capabilities and tasks of CSIRTs

CSIRTs must maintain multiple communication channels with no single points of failure, operate from secure premises, manage requests securely, ensure confidentiality and trustworthiness, maintain adequate trained personnel, and have backup systems for service continuity. CSIRTs must collectively have technical capabilities to monitor threats and vulnerabilities, provide early warnings, respond to incidents, analyse forensic data, offer vulnerability scanning upon request, assist other CSIRTs, coordinate vulnerability disclosure, and support information-sharing tools. CSIRTs may prioritize tasks using risk-based approaches, conduct non-intrusive scanning of essential and important entities' systems, and carry out proactive scanning of publicly accessible systems to detect vulnerabilities or misconfigurations.

Article 12 Coordinated vulnerability disclosure and a European vulnerability database

Each Member State must designate one CSIRT as a vulnerability disclosure coordinator to act as a trusted intermediary between vulnerability reporters and affected manufacturers or providers. The coordinator must identify involved parties, assist reporters, negotiate disclosure timelines, and handle multi-entity vulnerabilities; it must accept anonymous reports and maintain reporter anonymity. ENISA must develop and maintain a European vulnerability database with security and integrity measures, enabling voluntary disclosure of known public vulnerabilities by any entity and suppliers.

Article 13 Cooperation at national level

Member States must ensure cooperation between their competent authorities, single points of contact, and CSIRTs regarding Directive obligations. CSIRTs or authorities must receive notifications of significant incidents and cyber threats, and must inform single points of contact of such notifications. Member States must facilitate cooperation between these bodies and law enforcement, data protection, aviation, electronic signatures, financial services, and electronic communications authorities.

Article 14 Cooperation Group

A Cooperation Group composed of Member State representatives, the Commission, and ENISA, with observers from the European External Action Service and optional participation by European Supervisory Authorities and financial services authorities, is established to support strategic cooperation and information exchange between Member States, with the Commission providing secretariat support. The Group must develop biennial work programmes and provide guidance on implementing the Directive, exchange best practices on cyber threats and vulnerabilities, advise on emerging cybersecurity policies, review peer assessments, conduct critical supply chain security assessments, guide CSIRTs and EU-CyCLONe, and facilitate capacity building exchanges. The Group must hold regular joint meetings with private stakeholders, discuss cybersecurity exercises and peer review methodologies, prepare reports on strategic experience and peer reviews, regularly assess cyber threats and incidents, and submit required reports to the Commission, European Parliament, Council and Member States, who must ensure effective and secure cooperation of their representatives.

Article 15 CSIRTs network

A network of national Computer Security Incident Response Teams, composed of designated national CSIRTs and CERT-EU with ENISA providing secretariat support, is established to promote confidence, trust and operational cooperation among Member States by exchanging information on capabilities, technologies and best practices, sharing incident and cyber threat information, facilitating coordinated cross-border responses, cooperating with regional Security Operations Centres, and discussing peer-review reports and operational practices. Starting on 17 January 2025 and at two-year intervals thereafter, the CSIRTs network must evaluate operational cooperation progress and produce reports with conclusions and recommendations based on peer reviews of national CSIRTs, submitting findings to the Cooperation Group, and must adopt its own procedures and coordinate with EU-CyCLONe through agreed arrangements.

Article 16 European cyber crisis liaison organisation network (EU-CyCLONe)

EU-CyCLONe supports Member States in managing large-scale cybersecurity incidents and crises operationally and facilitates information exchange, with membership comprising cyber crisis authority representatives and the Commission when incidents have significant impact. ENISA provides secretariat support, the network adopts its own procedures, and it must submit reports to Parliament and Council every 18 months starting 17 July 2024, while regularly reporting to the Cooperation Group.

Article 17 International cooperation

The Union may conclude international agreements with third countries or international organisations to allow and organise their participation in specific activities of the Cooperation Group, CSIRTs network and EU-CyCLONe, provided such agreements comply with Union data protection law.

Article 18 Report on the state of cybersecurity in the Union

ENISA must adopt a biennial report on Union cybersecurity in cooperation with the Commission and Cooperation Group, assessing the cyber threat landscape, development of cybersecurity capabilities across public and private sectors, general cybersecurity awareness among citizens and entities, aggregated peer review outcomes, and maturity of Member States' cybersecurity capabilities and strategy alignment. The report must include policy recommendations to address shortcomings and increase cybersecurity, and a summary of findings from ENISA's technical situation reports on incidents and threats.

Article 19 Peer reviews

By 17 January 2025, the Cooperation Group must establish peer review methodology and organisational aspects with voluntary participation and cybersecurity experts from at least two different Member States to strengthen mutual trust and enhance cybersecurity capabilities, covering risk-management measures and reporting obligations, competent authority capabilities and resources, CSIRT operational capabilities, mutual assistance implementation, cybersecurity information-sharing arrangements, and cross-border or cross-sector issues using objective, non-discriminatory, fair and transparent criteria. Peer reviews involve on-site visits or remote information exchanges, with the reviewed Member State supplying information without prejudicing classified, confidential or essential state function protections, and experts prohibited from disclosing sensitive information to third parties. The same aspects may not be reviewed again in a Member State for two years unless that Member State requests it or the Cooperation Group proposes otherwise.

Article 20 Governance

Management bodies of essential and important entities must approve, oversee and be held liable for cybersecurity risk-management measures taken under Article 21. Members of management bodies must receive regular training, and entities are encouraged to provide similar training to employees, so that they develop adequate knowledge and skills to identify risks and evaluate cybersecurity practices and their impact on services.

Article 21 Cybersecurity risk-management measures

Member States must ensure essential and important entities implement suitable and balanced cybersecurity measures accounting for standards, costs, entity size, risk exposure and incident severity, including policies on risk analysis, incident handling, business continuity, supply chain security, secure development, assessment, training, cryptography, personnel security and authentication. Entities must take all necessary, appropriate and proportionate corrective actions without undue delay if non-compliant. By 17 October 2024, the Commission must adopt implementing acts setting out technical and methodological requirements for DNS providers, TLD registries, cloud service providers, data centre providers, content delivery networks, managed service and security service providers, online marketplace, search engine and social network platform providers, and trust service providers, and may adopt sectoral requirements for other entities following standards.

Article 22 Union level coordinated security risk assessments of critical supply chains

The Cooperation Group may conduct joint assessments of specific critical ICT services, systems or products supply chains in cooperation with the Commission and ENISA, considering technical and non-technical risk factors. The Commission shall identify which specific critical ICT offerings may undergo assessment after consulting the Cooperation Group, ENISA, and relevant stakeholders.

Article 23 Reporting obligations

Essential and important entities must notify their CSIRT or competent authority without undue delay of significant incidents, including information on cross-border impacts, and must notify affected service recipients where appropriate and inform potentially affected recipients of significant cyber threats and available remedies. When an incident is ongoing at final report submission, entities must provide a progress report then and a final report within one month. Trust service providers must notify the CSIRT or competent authority without undue delay and within 24 hours of becoming aware of a significant incident affecting their trust services.

Article 24 Use of European cybersecurity certification schemes

Member States have the authority to mandate that essential and important entities employ ICT products, services and processes that hold certification under European cybersecurity certification schemes. The Commission may adopt delegated acts to specify which entity categories must use certified solutions or obtain certificates, but only following impact assessments and consultations and where cybersecurity levels prove inadequate. If no suitable scheme exists, the Commission may request ENISA to develop one.

Article 25 Standardisation

Member States must promote adherence to European and international standards and technical specifications for network and information system security, without favoring particular technologies. ENISA shall, working with Member States and relevant stakeholders, develop guidance on technical areas and existing standards that address these security requirements.

Article 26 Jurisdiction and territoriality

Entities within the Directive's scope fall under their establishment Member State's jurisdiction, except that public electronic communications providers fall under the jurisdiction where they provide services; DNS providers, cloud and data centre providers, content delivery networks, managed service providers, online marketplaces, search engines and social platforms fall under their main EU establishment location; and public administration entities fall under their establishing Member State. Main establishment is determined by where cybersecurity decisions are predominantly made, or if undeterminable, where cybersecurity operations occur, or if still undeterminable, where the most employees are based. Non-EU entities offering services in the EU must designate an EU representative and fall under that representative's Member State's jurisdiction; absent a representative, any Member State where services are offered may take enforcement action.

Article 27 Registry of entities

ENISA shall establish and maintain a registry of DNS providers, domain name registries and registration entities, cloud and data centre providers, content delivery networks, managed service and security service providers, and online marketplaces, search engines and social platforms, based on information from single points of contact. Member States must require these entities to submit specified information including entity name, relevant sector classification, addresses and contact details, Member States where they operate, and IP ranges by 17 January 2025, and notify competent authorities of changes within three months. Single points of contact forward this information to ENISA without undue delay, excluding IP ranges.

Article 28 Database of domain name registration data

Member States must require top-level domain registries and domain name registration service providers to collect and maintain accurate and complete registration data in a database, including registrant names, contact details, and points of contact for administering domain names, with policies and verification procedures made publicly available. Non-personal domain name data must be published promptly, while personal data access must be granted to legitimate seekers following lawful requests within 72 hours, subject to data protection law, with disclosure policies made public.

Article 29 Cybersecurity information-sharing arrangements

Article 30 Voluntary notification of relevant information

In addition to mandatory notification, Member States must allow voluntary submission of incident, threat and near-miss reports to security teams or authorities by essential and important entities, and by other entities regarding significant incidents. Voluntary notifications follow the same procedures as mandatory ones but may be deprioritised, and the reporting entity faces no additional obligations except confidentiality protection and restrictions on criminal investigation prevention.

Article 31 General aspects concerning supervision and enforcement

Competent authorities must effectively supervise and enforce compliance with the Directive, applying risk-based prioritisation of supervisory tasks and cooperating with data protection authorities when incidents involve personal data breaches. For public administration entities, Member States must ensure competent authorities have operational independence to conduct supervision and impose enforcement measures according to national frameworks.

Article 32 Supervisory and enforcement measures in relation to essential entities

Competent authorities must impose effective, proportionate and dissuasive measures on essential entities, including inspections, targeted security audits by independent bodies, security scans, and requests for documentation. Authorities may order notifications to affected users, implementation of audit recommendations, public breach disclosure, impose monitoring officers or administrative fines, and where earlier measures fail, may suspend services or certifications or prohibit individuals from managerial functions, subject to procedural protections not applying to public administration. Natural persons with authority to represent or control entities must ensure compliance and may be held liable for breaching this duty; authorities must respect rights of defence and consider factors including seriousness, duration, prior violations, damage, intent or negligence, remedial measures, codes of conduct or certifications, and cooperation, provide reasoned decisions and notify entities of preliminary findings before adopting measures unless immediate action is needed.

Article 33 Supervisory and enforcement measures in relation to important entities

When evidence suggests an important entity breaches the Directive, competent authorities must take effective, proportionate and dissuasive supervisory action, including on-site and off-site supervision, targeted security audits by independent bodies based on risk assessments (costs paid by the audited entity unless the authority decides otherwise in justified cases), security scans, and requests for information, data, documents and evidence of compliance. Authorities may issue warnings, binding instructions to remedy deficiencies, orders to cease infringement, orders to ensure compliance with cybersecurity or reporting requirements within a specified timeframe, orders to notify affected service users or participants about threats and protective measures, requirements to implement audit recommendations within a reasonable deadline, and requirements for public disclosure of breach aspects, and may impose administrative fines in addition to other measures.

Article 34 General conditions for imposing administrative fines on essential and important entities

Member States must impose administrative fines on essential and important entities that are effective, proportionate and dissuasive. Fines may be imposed in addition to other enforcement measures and must consider factors specified in Article 32(7). 4% of worldwide annual turnover (whichever is higher).

Article 35 Infringements entailing a personal data breach

When competent authorities discover that violations of Articles 21 or 23 may cause a personal data breach as defined in the GDPR and requiring notification under it, they must promptly inform the GDPR supervisory authorities. If supervisory authorities impose administrative fines under the GDPR for the same conduct, competent authorities may not impose administrative fines under this Directive but may still apply other enforcement measures. Competent authorities must also inform their own Member State's supervisory authority about potential data breaches when the GDPR supervisory authority is in another Member State.

Article 36 Penalties

Member States must establish rules on penalties for violations of national measures implementing this Directive, ensure implementation, and make penalties effective, proportionate and dissuasive. Member States must notify the Commission of such rules and measures by 17 January 2025 and inform it without delay of any subsequent amendments.

Article 37 Mutual assistance

Competent authorities of Member States must cooperate and assist each other when entities operate across multiple Member States or have network systems in different States. Authorities must inform and consult each other on supervisory or enforcement measures via a single point of contact, may request other authorities to take measures, and must provide proportionate assistance on request including information and on-site or targeted audits. A competent authority may refuse assistance only if it lacks competence, assistance is disproportionate to its tasks, or would conflict with national security, public security or defence interests, and must consult other authorities and potentially the Commission and ENISA before refusing.

Article 38 Exercise of the delegation

Article 39 Committee procedure

The Commission is assisted by a committee operating under Regulation (EU) No 182/2011, and Article 5 of that Regulation applies. Written procedure terminates without result when the committee chair decides or a member requests termination within the opinion delivery timeframe.

Article 40 Review

The Commission must review the Directive's functioning by 17 October 2027 and thereafter every 36 months, reporting to the European Parliament and Council on whether the affected entity sizes and sectors remain appropriate for economic and societal cybersecurity needs, taking into account Cooperation Group and CSIRTs network reports, and may propose legislation where necessary.

Article 41 Transposition

Member States must adopt and publish measures to comply with this Directive by 17 October 2024, immediately inform the Commission, and apply those measures from 18 October 2024. National measures must reference this Directive or be accompanied by such reference at official publication, with Member States determining the reference method.

Article 42 Amendment of Regulation (EU) No 910/2014

Article 19 of Regulation (EU) No 910/2014 is deleted from 18 October 2024.

Article 43 Amendment of Directive (EU) 2018/1972

Articles 40 and 41 of Directive (EU) 2018/1972 are deleted from 18 October 2024.

Article 44 Repeal

Directive 2016/1148 ceases to have effect from 18 October 2024, with references to the repealed Directive now referring to this Directive and interpreted according to the correlation table in Annex III.

Article 45 Entry into force

Article 46 Addressees

Member States are the recipients of this Directive.