NIS2 Requirements: The 10 Measures
The heart of the NIS2 Directive (EU 2022/2555) is Article 21: ten technical and organisational minimum measures that every affected entity must implement in line with the state of the art. Added to these are the personal liability of management under Art. 20 and the staggered reporting obligation within 24 and 72 hours under Art. 23. We explain each requirement in practical terms and guide you to demonstrable compliance.
What NIS2 Requires of You
Obligations, liability, deadlines and who is affected at a glance
10 Minimum Measures
Art. 21 (2) of EU Directive 2022/2555 defines ten mandatory risk management measures — from the risk concept to multi-factor authentication. They apply to every affected entity.
Management Liability
Art. 20 NIS2 obliges management bodies to approve and oversee the measures and to be trained themselves. In the event of breaches, management is personally liable — under the German NIS2UmsuCG without any limitation of liability.
Reporting Obligation 24 / 72 h
Significant security incidents must be reported in stages: an early warning within 24 hours, a full report within 72 hours and a final report after one month at the latest (Art. 23 NIS2).
Who Is Affected?
Affected are medium-sized and large entities (from 50 employees or EUR 10 million in turnover) across 18 sectors — divided into essential and important entities. In Germany, around 29,000 companies (BSI).
Fines & Sanctions
Breaches can incur fines of up to EUR 10 million or 2 % of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4 % for important entities (Art. 34 NIS2).
Registration & Proof Obligation
Affected entities must register with the BSI and be able to demonstrate the effectiveness of their measures. Essential entities are subject to proactive supervision, important ones to incident-based supervision.
The 10 Minimum Measures under Art. 21 NIS2
Every requirement of EU Directive 2022/2555 explained individually
1. Risk Analysis & Security Concepts
Concepts for risk analysis and for the security of information systems (Art. 21 (2) lit. a). The basis is a documented, regularly updated risk management process, ideally aligned with ISO/IEC 27001 or BSI IT-Grundschutz.
2. Handling of Security Incidents
Incident handling (lit. b): processes for detecting, analysing, containing and remediating incidents — including the reporting process to the BSI with a 24-hour early warning and a 72-hour report under Art. 23.
3. Business Continuity
Backup management, recovery after emergencies and crisis management (lit. c). Business continuity and disaster recovery plans with defined RTO/RPO targets and regular recovery tests.
4. Supply Chain Security
Supply chain security (lit. d): securing relationships with suppliers and service providers, assessing their security practices and contractual security requirements right down the IT service chain.
5. Secure Procurement & Vulnerabilities
Security in the acquisition, development and maintenance of IT systems including vulnerability management and vulnerability disclosure (lit. e) — secure development, patch management and defined reporting channels for vulnerabilities.
6. & 7. Effectiveness, Cyber Hygiene & Training
Concepts for assessing the effectiveness of the measures (lit. f) as well as basic cyber hygiene and cybersecurity training (lit. g) — measurable KPIs, audits, awareness training and mandatory management training.
8. & 9. Cryptography, Access & Personnel
Concepts for cryptography and encryption (lit. h) as well as personnel security, access control based on least privilege and asset management (lit. i) — from data encryption to a complete asset inventory.
10. MFA & Secured Communication
Use of multi-factor authentication, continuous authentication as well as secured voice, video, text and emergency communication (lit. j) — the standard for all privileged and remote access.
Frequently asked questions
The questions we are asked most often before a project – with answers on process, costs and data protection.
What are the 10 measures under Art. 21 NIS2?
Art. 21(2) of the NIS2 Directive (EU 2022/2555) lists ten minimum measures: (1) risk analysis and security concepts, (2) handling of security incidents, (3) maintaining operations including backup and crisis management, (4) supply chain security, (5) security in procurement, development and maintenance including vulnerability management, (6) assessing the effectiveness of the measures, (7) basic cyber hygiene and training, (8) cryptography and encryption, (9) personnel security, access control and asset management, and (10) multi-factor authentication and secured communication.
Who is affected by the NIS2 requirements?
Affected are medium-sized and large entities in 18 critical sectors, generally from 50 employees or EUR 10 million in annual turnover. NIS2 distinguishes between essential and important entities. The BSI estimates around 29,000 affected companies in Germany. Regardless of size, certain critical operators and qualified trust service providers may also be covered.
Which reporting obligations apply under NIS2?
Under Art. 23 NIS2 a staggered reporting obligation applies to significant security incidents: an early warning within 24 hours of becoming aware, a full report within 72 hours with an initial assessment and a final report no later than one month after the report. The competent authority in Germany is the BSI.
Is management personally liable for NIS2 violations?
Yes. Art. 20 NIS2 obliges the management bodies to approve the risk management measures, oversee their implementation and regularly attend cybersecurity training. Under the German implementation act (NIS2UmsuCG) management is personally liable for culpable breaches of duty, and a waiver of the company's claims for compensation is invalid.
What fines are possible for violating NIS2 requirements?
Under Art. 34 NIS2, essential entities face fines of up to EUR 10 million or 2% of global annual turnover, and important entities up to EUR 7 million or 1.4% of global annual turnover — whichever is higher. In addition, supervisory measures up to a temporary ban on management duties may apply.
Is an ISO 27001 certification sufficient for the NIS2 requirements?
An ISO/IEC 27001 certification or an approach based on BSI IT-Grundschutz covers many of the ten measures and is a very good foundation, but does not replace full NIS2 compliance. NIS2 additionally requires, among other things, the specific reporting obligations under Art. 23, the management responsibility under Art. 20 and a specific applicability and registration assessment. A gap analysis shows which gaps between an existing ISMS and the NIS2 obligations still need to be closed.
Ready for the next step?
Let's discuss in a free initial consultation how we can move your business forward.