NIS-2

NIS-2 is the EU directive that raises the security baseline for essential and important entities. It sets concrete duties: risk-management measures, incident reporting on a fixed clock, direct accountability for management, and security across your supply chain. turingsecure gives you the controls, evidence and incident workflows to meet them.

Who Is in Scope

Essential and Important Entities

NIS-2 applies to organisations in sectors the EU classes as highly critical or critical, from energy, transport, banking and health to digital infrastructure, public administration and manufacturing. Size matters too: most obligations reach medium and large organisations, meaning 50 or more staff or annual turnover above 10 million euros.

The directive splits these organisations into essential entities and important entities. Both carry the same core duties. The difference is supervision: essential entities face proactive oversight, while important entities are supervised after an incident or a concrete indication of non-compliance.

Essential and important entities in scope of the NIS-2 directive

Your Duties

What NIS-2 Requires of You

Article 21 Risk Measures: Put technical and organisational measures in place: risk analysis, incident handling, business continuity, access control, encryption and vulnerability management, each sized to the risk you face.
Article 23 Reporting Clock: Send an early warning within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month.
Management Accountability: Management bodies must approve the risk-management measures and oversee their implementation. Members can be held personally liable and are required to follow security training.
Supply-Chain Security: Assess and address the security of your direct suppliers and service providers, because their weaknesses become your risk under the directive.