NIS2 Compliance
NIS2 is the EU cybersecurity directive (Directive (EU) 2022/2555), which member states had to transpose by 17 October 2024. It extends obligations to essential and important entities across many sectors and reaches Brazilian groups with EU operations, with management accountability and short incident-reporting deadlines.
What is NIS2?
NIS2 (Directive (EU) 2022/2555) is the European Union directive on the security of network and information systems. It entered into force on 16 January 2023, repealed the original NIS Directive ((EU) 2016/1148), and had to be transposed into each member state's national law by 17 October 2024.
The directive distinguishes essential entities from important entities and applies, under the size-cap rule, from medium-sized enterprises upward in the sectors listed in Annexes I and II. It introduces direct accountability for management bodies, a minimum set of risk-management measures, and incident-reporting obligations. NIS2 has extraterritorial reach: it applies to organizations not established in the EU that offer services in the European market — including groups with EU subsidiaries or operations — some of which must designate a representative in the Union. Transposition happens through each country's national law, so the exact scope and penalties depend on the jurisdiction where the entity operates.
What the engagement covers
Who does NIS2 apply to?
NIS2 applies to essential and important entities in the high-criticality and critical sectors, generally from medium-sized enterprises upward. The first step of the engagement is to determine whether and how the organization falls in scope, sector by sector and jurisdiction by jurisdiction.
Essential entities
Large organizations in the high-criticality sectors of Annex I. They are subject to proactive supervision and to the directive's highest penalties.
Important entities
Medium-sized enterprises in Annex I sectors and entities in Annex II sectors. They are subject to reactive supervision, triggered by indications of non-compliance.
High-criticality sectors (Annex I)
Energy, transport, banking, financial market infrastructures, health, drinking and waste water, digital infrastructure, ICT service management, public administration, and space.
Other critical sectors (Annex II)
Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research organizations.
Size-cap rule
The directive generally applies to medium-sized enterprises and above; some critical entities fall in scope regardless of size.
Groups with EU operations
Extraterritorial reach captures non-EU organizations offering services in the Union. Some digital providers must designate a representative in the EU.
What are the NIS2 obligations and deadlines?
NIS2 requires proportionate risk-management measures, management accountability, and a staged incident-reporting process. The reporting deadlines are short and must be designed before an incident occurs.
Management accountability
Management bodies approve the risk-management measures, oversee their implementation, and can be held personally liable for breaches. Training is also required.
Risk-management measures
A minimum set of technical and organizational measures: risk analysis, incident handling, business continuity, cryptography, access control, and basic cyber hygiene.
Incident reporting
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month, to the competent national authority or CSIRT.
Supply-chain security
Measures must cover risks from suppliers and service providers, with security assessment across the whole supply chain.
Registration and supervision
In-scope entities must register with national authorities, which exercise supervision and may require audits, inspections, and evidence of compliance.
Penalties
For essential entities, up to €10 million or 2% of total worldwide annual turnover; for important entities, up to €7 million or 1.4%, whichever is higher.
How does Berghem support NIS2 compliance?
From scope determination to technical validation, Berghem — with Berilo for the European market — covers the risk-management measures, governance, and incident reporting the directive requires, with auditable evidence.
NIS2 gap analysis
Scope determination (essential or important entity) and diagnosis against the risk-management measures, with a prioritized roadmap to compliance.
ISO 27001 as the base
An information security management system aligned with ISO 27001 delivers much of the technical and organizational measures NIS2 requires.
Incident response and reporting
Design of the response and notification process that meets the 24h, 72h, and one-month windows, with playbooks, roles, and communication with the competent authority.
Supply-chain security
Third-party risk management (TPRM) to assess suppliers and the supply chain, as the NIS2 measures require.
Technical testing
Penetration testing and offensive security that produce the evidence of security measures implemented across networks, applications, and infrastructure.
Threat intelligence
Threat intelligence to support the risk analysis and continuous monitoring the directive's measures call for.
What drives the cost and timeline of a NIS2 engagement?
There is no single price. The investment depends on the applicable scope, the current maturity of controls, and the number of jurisdictions the group operates in.
Entity classification
Being an essential or important entity changes the intensity of supervision and the depth of evidence required, and therefore the engagement effort.
Control maturity
Organizations with an ISMS already in place — for example, aligned with ISO 27001 — reach compliance with less remediation. Open gaps extend the timeline.
Number of jurisdictions
NIS2 is transposed by distinct national laws. Operating in several EU countries multiplies registration, reporting, and authority-relationship obligations.
Supply-chain complexity
The number of critical suppliers and their relevance to the service determine the breadth of the third-party risk assessment.
NIS2 questions
Who needs to comply with NIS2?
What was the NIS2 transposition deadline?
What are the incident-reporting deadlines?
What penalties does NIS2 set out?
Does NIS2 apply to a Brazilian group with EU operations?
Ready to start your NIS2 engagement?
In one conversation we determine the applicable scope, map the gaps against the directive's measures, and design the path to compliance — from governance to incident reporting.
Contact Us