NIS2 scope and duties

NIS2 does not name NDR, but it does require you to detect and handle incidents and to report significant ones on a fixed timeline. Article 21 lists incident handling among the required risk-management measures; Article 23 sets an early warning within 24 hours, a notification within 72 hours and a final report within one month. Network monitoring is one practical way to detect incidents in time and keep the evidence those reports need, and NetSenX tracks the Article 23 deadlines for each incident. The duties sit with your organisation: no tool fulfils them on its own.

NIS2 does not name network monitoring or NDR, but Article 21 lists incident handling among the required risk-management measures, and Article 23 requires significant incidents to be reported on a fixed timeline. You cannot report an incident you have not detected, so continuous network monitoring is one practical way to meet both.

Under Article 23(4): an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, an intermediate report if the authority asks for one, and a final report no later than one month after the notification. National laws transposing NIS2 can add detail, so check your own country's rules.

In general, NIS2 applies to entities in the sectors of its Annexes I and II that are at least medium-sized under Recommendation 2003/361/EC (50 or more employees, or an annual turnover and a balance sheet total both above EUR 10 million) and to some entities regardless of size. Your national authority or legal counsel can confirm whether your organisation is in scope.

No. NetSenX tracks the Article 23 deadlines for each incident, keeps the alerts and the audit log the report draws on, and prepares a GDPR Article 33 breach notification for your DPO; your organisation submits the reports to its CSIRT or competent authority.

National laws must allow maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. Article 34 of Directive (EU) 2022/2555 sets these figures, whichever amount is higher in each case. They are floors for the maximum, not the fine anyone will actually pay: national laws set the exact amounts, which breaches are fined and the procedure, and authorities weigh factors such as the seriousness and duration of the breach and the company's cooperation. Germany, for example, sets up to EUR 10 million or EUR 7 million in section 65 of the BSIG, rising to 2% or 1.4% of worldwide turnover for entities with a total turnover above EUR 500 million. Check your own country's law for the figures that apply to you.

The management body. Article 20 of NIS2 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, to oversee their implementation and to answer for infringements, and requires their members to follow training. In practice that means the managing directors or the board cannot delegate the responsibility away to IT or to a provider, even though others do the work: they approve the measures, receive regular reports and must be able to show that oversight took place. National laws add the detail. In Germany, for example, section 38 of the BSIG obliges the management to implement and monitor the measures, makes it liable to the company under company law and requires regular training. Appoint a named person to run the programme day to day, and keep minutes of every review.

Usually not directly, but there are exceptions, and it can reach you through your customers. NIS2 generally applies to entities in its listed sectors that are at least medium-sized under the EU definition, which in broad terms means 50 or more employees, or annual turnover and balance sheet both above EUR 10 million. Article 2(2) brings in some entities regardless of size, such as providers of public electronic communications, trust service providers, top-level domain registries and DNS service providers, and those a Member State identifies as critical. Check also whether your group counts as one enterprise, because partner and linked companies' figures can be added. Even when you are out of scope, customers in scope must manage supplier risk under Article 21, so expect questionnaires. Your national law and authority have the final word.

Yes, it can. NIS2 measures size with the EU definition of small and medium-sized enterprises (Commission Recommendation 2003/361/EC), under which the staff, turnover and balance sheet of partner and linked enterprises are generally added to the company's own figures. A 30-person subsidiary of a large group can therefore count as large and fall within scope if its activity is in a listed sector. National laws may soften this: Germany's section 28(4) of the BSIG, for example, does not add the group's figures if the company is independent of its partner or linked enterprises in how its IT systems are designed and run. Map each legal entity in the group, its sector and its group figures, check the national rules in each country where it operates, and record the result.

Not with the law directly, unless you are in scope yourself, but you will have to meet your customer's requirements in practice. Article 21(2)(d) obliges entities in scope to address supply-chain security, including security-related aspects of their relationships with direct suppliers and service providers, and Article 21(3) asks them to consider each direct supplier's vulnerabilities and cybersecurity practices. Your customer will therefore send questionnaires, ask for evidence and write security and incident-notification clauses into the contract. Answer truthfully, document what you have, and negotiate duties that fit your size. Contract terms bind you even when the directive does not. NetSenX helps with one recurring question, intrusion detection: it gives you network detection on every plan, Free included, an alert history and an audit log you can show, with customer data stored in the EU.

Four things, broadly. First, governance: the management body approves the cybersecurity measures, oversees them and follows training (Article 20). Second, risk management: appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach, covering at least the ten areas in Article 21(2), from risk analysis and incident handling to backups, supply chain, cryptography, access control and multi-factor authentication. Third, reporting: significant incidents go to the CSIRT or competent authority in stages, an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23). Fourth, registration and supervision as national law sets out. Proportionate means scaled to your size and exposure. NetSenX helps with detection, incident evidence and deadline tracking; the rest is your programme.

Article 21(2) lists the minimum areas every entity in scope must cover. In plain language: policies on risk analysis and information system security; incident handling; business continuity, such as backup management, disaster recovery and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including handling and disclosing vulnerabilities; policies to assess whether the measures work; basic cyber hygiene and training; policies on cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor or continuous authentication, secured voice, video and text communication and, where appropriate, secured emergency communications. Each must be appropriate and proportionate to your risks. National laws restate the list; Germany's is section 30(2) of the BSIG. NetSenX supports incident handling and effectiveness evidence, not the whole list.

Mainly how they are supervised and the maximum fines, not the duties themselves. Both must meet the risk-management measures of Article 21 and report significant incidents under Article 23. Under Article 3, essential entities are, broadly, large companies in the Annex I sectors, plus some entities regardless of size, such as qualified trust service providers, top-level domain registries and DNS service providers, and those a Member State designates; important entities are the other entities in scope from Annexes I and II. Essential entities face proactive supervision, with inspections and audits possible at any time (Article 32), while important entities are supervised after the fact, when there are signs of non-compliance (Article 33). Maximum fines differ under Article 34. National laws use their own names, for example particularly important and important entities in Germany.

Eighteen sectors in two annexes. Annex I, the sectors of high criticality, covers energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business customers (managed service and managed security service providers), public administration and space. Annex II, other critical sectors, covers postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices; computers, electronic and optical products; electrical equipment; machinery; motor vehicles; other transport equipment), digital providers (online marketplaces, search engines and social networks) and research. Each sector is divided into types of entity, so read the exact wording for your activity, not just the sector name. Size thresholds and national choices then decide whether a particular company is in scope.

They can be, in the way national law sets out. Article 20(1) requires Member States to ensure that the management bodies of essential and important entities can be held liable for infringements of their duty to approve and oversee the cybersecurity measures. For essential entities, Article 32 also lets authorities, as a last resort, request a temporary ban on a person exercising managerial functions if ordered measures are not taken. How liability works in practice differs by country: Germany, for example, makes management liable to the company for culpably caused damage under the rules of company law (section 38(2) BSIG) and allows a temporary ban on unreliable managers of particularly important entities (section 61(9)). Check your national law, your directors' and officers' insurance, and keep minutes that show you approved and reviewed the measures.

Yes for the members of management bodies of entities in scope; how often is left to national law. Article 20(2) requires those members to follow training so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides, and it encourages entities to offer similar training to employees regularly. NIS2 sets no hours or certificates. National laws add detail: Germany's section 38(3) of the BSIG, for example, requires management to attend training regularly. A sensible programme covers threats, the company's risk picture, the board's duties and reporting deadlines, and includes a tabletop exercise. Keep attendance records and materials as evidence. NetSenX does not provide training; its plain-language alerts can serve as realistic examples in a session.

The cybersecurity risk-management measures the entity takes under Article 21, and they must also oversee how those measures are implemented. In practice, the board approves a short set of documents and decisions: the risk assessment and the resulting priorities, the security policies that cover the ten areas of Article 21(2), the incident-handling and reporting procedure, the business continuity and backup plan, the supplier-security approach, and the budget and owners for each. Approval is not a single signature: the board should receive regular reports on whether the measures work, decide on gaps and record its decisions. Ask for evidence, not just policies, such as restore tests, monitoring coverage and incident records. NetSenX can supply evidence for detection and incident handling on the network; approving the rest remains the board's job.

By asking for tests and results rather than descriptions. NIS2 itself lists policies and procedures to assess the effectiveness of the measures among the required areas (Article 21(2)(f)). Useful checks that need no technical knowledge: ask IT to restore a real system from backup and report the time it took; ask for the share of accounts with multi-factor authentication and the list of exceptions; ask for the date of the last external penetration test and which findings are still open; ask which network segments are monitored and to see one recent alert and what was done about it; and run a short tabletop exercise once a year. Compare the answers quarter by quarter. NetSenX gives you the detection part in plain language: alert history, the list of monitored segments and an audit log of decisions.

No. NetSenX supports a few of them and is honest about the rest. It helps most with incident handling (Article 21(2)(b)): network detection of beaconing, scanning, lateral movement and unusual outbound data volume on every plan, Free included, with NIS2 Article 23 deadlines tracked per incident. It provides evidence for assessing effectiveness (point f): alert history, monitored segments and an audit log of decisions, with PDF reports from the Starter plan. It gives partial visibility for supply chain (point d), by showing what suppliers' remote sessions do on your network, and for asset management (point i), through the network map. It does not write your policies, run backups, manage access, enforce multi-factor authentication, train staff or handle vulnerability disclosure. No tool achieves compliance on its own: NIS2 compliance is an organisational programme.

No. Compliance means that your organisation has taken the risk-management measures of Article 21, under the oversight of its management body, and reports significant incidents as Article 23 requires; a tool can support some of that work but cannot do it for you. Registration is a separate legal step: if you are in scope, you submit your details to the national authority through the procedure your national law sets, such as the BSI registration in Germany under section 33 of the BSIG, and no vendor can do that on your behalf by selling you software. Be wary of any product sold as making you compliant. NetSenX supports detection, incident evidence and NIS2 deadline tracking, and states what it does not do; whether you are in scope, and registering, stays with you.

Software helps with tasks that produce or analyse data; it cannot take decisions, carry legal responsibility or change behaviour on its own. Tools can help with detecting incidents (network and endpoint detection), keeping evidence and tracking reporting deadlines, managing vulnerabilities and patches, enforcing multi-factor authentication, running and testing backups, keeping an asset inventory, and collecting audit evidence. They cannot decide whether you are in scope, register you, approve measures on behalf of the management body, judge whether an incident is significant, submit the reports, negotiate supplier contracts or make staff follow training. Plan both columns: the tools and, next to each, the person who owns the decision. NetSenX covers network detection, incident evidence and NIS2 deadline tracking; it never submits reports for you.

No. NIS2 is technology-neutral: Article 21 requires appropriate and proportionate measures that take into account the state of the art, relevant standards and the cost of implementation, but it names no product category. In practice you cannot handle incidents (Article 21(2)(b)) or report them on time (Article 23) without some way of detecting them, so most entities use a combination of endpoint protection, log collection and network detection, scaled to their risk. National laws can be more specific for some entities: Germany's section 31(2) of the BSIG requires operators of critical installations to use systems for attack detection, while other particularly important and important entities fall under the general measures of section 30. Choose tools by the risks in your assessment, and document why.

You come into scope from the moment you meet the criteria under your national law, and the clock for registration and the measures starts. Growth in headcount or turnover, or an acquisition that makes you part of a larger group, can change whether you count as medium-sized or large, and in which category you fall. Check the figures at each year-end and before any acquisition closes, using the EU method for counting staff, turnover and balance sheet, including partner and linked enterprises. National laws set when duties begin: in Germany, section 33(1) of the BSIG requires registration no later than three months after an entity first or again counts as particularly important or important. Build the risk-management measures before you cross the line, not after, and include the target's security in acquisition due diligence.

In most countries you assess it yourself first, against the criteria in your national law, and the authority can confirm or correct the result. NIS2 sets the framework: sector and entity type in Annex I or II, size under the EU definition, and the exceptions that apply regardless of size (Article 2). Member States must draw up a list of essential and important entities (Article 3(4)) and, in practice, usually rely on companies to register themselves; some also notify companies they consider in scope. In Germany, the BSI can register an entity itself if it fails to do so (section 33(3) BSIG). So document your assessment: activities, sector mapping, group figures, the conclusion and who signed it off. If the result is unclear, ask the national authority or a lawyer. A vendor cannot make this decision for you.

Usually yes, if you are in scope, with the authority your national law names. Article 3(4) of NIS2 requires Member States to establish a list of essential and important entities and to require entities to submit at least their name, address and up-to-date contact details including e-mail addresses, IP ranges and telephone numbers, their Member State and their sector and subsector. Certain digital providers, such as DNS and cloud providers, data centres, managed service and managed security service providers, register under Article 27 in the country of their main establishment. The procedure and deadline are national: in Germany, section 33 of the BSIG requires registration with the BSI within three months of first counting as an entity and changes within two weeks. Check your own country's portal and keep the confirmation.

Because NIS2 makes them responsible for the security of their supply chain. Article 21(2)(d) requires entities in scope to address supply-chain security, including the security-related aspects of relationships with their direct suppliers and service providers, and Article 21(3) asks them to take into account each supplier's vulnerabilities, product quality and cybersecurity practices. Their auditors and authorities will ask how they did that, and a questionnaire is the usual first step, often followed by contract clauses on security measures, incident notification and audit rights. See it as a sales question: a prompt, honest and documented answer helps keep the customer. Keep a standard answer pack ready, with policies, certifications if any, incident handling, data location and monitoring. NetSenX gives you evidence for the monitoring part on every plan.

Precisely, with what you have, where, and who responds. A good answer names the type of detection (network, endpoint, or both), which sites and segments it covers, how alerts reach a person and how quickly, and what evidence you can provide. For example: network detection runs on the head-office and warehouse segments through a sensor on a mirror port; alerts are e-mailed to the IT manager and our IT provider; we keep an alert history and an audit log of decisions; endpoint protection runs on all laptops and servers. If something is missing, such as night cover, say so and say what you do instead. With NetSenX you can answer that network detection is in place on every plan, with an alert history, an audit log, PDF reports from the Starter plan and customer data stored in the EU.

Find out whether and how you are in scope, then fix the gaps that would hurt most in a real incident. A practical order: confirm scope and category under your national law and register if required; name an owner at management level and brief the board on its duties; list your critical systems, data and suppliers; make sure you would notice an incident, through endpoint and network detection, and that someone receives the alerts; write a short incident-response and reporting procedure that meets the 24-hour, 72-hour and one-month stages of Article 23; test a restore from backups; switch on multi-factor authentication for e-mail, remote access and admin accounts; then work through the remaining Article 21 measures in a risk-based plan approved by management. NetSenX can cover the detection and deadline-tracking steps on every plan, Free included.

Keep it simple, specific and repeated, rather than large and theoretical. NIS2 asks for policies on risk analysis (Article 21(2)(a)) and an all-hazards approach, so include fire, power failure and human error as well as attacks. A workable method: list the services that keep the business running and the systems, data and suppliers each depends on; for each, describe what could go wrong, how likely it is and what it would cost; note the controls already in place and the gaps; rank the gaps by impact; and agree owners and dates for the top ones with management. One page per critical service is enough to start. Review it yearly and after every incident or major change. NetSenX does not perform the assessment, but its alerts and network map show which risks are actually occurring on your network.

Check your national government's or cybersecurity authority's website, because the answer differs by country and changes over time. NIS2 is a directive, so it applies to companies through national laws; Article 41 set the date by which Member States had to adopt them, and several were late. Germany's law, the NIS2UmsuCG, rewrote the BSI Act (BSIG); other countries have passed or are still passing their own acts, often with different names, authorities, registration portals and details. Until your national law is in force, its duties, deadlines and fines do not bind you in the same way, but customers and insurers may already ask for NIS2-level measures, and earlier national cybersecurity rules may still apply. Plan with the directive as the baseline and adjust when your law is final.

It lists it as a required area, where appropriate. Article 21(2)(j) includes the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. Where appropriate leaves room for a risk-based decision, but for the accounts attackers target most, it is hard to justify not using it: e-mail, remote access and VPN, administrator accounts, cloud consoles, backup systems and finance applications. Start there, use authenticator apps or hardware keys rather than SMS where you can, cover service providers' accounts too, and keep a list of documented exceptions with the reason for each. Insurers usually ask about the same accounts. NetSenX itself offers two-factor authentication on every plan; it does not manage MFA for your other systems.

It requires policies and procedures on the use of cryptography and, where appropriate, encryption (Article 21(2)(h)). That means deciding, in writing, where your company uses encryption and how: data in transit (TLS for websites, e-mail and remote access), data at rest (disk encryption on laptops, encrypted backups and databases), and the management of keys and certificates, including who can access them and how they are renewed. Base the choices on current recommendations from your national authority or ENISA, and keep an inventory of where cryptography is used, so you can replace weak algorithms when guidance changes. NetSenX analyses traffic metadata and never decrypts it; where the agent captures packets, on Linux or as a SPAN or TAP sensor, it reads TLS handshakes, which helps show which connections use weak or outdated encryption.

Yes. Article 21(2)(c) lists business continuity, such as backup management and disaster recovery, and crisis management among the minimum measures. In practice, an entity in scope should be able to show: which services and systems are critical and how long they may be down; backups of those systems, kept so that an attacker who controls the network cannot delete or encrypt them, for example offline or immutable copies; restore tests with recorded results and times; a recovery order; and a crisis plan with roles, contact lists on paper and a way to communicate without company e-mail. Practise it at least yearly. Supervisors and insurers both ask for restore-test evidence. NetSenX does not back up or restore anything; it can raise an alert when a device starts touching many file shares or sending data out, which often comes before ransomware locks systems.

That entities in scope must manage the security risks that come from their suppliers and service providers. Article 21(2)(d) includes supply chain security, covering the security-related aspects of relationships between each entity and its direct suppliers or service providers, and Article 21(3) requires entities to take into account the vulnerabilities specific to each direct supplier, the overall quality of products and suppliers' cybersecurity practices, including secure development procedures. Article 22 adds coordinated EU risk assessments of critical supply chains. In practice: keep a list of suppliers with access to your systems or data, rank them by risk, ask the higher-risk ones for evidence, write security and incident-notification clauses into contracts, limit and monitor their access, and review yearly. NetSenX shows what suppliers' remote sessions do on your network and alerts if they spread to other devices.

Yes, as part of a required area. Article 21(2)(i) covers human resources security, access control policies and asset management, and it is hard to protect, patch or recover systems you do not know you have. A useful inventory lists, for each device, system and cloud service: what it is, where it runs, who owns it, how critical it is, which data it holds, and whether it is supported and patched. Keep it current by combining sources: device management, purchase records, cloud accounts and what you actually see on the network. Unknown devices are a common finding, from old servers to small computers in a wall socket. On every plan, the NetSenX network map lists the devices seen on monitored segments with their announced names and first and last seen, which helps you find what the paper inventory missed.

The competent authority your national law designates, often the national cybersecurity agency or a sector regulator. Articles 32 and 33 give authorities supervisory and enforcement powers: on-site inspections and off-site supervision, regular, targeted and ad hoc audits, security scans, requests for information and for evidence of the measures, binding instructions and orders to remedy deficiencies, orders to inform customers about threats, and fines. Essential entities can be supervised proactively at any time, while important entities are usually supervised after the fact, when there are indications of non-compliance. In Germany, the BSI holds these powers under sections 61 and 62 of the BSIG, including ordering audits by independent bodies. Prepare by keeping your documentation current, so you can answer a request in days, not months.

It can, if they provide services in the EU. NIS2 applies to entities that provide their services or carry out their activities within the Union (Article 2), and Article 26 sets which Member State has jurisdiction: as a rule the one where the entity is established, with special rules for providers of public electronic communications, for public administration and for certain digital providers, such as DNS and cloud providers, data centres, managed service and managed security service providers, online marketplaces, search engines and social networks, which fall under the country of their main establishment in the EU. A provider of those digital services that is not established in the EU but offers services there must designate a representative in a Member State. Non-EU companies outside these categories usually meet NIS2 through their EU customers' supplier requirements.

Evidence that the measures exist, are approved by management and actually work. Expect requests for: the scope assessment and registration; the risk analysis and the security policies covering the Article 21(2) areas; minutes showing the management body approved and reviewed them, and records of management training; the incident-handling procedure and the register of incidents, with the reports you submitted and their timing; backup and restore-test results; the supplier list with contracts and assessments; access-control and multi-factor-authentication status; and results of audits, penetration tests and the fixes that followed. German law, for example, requires entities to document compliance with their risk-management duties (section 30(1) BSIG). NetSenX contributes incident evidence: alerts with time, devices and destinations, NIS2 deadlines per incident, an audit log of decisions and, from the Starter plan, PDF reports.

It is the Commission act that sets detailed requirements for the Article 21 measures of certain digital entities. It also defines when an incident at those entities counts as significant. It applies to DNS service providers, top-level domain registries, cloud computing providers, data centre service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. For them, the regulation, which applies directly without national transposition, describes what each measure must contain, from risk management and incident handling to access control and cryptography. German law reflects this: section 30(3) of the BSIG gives that implementing act priority for these entity types. If you are not one of them, it is still a useful, concrete checklist for structuring your own measures, and MSP customers often expect suppliers to follow it.

In names, authorities, procedures and some details, while the core is the same. Every national law must contain the directive's essentials: the sectors and size rules, the Article 21 measures, management-body duties, the staged reporting of Article 23 and fines of at least the Article 34 levels. Differences you will meet include: who the competent authority and CSIRT are and how you reach them; the registration portal and its deadlines; whether more entities are brought into scope, such as some public bodies or smaller firms; extra national requirements, such as Germany's systems for attack detection for critical installations (section 31(2) BSIG) or a named security officer; and the procedure and actual amounts of fines. If you operate in several countries, map each subsidiary to its national law and authority, and check each country's law, because local terms and deadlines decide.