NIS2 Directive Compliance

The NIS2 Directive (Directive (EU) 2022/2555) is the EU's law for achieving a high common level of cybersecurity across the Union. It imposes binding obligations on essential and important entities across 18 critical sectors and shifts the expectation from merely having documented policies to demonstrating actual control effectiveness, structured risk management, and measurable incident readiness.

NIS2 entered into force in January 2023. EU Member States were required to transpose it into national law by 17 October 2024, and it repealed the original NIS Directive (2016/1148) with effect from 18 October 2024

Compliance is mandatory for essential and important entities operating across the Directive's 18 critical sectors. Entities in the digital infrastructure and digital provider sectors are additionally subject to Commission Implementing Regulation (EU) 2024/2690, which is directly applicable without national transposition and translates the high-level measures of Article 21 into more than 150 specific, binding technical and methodological requirements.

NIS2 raises the level of ambition through four main shifts: a wider scope covering 18 critical sectors, clearer obligations for essential and important entities, stronger management accountability, and more aggressive supervision and enforcement. Most significantly, it makes assessing the effectiveness of cybersecurity risk-management measures a mandatory measure in its own right.

As of mid-2026, transposition is no longer theoretical. Most Member States have enacted their national NIS2 laws and are in live implementation, while a smaller group is still completing the process. Following reasoned opinions issued to Member States for incomplete transposition, enforcement has accelerated. For essential and important entities, NIS2 is now a live operational obligation, not a future one.

The 2026 amendments are still proposals, not law. As of June 2026, the Commission's proposed changes — part of the Digital Omnibus and a broader cybersecurity package, focused on incident notification routing, scope clarifications, and certification-based pathways — remain in the legislative process and have not been adopted. They do not alter the core Article 21 risk-management obligations or the Article 23 reporting triggers and deadlines that compliance rests on.

Non-compliance can attract administrative fines of up to €10 million or 2% of total worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities. These sit alongside management accountability under Article 20 and potential personal liability for senior managers. Providing false or grossly inaccurate information about risk-management measures is itself treated as a serious infringement.

The Picus Platform continuously validates control effectiveness through adversary-emulated techniques in a production-safe manner. It helps essential and important entities meet NIS2 requirements by verifying whether identified vulnerabilities can actually be leveraged into attack paths, testing whether monitoring tools properly detect malicious behaviors, prioritizing remediation based on validated exposure rather than theoretical severity, and generating objective, MITRE ATT&CK-mapped evidence to support audits, supervisory requests, and post-incident reviews.