NIS2 directive: European cyber regulation

Understand NIS2 obligations, EU country enforcement and how Thales supports compliant, resilient critical infrastructure operators.

Cybersecurity
Cybersecurity services
Cyber governance & compliance

Overview of the European Union NIS2 Directive, its key cybersecurity obligations, national enforcement across Europe, and how Thales helps essential and important entities achieve compliance and resilience.

NIS2 requirements

NIS2 defines stringent cybersecurity, governance and reporting obligations for essential and important entities across the European Union.

Risk management

Regular risk assessments of network and information systems, and implementation of appropriate technical and organisational security measures.
Incident reporting

Significant cybersecurity incidents must be reported within 24 hours. Entities must have clear incident response procedures and conduct tabletop exercises to test their effectiveness.
Corporate accountability

Senior management is responsible for overseeing, approving, and being trained on the entity’s cybersecurity measures. Breaches may result in penalties for management, including liability and potential temporary bans from management roles.
Business continuity

Organisations must maintain up-to-date backups and ensure IT system recovery strategies are in place to minimise downtime after incidents.
Third-party and network security

Organisations must assess the cybersecurity posture of third-party vendors and suppliers to manage supply chain risks and meet NIS2 requirements. They must also implement security controls such as firewalls and intrusion detection/prevention systems (IDS/IPS) to protect networks from unauthorised access.
Data protection & access

Sensitive data must be encrypted at rest and in transit, with regularly tested backups ensuring quick recovery in case of a breach. Multi-factor authentication (MFA) is mandatory, with alternative measures required where MFA is not feasible.

What is NIS2?

The NIS2 directive (Directive (EU) 2022/2555) is the European Union’s updated framework for cybersecurity, replacing the original NIS Directive (2016). It aims to establish a high common level of security for network and information systems, expanding the scope of covered entities and strengthening risk management, incident reporting and enforcement. EU Member States had to transpose NIS2 into national law by 17 October 2024.

Cyber governance & compliance
Cybersecurity
Cybersecurity services

NIS2: don’t comply, be cyber secure

Understand NIS2 obligations, EU country enforcement and how Thales supports compliant, resilient critical infrastructure operators.

Download white paper

Thales stands out as a Critical National Infrastructure (CNI) organisation, with decades of experience securing essential services and strategic assets across Europe. NIS2 compliance is a strategic priority to protect critical infrastructure, ensure regulatory alignment and maintain stakeholder trust.

We offer a comprehensive suite of cybersecurity solutions, including risk management, incident response, secure communications and cryptographic key management, backed by global SOCs, advanced threat intelligence and post-quantum cryptography to help NIS2‑regulated entities remain both compliant and resilient.

Cybersecurity appliance changes by country

The Supervision Commission of the Financial Sector (CSSF) and the Commissariat aux Assurances (CAA) are responsible for NIS2 enforcement. Luxembourgish organisations must comply with strict incident reporting, risk management, and business continuity requirements, with a strong focus on protecting critical infrastructure.

The Portuguese Securities Market Commission (CMVM) and the Bank of Portugal oversee NIS2 compliance. Portuguese organisations must conduct regular risk assessments, implement robust incident response procedures, and ensure business continuity. The focus is on enhancing the resilience of financial and critical infrastructure sectors.

The Autorité de contrôle prudentiel et de Résolution (ACPR) and the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI) oversee NIS2 enforcement. French organisations must comply with stringent incident reporting, risk management, and business continuity requirements, with a strong emphasis on protecting critical infrastructure.

The Belgian Financial Services and Markets Authority (FSMA) and the National Bank of Belgium (NBB) oversee NIS2 compliance. Belgian entities must conduct regular risk assessments, implement robust incident response procedures, and ensure business continuity, with a focus on enhancing the resilience of financial and critical infrastructure sectors.