The NIS2 Software That Drives Your Compliance

Two criteria combine: sector and size. An organisation has to operate in one of the sectors listed in the directive's annexes and reach at least the size of a medium-sized enterprise under the European definition, in practice fifty staff or ten million euros of turnover or balance sheet total. The directive itself sets that size test aside in several cases: DNS service providers, trust service providers, and any organisation that is the sole provider in its country of an essential service. The European transposition deadline was 17 October 2024, with the detail then set by each national law.

The classification follows sector and size: large companies in the sectors of high criticality are essential entities, the other organisations in scope are important entities. The risk management measures expected of them are the same; what changes is supervision. An essential entity is supervised proactively, with inspections and audits possible without any prior suspicion. An important entity is supervised after the fact, once there is an indication of non-compliance or an incident. The penalty ceilings differ as well.

No. NIS2 is a directive, not a certifiable standard: no body issues a NIS2 certificate, and a supplier promising you one is selling something else. What the supervisory authority expects is evidence that your risk management measures are defined, implemented, assessed and documented. An ISO 27001 certificate, or a European certification covering a product or a service, can support that case, but it does not replace the demonstration itself.

No, but it covers a good part of the ground. A certified management system already delivers risk assessment, incident handling, business continuity and supplier oversight. What remains is what belongs to the directive: the reporting deadlines towards the authority, the formal accountability of management bodies and their training obligation, and above all the scope, which is that of your regulated activities and not only the one you chose to certify. The useful work is measuring that gap, not starting again.

The directive requires member states to provide for minimum ceilings: for an essential entity, at least ten million euros or 2% of worldwide annual turnover, whichever is higher; for an important entity, at least seven million euros or 1.4%. Fines are not the only lever. An authority can order corrective measures, make a breach public and, for essential entities only, temporarily suspend an authorisation or act on managerial responsibilities.

Not necessarily, and that is where the difficulty sits. The directive only binds the organisations within its scope, yet it makes you accountable for the security of your supply chain, including for providers that carry no direct obligation of their own. You are expected to assess the risk attached to each supplier, take the quality of their security practices into account and carry your requirements into the contracts. A supplier outside the scope is not a supplier outside the analysis.

Because NIS2 compliance is demonstrated through links, not through a list. The authority wants to see which measure covers which requirement, which risk justifies it, which evidence supports it and when it was last reviewed. A spreadsheet loses those links as soon as a scope shifts or an owner changes role, and it keeps no history of the decisions taken. A platform maintains them, flags what has gone stale and produces the deliverables without re-keying. With Vailor, AI also cuts the time spent on risk assessments by 70%.