LRO ConsultThe European NIS2 directive replaces NIS1 and changes scale: where a few hundred operators per country used to be covered, many thousands of entities are now in scope across the EU, including a large number of mid-sized companies and public bodies.
Three questions to see where you stand
Is your sector on the list? The directive covers 18 sectors, from energy and healthcare to digital infrastructure, managed ICT services, waste management and food production.
How large is your organisation? As a general rule, medium and large companies are covered: from 50 employees, or above 10 million euros in turnover and balance sheet. Some activities are covered regardless of size.
Do you supply an entity in scope? Even if you are not directly covered, your customers subject to NIS2 must secure their supply chain. Expect security questionnaires and contractual requirements.
What it means
Entities in scope must put documented risk management in place, report significant incidents within short deadlines, secure their backups and business continuity, and directly involve their management, which becomes accountable.
Where to start
Check how NIS2 has been transposed in your country and how to register with the competent authority (in France, ANSSI’s MonEspaceNIS2 service). Then take stock: asset inventory, backups, recovery plan, access management. That is exactly what a first call is for.