NIS2: what applies to you – and what do you do first?

What NIS2 is – and why it is not an IT project

NIS2, Directive (EU) 2022/2555, is the EU's revised cybersecurity framework and replaces the earlier NIS1. Its aim is to raise the baseline in organisations that society depends on and to make the requirements more uniform across the Union.

A directive is not a law that applies directly. It has to be transposed into national legislation, and each member state decides some of the details: which authority carries out supervision, how penalties are designed and which channels are used for reporting. So start from the Swedish implementation and check what actually applies to you – provisions in the directive may have been worded differently in Swedish law.

A common misconception is that NIS2 is an IT project. It is not. The requirements are aimed at the organisation and its management, and are as much about governance, responsibility and suppliers as about technology.

Are you covered? Sector, size and role in the chain

The regulations apply to organisations in a number of sectors. Those mentioned include energy, transport, banking and finance, healthcare, drinking water, waste water, digital infrastructure, ICT service management, public administration and space, plus a few other areas. The list is long and the boundaries can be hard to draw – especially if you supply someone who is covered.

Size is decisive in most cases. The starting point is medium-sized and large companies, with thresholds of around 50 employees or EUR 10 million in turnover. Some organisations are covered regardless of size, for example parts of public administration and certain trust service providers. The directive also distinguishes between important and essential entities: both are subject to the requirements, but essential entities are under stricter supervision.

Four questions to answer before you plan anything:

• Sector: do you operate in one of the listed sectors, or on the borderline of one?
• Size: are you medium-sized or large by the criteria – or are you covered regardless of size?
• Role in the chain: are you a supplier to an organisation that is covered? Then the requirements often reach you through contracts, even if the law does not apply to you directly.
• Category: do you count as an important or an essential entity? That affects supervision, documentation and reporting.

The size criteria are based on number of employees and turnover or balance sheet total. Check the exact thresholds and exemptions in the Swedish implementation before drawing conclusions.

Management responsibility – the biggest change from NIS1

What most clearly sets NIS2 apart from NIS1 is that responsibility moves up to management. Management must approve the risk management measures taken, be accountable for their implementation and follow-up, and in some cases undergo training. In the event of infringements, liability can be directed at members of management personally, alongside penalties against the organisation.

In practice this means NIS2 cannot be delegated to a security function. Management needs to be able to say what risks exist, what is being done about them and how it knows the measures work. These are the same questions a board should ask regardless of regulation – but here they are written explicitly into the law.

The ten areas of risk management

Risk management is described in ten areas. They are to be applied in proportion to the organisation's risks and size, and they overlap heavily with established information security frameworks.

Read the table as a map of areas, not a finished list of requirements. The exact wording and scope are determined by the Swedish implementation.

Reporting: early warning, notification and final report

Significant incidents must be reported in several stages. The most common summary of the directive's procedure looks like this:

Deadlines and channels may differ between countries and between supervisory areas. Verify what applies in Sweden and which authority you must report to – and make sure you can actually report in practice, not just describe the routine in a document. Note also the similarity to the GDPR's 72-hour rule for personal data breaches: the same event may need to be handled in several parallel tracks.

What do you do first? Five steps in order

1. Determine whether you are covered – and document the assessment. Write down sector, size, role and who made the decision. Even a no needs to be explainable later.
2. Appoint an owner and anchor it with management. Clear ownership, a mandate and a standing item on management's agenda. Without that, the work never gets beyond a presentation.
3. Map assets, dependencies and suppliers. What is business-critical, what depends on what, and which third parties can you not do without?
4. Get the incident process in order. Detection, escalation, reporting and contact routes – and practise it before you need it.
5. Fix the basics. Access and permissions, MFA on the most important accounts, updates, logging, working backups and training. That gives the most effect for the money.

Build a management system – NIS2, ISO 27001, GDPR and the AI Act

There is rarely any reason to build separate systems for each regulation. ISO/IEC 27001 covers large parts of the ten areas. If you have an information security management system (ISMS) in place, the gap to NIS2 is often manageable: it is more about connecting existing processes to the new requirements, documenting management's responsibility and reviewing the supply chain. See our security services for how we usually structure that work.

The GDPR and NIS2 share several processes: incident handling, access control, supplier agreements and documentation. A personal data breach is not always a NIS2 incident, and vice versa – but the routines can be shared. Read DPIA in practice and GDPR and data protection.

The AI Act adds requirements for risk management, documentation and logging for AI systems. There too, much of what you already do in information security can be reused. Read Is your AI system a high-risk system?

In short: build a management system with shared processes and adapt them to each regulation, instead of running NIS2 as a separate project alongside everything else. If you want help pinning down scope, responsibility and what to do first, book a meeting.