NIS2 Directive (Directive (EU) 2022/2555): cybersecurity risk management and incident reporting for essential and important entities
Medium and large entities in 18 critical sectors must take appropriate cybersecurity risk-management measures, including access control and attention to the quality of their suppliers, and notify national authorities of significant incidents. Top management is accountable for non-compliance with those measures.
Scope. Reaches a US company of medium or large size in a covered sector through each Member State's transposing law; under Article 26(3) a DNS, cloud, data centre, content delivery, managed or managed security service provider, online marketplace, search engine or social network not established in the EU but offering services there must designate an EU representative. US suppliers are reached indirectly through covered entities' supply-chain duties (Article 21(2)(d) and (3)).
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Reporting integrity C-V2 | Required by the text | Article 23(1): essential and important entities 'notify, without undue delay, its CSIRT or ... competent authority ... of any incident that has a significant impact'; Article 23(4): early warning 'within 24 hours', incident notification 'within 72 hours', final report 'not later than one month' after the notification. Binding through national transposing law. | high | 1 case |
| Provenance of the actor's software and hardware C-A3 | Implied | Article 21(2)(d): measures shall include 'supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers'; Article 21(3): entities take into account 'the overall quality of products and cybersecurity practices of their suppliers ... including their secure development procedures'. Documentation of component origin is not named. | medium | 1 case |
| Least-privilege credential scoped to task C-E1 | Implied | Article 21(2)(i): measures shall include 'human resources security, access control policies and asset management'. Least privilege is not named. | medium | 5 cases |
| Coordinated disclosure program C-O1 | Implied | Article 21(2)(e): measures shall include 'security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure'. An outside-reporter path is not named. | high | not yet seen missing in a case |
| Recovery assets outside the failure domain C-R1 | Implied | Article 21(2)(c): measures shall include 'business continuity, such as backup management and disaster recovery, and crisis management'. Separation of backups from the failure domain is not named. | high | not yet seen missing in a case |
| Actor identity verification C-A1 | Implied | Article 21(2)(j): 'the use of multi-factor authentication or continuous authentication solutions ... where appropriate'. | medium | 8 cases |