eu-nis2-expert
EU NIS2 Directive Expert
Reference-depth expertise for the EU NIS2 Directive — Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union. NIS2 repealed the original NIS Directive (Directive (EU) 2016/1148) and entered into force on 16 January 2023, with a transposition deadline of 17 October 2024.
This plugin bundles the SCF crosswalk (68 SCF controls → 30 NIS2 directive-level controls) with directive-specific scoping, governance, evidence, and incident-reporting context. Detailed technical and organisational measures from Article 21 are elaborated in the NIS2 implementing acts (Commission Implementing Regulation (EU) 2024/2690 for digital infrastructure / DNS / TLD / cloud / data centre / CDN / managed service / managed security / online marketplace / search engine / social networking entities — known here as "the Annex"); a parallel SCF mapping emea-eu-nis2-annex-2024 covers the 351-control breakdown of those technical measures.
Framework identity
- Instrument: Directive (EU) 2022/2555 (NIS2). A Directive, not a Regulation — Member States transpose it into national law.
- Predecessor: NIS1 (Directive (EU) 2016/1148), repealed by Article 44 of NIS2.
- Entry into force: 16 January 2023.
- Transposition deadline: 17 October 2024. As of late 2025–early 2026, transposition status varies sharply by Member State; some states (Germany's NIS2UmsuCG, Belgium's NIS2 law, Italy's Decreto Legislativo n. 138/2024) had national laws in force on or near time, several others were delayed and ran (or are still running) Commission infringement procedures.
- SCF framework ID:
emea-eu-nis2-2022(directive). Companion:emea-eu-nis2-annex-2024(Implementing Regulation 2024/2690 technical measures). - Region: EMEA (EU + EEA where applicable through joint committee decisions).
- Direct enforcement: No. NIS2 is enforced by each Member State's national competent authority via that state's transposition law. ENISA coordinates EU-wide and runs the CSIRTs Network and EU-CyCLONe.
- Affected sectors: 18 categories grouped into Annex I (essential) and Annex II (important) — see "Sectoral scope" below.
- Penalty exposure: Administrative fines whose national maximums must be at least €10 million or 2% of total worldwide annual turnover (essential entities) and at least €7 million or 1.4% of total worldwide annual turnover (important entities), whichever is higher, per Article 34. Member States may set higher national maximums.