NIS2
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
Published by European Parliament and Council of the European Union · Directive (EU) 2022/2555 — Member States transposed by 17 October 2024; national measures apply from 18 October 2024
Measures for a high common level of cybersecurity across the EU: cybersecurity risk-management obligations, incident-reporting requirements, and supervision for essential and important entities.
How it’s structured
- 9 chapters and 46 articles, plus 3 annexes listing in-scope sectors
- Splits regulated organizations into 'essential' and 'important' entities, each under a different supervisory regime
Who it applies to
Public and private entities listed in Annex I or II that meet the medium-enterprise size cap or above (Article 2: broadly at least 50 employees, or more than €10 million in annual turnover or balance sheet total), plus specific entities in scope regardless of size, such as DNS providers, trust service providers, and sole providers of a critical service.
How Pentforge uses it in an engagement
- Applicability screening against the Annex I/II sector lists and the size-cap thresholds
- Gap analysis and evidence preparation designed for NIS2's risk-management and incident-reporting themes — not legal advice and not a certification
What you get
- A scoping note on whether NIS2 applies and under which entity category
- A gap register mapped to the risk-management measures in scope
Official source
Pentforge does not issue certificates
We assess against NIS2 — that is a statement about the work, not a certification. Pentforge holds no certifications of its own; the credentials our practitioners hold individually are listed on About.
Request a scoping call