NIS2 has been enforceable across the EU since October 2024, yet it remains one of the least understood pieces of cybersecurity legislation in the market. Part of that is scope: it only applies to organizations above certain size thresholds operating in specific sectors, so large portions of industry have no reason to track it closely. Part of it is overlap: companies that are already dealing with the Cyber Resilience Actor ISO 27001 sometimes wonder whether they’ve effectively covered their NIS2 obligations as well. They haven’t, and this post explains why.
What NIS2 Regulates
NIS2 (Network and Information Security Directive 2, EU 2022/2555) targets organizations operating in sectors the EU considers critical or important. Energy, transport, banking, health, digital infrastructure, water, public administration, and space are on the essential side. Manufacturing of key products, postal services, waste management, and digital providers fall under the important category.
Size thresholds determine whether you’re in scope. The rule uses the EU SME definition: you’re out if you have fewer than 50 employees AND your annual turnover is at or below €10M AND your balance sheet doesn’t exceed €10M. Exceed any one of those criteria and you’re in. A company with 30 employees but €15M in revenue is a medium-sized entity under NIS2 and needs to comply.
A few categories have no size threshold at all.
Trust service providers, DNS service providers, and operators of critical infrastructure fall under NIS2 regardless of how small they are.
One more thing worth noting on scope: outsourcing physical production doesn’t change your classification. If your company designs a product, has it manufactured by an ODM outside the EU, and places it on the EU market as the responsible economic operator, you’re the manufacturer in the legal sense. The same logic that applies to CE marking and GPSR applies here.
What the Cyber Resilience Act Regulates
The CRA applies to manufacturers and importers of products with digital elements. If you put a connected device or software product on the EU market, the CRA covers you, regardless of your sector or size.
Where NIS2 looks at how an organization manages its own security operations, the CRA looks at what’s inside the product before it ships. Security by design, vulnerability handling, software updates, and technical documentation are the core obligations. The CRA is also a market access regulation: compliance is a condition for CE marking on products with digital elements.
The Core Distinction
NIS2 regulates how you run your organization. The CRA regulates what you sell.
A company can be subject to both. A manufacturer of connected industrial equipment that also operates critical infrastructure in an EU member state has CRA obligations for its products and NIS2 obligations for its operations. Those two sets of requirements don’t cancel each other out, and complying with one doesn’t satisfy the other.
What NIS2 Actually Requires
Article 21 of the directive sets out a minimum of ten risk management measures that in-scope entities must implement. These cover risk analysis and information security policies, incident handling, business continuity and disaster recovery, supply chain security, network security, access controls, encryption, multi-factor authentication, and cybersecurity training.
Article 23 sets the incident reporting timeline. Once your organization becomes aware of a significant incident, the clock starts: 24 hours for an initial early warning to your national authority, 72 hours for a detailed notification with severity assessment, and one month for a full final report.
Article 20 introduces something that tends to get attention in boardrooms. Senior management is personally responsible for approving and overseeing the cybersecurity measures in Article 21. That responsibility can’t be delegated to IT. If an organization fails to comply, the people at the top are exposed, not just the company.
And What Are the Differences Between NIS2 and ISO 27001?
They address different problems, and the distinction matters practically.
ISO 27001 is a voluntary international standard for information security management systems. Getting certified means an accredited third party has verified that your ISMS meets the standard’s requirements. It signals good governance to customers and partners. It has no enforcement mechanism, carries no fines, and creates no personal liability for management.
NIS2 is a legal obligation with active enforcement. National authorities are conducting audits, examining board meeting minutes, and verifying that leadership is genuinely engaged in risk oversight. Fines reach €10M or 2% of global annual turnover for essential entities, and €7M or 1.4% for important entities.
The overlap is real. The controls ISO 27001 requires and the measures NIS2 mandates cover much of the same ground: risk assessment, incident response, access controls, supply chain security, business continuity. An organization with a mature ISO 27001 implementation will find that a significant part of the NIS2 groundwork is already done.
The gap is in governance and reporting. ISO 27001 doesn’t require you to notify any authority within 24 hours of an incident. It doesn’t create personal liability for your CEO. It doesn’t mandate that your board approve your security policies by name. Those are NIS2 requirements that ISO 27001 certification alone won’t cover.
Do You Need a CISO to Comply with NIS2?
A Chief Information Security Officer, or CISO, is the senior executive responsible for an organization’s cybersecurity strategy and its day-to-day implementation.
The role sits at the intersection of technical security and corporate governance: the CISO translates risk into business terms, reports to the board, and owns the incident response process.
NIS2 doesn’t use the word CISO anywhere. The directive requires the management body to approve and supervise cybersecurity measures, but it doesn’t mandate a specific role or job title.
That said, for a medium or large entity in a regulated sector, meeting the Article 21 requirements in practice requires someone to own them. That person coordinates risk assessments, manages the incident response process, oversees supply chain security, runs the training program, and reports to the board. Whether the company calls that person a CISO or something else is a naming decision, not a compliance one.
The contrast with US regulation is worth noting. New York’s Department of Financial Services cybersecurity regulation (23 NYCRR 500) explicitly requires covered financial institutions to designate a Chief Information Security Officer by name, with a direct reporting line to the board and a mandatory annual written report on the state of the cybersecurity program. Several US states with insurance data security laws follow the same model. The EU chose a different approach: it defines outcomes and governance obligations, and leaves the organizational structure to each entity.
The first practical step is determining which regulations actually apply to your situation. If you operate in a regulated sector and exceed the size thresholds, NIS2 applies. If you manufacture or import products with digital elements for the EU market, the CRA applies. If both are true, you’ll need to address both, and the sooner you map the gaps, the less overlap you’ll be managing reactively.
If you want to understand which of these obligations apply to your company and what a compliance roadmap looks like in practice, get in touch and we’ll walk you through it.
