Overview
NIS2 is the EU directive that expands and strengthens the original NIS Directive, raising the cybersecurity baseline for essential and important entities across more sectors.
Purpose
Achieve a high common level of cybersecurity across the EU by mandating risk-management measures, incident reporting, and stronger supervision and enforcement.
Architecture
Core obligations include risk-management measures (Article 21), incident reporting with staged deadlines (Article 23), and governance accountability for management bodies.
Core Concepts
- Essential vs. important entities — determines the supervisory regime and penalties.
- Supply-chain security — measures must address risks from suppliers and service providers.
Cloud Mapping
Article 21 measures (access control, encryption, MFA, logging) map to native controls in AWS, Azure, GCP, and Kubernetes; incident-reporting timelines drive detection and alerting design.
References
See the primary source below.