Compliance · NIS2
NIS2: which organisations are in scope and what does it require?
By Steven Carrier Updated on
Up to date as of . In France, the bill transposing NIS2 is being debated in the National Assembly and has not yet been promulgated at this date.
The NIS2 Directive (EU) 2022/2555 applies to medium-sized and large organisations in 18 sectors, and to some entities regardless of their size. It requires them to manage cyber risk under the accountability of their management, to report significant incidents within 24 hours, then 72 hours, and to secure their supply chain. BEAROPS helps you prepare, document and demonstrate your compliance, without ever taking its place.
- Compliance support, not a guarantee
- Evidence mapped to obligations
- French software vendor
Which organisations are in scope of NIS2?
NIS2 applies to public and private entities in 18 sectors that are at least medium-sized enterprises: 50 or more employees, or annual turnover and balance sheet total both above €10 million (Article 2 and Recommendation 2003/361/EC). Its scope is far wider than that of the first NIS Directive: many mid-sized companies and SMEs are now in scope, often without knowing it.
Some entities are in scope regardless of their size: providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, domain name registration services, critical entities, and any entity that is the sole provider of an essential service in a Member State.
| Criterion | What the directive provides |
|---|---|
| Sectors of high criticality (Annex I) | Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration, space |
| Other critical sectors (Annex II) | Postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery, vehicles), digital providers, research |
| Size threshold | Medium-sized and large enterprises: 50 or more employees, or annual turnover and balance sheet total above €10 million |
| Supply chain effect | An entity in scope passes requirements on to its suppliers, even when they are not in scope themselves |
In France, an entity that considers itself in scope must register with ANSSI, which has opened pre-registration on MesServicesCyber. According to ANSSI, several thousand entities will be in scope, mostly medium-sized and large companies, local authorities and public administrations.
Essential or important entity: what is the difference?
Both categories have the same security and reporting obligations. They differ in how the authority supervises them: ex ante and ex post for an essential entity, ex post only, based on evidence or indications, for an important entity. The ceiling for fines is also higher for an essential entity.
| Criterion | Essential entity | Important entity |
|---|---|---|
| Who? | Annex I entities above the medium-sized enterprise ceilings (250 or more employees, or turnover above €50 million and balance sheet total above €43 million), and certain designated entities regardless of size (Article 3) | Any other Annex I or II entity that falls within the scope of the directive |
| Obligations | Article 21 measures, Article 23 reporting | The same |
| Supervision | Ex ante and ex post: inspections, random checks, regular and targeted audits (Article 32) | Ex post, based on evidence or indications (Article 33) |
| Maximum fine | At least €10 million or 2% of total worldwide annual turnover | At least €7 million or 1.4% of total worldwide annual turnover |
What does NIS2 require?
Article 21 requires technical, operational and organisational measures proportionate to the risk, based on an “all-hazards” approach. It sets ten minimum areas. Any non-compliance found must be corrected without undue delay.
Two requirements shape day-to-day work: continuous risk management, based on analysis of the attack surface and the prioritised remediation of vulnerabilities , and the ability to prove that these measures are applied.
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity: backups, disaster recovery, crisis management.
- Supply chain security and relationships with direct suppliers.
- Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of the measures.
- Basic cyber hygiene and cybersecurity training.
- Cryptography and, where appropriate, encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication and secured communications, including in emergencies.
In France, ANSSI has published a working version of the Référentiel Cyber France (ReCyF), which details the measures it recommends to meet these objectives and may still be adjusted. For essential entities, this version provides for a security audit that includes at least one of the following: a penetration test , a configuration audit, an architecture audit, or an organisational and physical audit.
What must senior management do?
NIS2 places cyber risk governance at management level (Article 20). Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Their members are required to follow cybersecurity training. For an essential entity, the authority can go as far as requesting a temporary ban on a manager exercising their functions (Article 32). Cybersecurity becomes a matter of governance, not just a technical one.
What are the deadlines for reporting an incident?
An incident is “significant” if it has caused, or is capable of causing, severe operational disruption or financial loss for the entity, or considerable damage to others. It is reported to the CSIRT or the competent authority in several stages, and recipients of the affected services must be informed without undue delay where necessary.
| Stage | Deadline | Expected content |
|---|---|---|
| Early warning | 24 hours after becoming aware | Suspected malicious act, possible cross-border impact |
| Incident notification | 72 hours after becoming aware | Initial assessment: severity, impact, indicators of compromise |
| Intermediate report | At the request of the CSIRT or authority | Relevant status updates |
| Final report | No later than one month after the incident notification | Detailed description, likely root cause, mitigation measures, cross-border impact |
What are the penalties for non-compliance?
An infringement of Article 21 or 23 exposes an essential entity to a fine with a maximum of at least €10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. For an important entity, the ceiling is at least €7 million or 1.4% (Article 34). The directive sets minimums: each Member State sets the amounts in its transposing law.
Before a fine, the authority has other measures: warnings, binding instructions, targeted audits at the entity’s expense, an obligation to inform affected customers and, for an essential entity, suspension of a certification or a temporary ban on a manager. The challenge is not only to act, but to be able to prove that you act.
What does NIS2 change for your suppliers?
NIS2 makes supply chain security an obligation. For each direct supplier and service provider, you must take into account its specific vulnerabilities, the quality of its products and its cybersecurity practices, including its secure development procedures. This is a major shift for procurement and security teams, which must now share a common reading of supplier risk.
Structure a TPRM (third-party risk management) programme with Bearlink, or start from our NIS2 supply chain checklist (article in French).
Where does NIS2 transposition stand in France?
Adopted on 14 December 2022, the directive had to be transposed by Member States by 17 October 2024 at the latest, and applied from 18 October 2024, the date on which the first NIS Directive was repealed.
In France, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity was tabled in the Senate on 15 October 2024 and adopted by the Senate at first reading on 12 March 2025. As of 9 November 2026, it is being debated in plenary in the National Assembly and has not been promulgated. Its implementing decrees will set out the national arrangements.
In the meantime, ANSSI encourages future essential and important entities to start their security programme now, to pre-register and to use the ReCyF.
How does BEAROPS help you prepare?
Each requirement calls for action by your organisation. BEAROPS equips and documents those actions; compliance remains your responsibility.
| NIS2 requirement | Expected action | How BEAROPS helps |
|---|---|---|
| Risk governance (Art. 20) | Map and manage cyber risk | Unified view of exposure and management reporting |
| Security measures (Art. 21) | Address vulnerabilities continuously | Detection, prioritisation and remediation tracking |
| Effectiveness of measures (Art. 21) | Test defences in real conditions | Penetration tests, Red Team exercises and automated Red Teaming |
| Incident reporting (Art. 23) | Detect and document incidents | Traceability of findings and remediation |
| Supply chain (Art. 21) | Assess supplier risk | Native supplier cyber rating (Bearlink) |
| Proof of compliance (Art. 32 and 33) | Demonstrate implementation | Evidence mapped to obligations |
Where is your evidence data hosted? See our sovereignty and hosting doctrine .
Where to start? A 30, 60 and 90-day plan
-
30 days
determine whether you are in scope and in which category, pre-register with ANSSI, map your exposure, identify critical suppliers.
-
60 days
close the priority gaps, formalise governance and management training, set up incident detection and reporting.
-
90 days
structure continuous evidence, extend to supplier monitoring, prepare for dialogue with the authority.
Which NIS2 requirements are the hardest to implement?
Surveyed by ENISA for its NIS Investments 2025 report, European organisations name three NIS2 requirements as the hardest to implement: vulnerability handling and patching (50%), business continuity and recovery (49%) and supply chain security (37%). These are difficulties reported by the organisations, not gaps found during an inspection.
External benchmark, not BEAROPS data: ENISA, NIS Investments 2025 (December 2025), survey of organisations in EU Member States.
Sources and references
- ENISA, NIS Investments 2025, main report (December 2025)
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 32 to 34, 41 and Annexes I and II, EUR-Lex
- Commission Recommendation 2003/361/EC (definition of micro, small and medium-sized enterprises), EUR-Lex
- NIS 2 Directive, MesServicesCyber (ANSSI, in French)
- ReCyF: publication of the requirements framework and comparison tool, ANSSI innovation lab (in French)
- Bill on the resilience of critical infrastructure and the strengthening of cybersecurity, French Senate legislative file
- Same bill, National Assembly legislative file
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
Can a company with fewer than 50 employees be in scope of NIS2?
Yes, in some cases. Providers of public electronic communications, trust service providers, domain name registries and DNS service providers, domain name registration services and entities designated as critical are in scope regardless of size. A small company can also be designated if it is the sole provider of an essential service.
Should a supplier outside the scope of NIS2 prepare for it?
Indirectly, yes. Its customers in scope must secure their supply chain and take into account the cybersecurity practices of each direct supplier. They will therefore ask it for evidence, contractual commitments and sometimes audits. Being ready to demonstrate your security level becomes a commercial advantage.
Is ISO/IEC 27001 certification enough for NIS2?
Not on its own. It overlaps with many Article 21 measures, but NIS2 adds obligations of its own: management accountability and training, incident reporting within set deadlines, registration with the authority. ANSSI offers a tool that compares the ReCyF with the ISO 2700X standards to measure the gaps.
Does NIS2 apply to banks and insurers subject to DORA?
For financial entities, DORA is the sector-specific act that applies instead of NIS2 for ICT risk management, incident reporting, resilience testing and ICT third-party risk. This European regulation has applied directly since 17 January 2025. Financial entities therefore build their programme on DORA, while information sharing with NIS2 authorities is maintained.
Can a tool make me compliant with NIS2?
No. No tool “makes you compliant”: compliance results from organisation, measures and evidence. A platform such as Beareye helps you map risk, address vulnerabilities and document implementation, but compliance remains your responsibility, as does the decision on which measures to apply.
Take stock of your NIS2 position
A BEAROPS expert helps you determine whether you are in scope, measure your gaps and build a realistic implementation plan.