Follow What Is NIS2?
NIS2 is Directive (EU) 2022/2555, the EU’s baseline cybersecurity law for organizations that keep energy grids, water systems, hospitals, logistics chains, food supply and digital infrastructure running. It replaced the original NIS Directive (EU) 2016/1148 and turned a loosely applied, sector-by-sector regime into a single framework with common obligations, common reporting timelines and real enforcement powers.
So, what is NIS2 in practical terms for a security team? Three things. First, it defines who is in scope through size thresholds and two sector annexes, splitting covered organizations into essential and important entities. Second, it prescribes a minimum set of risk-management controls in Article 21, from incident handling and logging to supply chain security and cryptography. Third, it imposes a staged incident notification process in Article 23, with the first signal due to the national CSIRT or competent authority within 24 hours of becoming aware of a significant incident.
Because NIS2 is a directive rather than a regulation, every Member State writes its own national law. The core obligations are shared, but registration portals, supervisory authorities and reporting forms differ from Rome to Warsaw, which is exactly why a country-level view matters.
NIS2 Release Date and the Road to Compliance
The directive was published in the Official Journal on 27 December 2022 and entered into force on 16 January 2023. Member States had until 17 October 2024 to transpose it, with national measures applying from 18 October 2024. Few made it: Italy and Belgium were among the handful that had laws in force on time.
The Commission responded with letters of formal notice in November 2024, reasoned opinions in May 2025 and, on 8 July 2026, referrals to the Court of Justice of the EU for the remaining laggards. According to the nisd2.eu transposition tracker, as of 16 October 2026 a national law is in force in 24 of the 27 Member States. France, Ireland and Spain are still without one.
For NIS2 compliance, the takeaway is that the clock is national, not European. Germany’s BSIG amendments have applied since 6 December 2025, Poland’s amended KSC Act since 3 April 2026, the Dutch Cyberbeveiligingswet since 15 August 2026 and Austria’s NISG 2026 since 1 October 2026. Each brings its own registration window, so a multi-country operator can be compliant in Milan while already late in Gdańsk.
What the NIS2 Directive Requires
The NIS2 Directive puts obligations into three buckets: governance, technical controls and reporting.
Governance sits in Article 20. Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and complete regular training. Accountability no longer stops at the CISO.
Technical controls sit in Article 21(2), which lists ten minimum measures: risk analysis and information system security policies; incident handling; business continuity, backup and crisis management; supply chain security; secure acquisition, development and maintenance, including vulnerability handling; assessment of control effectiveness; cyber hygiene and training; cryptography; HR security, access control and asset management; and MFA plus secured communications. For digital infrastructure and ICT service providers, Implementing Regulation (EU) 2024/2690 spells these out in detail, including explicit monitoring and logging requirements.
Reporting sits in Article 23, and this is where SOC teams feel the pressure:
- 24 hours: early warning, including whether the incident is suspected to be malicious or to have cross-border impact
- 72 hours: incident notification with an initial severity and impact assessment and available indicators of compromise
- One month: final report with root cause, mitigation and cross-border impact
A 24-hour early warning is only credible if the team can actually read its logs within hours, not days.
Why the EU Replaced NIS1 with NIS2
NIS1 failed on consistency. Each Member State decided for itself which companies counted as operators of essential services, so two hospitals of the same size in neighbouring countries could face completely different obligations. Penalties were low and rarely applied, and incident reporting thresholds varied so widely that cross-border situational awareness barely existed.
The threat picture moved faster than the law. Between the Commission’s December 2020 proposal and the final text, Europe saw ransomware take down hospital IT, the SolarWinds and Kaseya supply chain compromises reach thousands of downstream customers, and the February 2022 attack on Viasat’s KA-SAT network cut remote monitoring for around 5,800 Enercon wind turbines in Germany. That last case made one point very clear: an attack on an IT service provider can produce physical, OT-level consequences in a different sector and a different country.
NIS2 answers with a wider scope, harmonised minimum controls, explicit supply chain duties, personal accountability for management and a common incident clock. It also formalises cooperation through EU-CyCLONe and the CSIRTs network, so a significant incident in Lyon is no longer a purely French problem.
NIS2 Fines and Management Liability
Article 34 sets the ceilings that national laws must reach at minimum:
| Entity type | Maximum administrative fine | Supervision model |
| Essential | At least €10 million or 2% of total worldwide annual turnover, whichever is higher | Ex ante: audits, on-site inspections, security scans |
| Important | At least €7 million or 1.4% of total worldwide annual turnover, whichever is higher | Ex post: triggered by evidence or an incident |
The turnover reference is the whole undertaking, not the local subsidiary, which is why group-level CFOs now read NIS2 briefings.
Money is only part of the exposure. For essential entities, Article 32 allows authorities to suspend certifications or authorisations and to temporarily bar a CEO or legal representative from managerial functions until deficiencies are fixed. Authorities can also order an entity to publicly disclose its non-compliance.
In practice, regulators look for evidence. An organization that can show when it detected an incident, which logs it examined and how it reached its 24-hour and 72-hour conclusions is in a far stronger position than one that reconstructs the timeline after the fact. Documented, repeatable log analysis is the cheapest insurance against the upper end of these penalties.
NIS2 vs. DORA: Which One Applies?
A one-line NIS2 directive summary: horizontal cybersecurity rules for 18 critical sectors, transposed nationally. DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), is the opposite on both counts. It is sector-specific, covering banks, insurers, investment firms, payment institutions, crypto-asset service providers and their critical ICT third-party providers, and as a regulation it has applied directly in every Member State since 17 January 2025.
The two connect through Article 4 of NIS2. Where a sector-specific EU act imposes requirements at least equivalent to NIS2, that act prevails. DORA is that lex specialis for financial entities, so a bank follows DORA’s ICT risk, testing and reporting rules rather than the NIS2 versions.
| NIS2 | DORA | |
| Legal form | Directive, national transposition | Regulation, directly applicable |
| Scope | 18 sectors, essential and important entities | Financial entities and critical ICT providers |
| First report | Early warning within 24 hours | Initial notification within 4 hours of classifying an incident as major, no later than 24 hours after detection |
| Testing | Effectiveness assessment | Threat-led penetration testing (TLPT) for significant entities |
The overlap matters for vendors. A managed SOC or cloud provider can be an important entity under NIS2 and, at the same time, a contractual ICT provider under DORA, facing two sets of log evidence requests.
NIS2 vs. GDPR: Service Continuity Meets Data Protection
GDPR protects people’s personal data. NIS2 protects the continuity of services that society depends on. The difference shows up in what triggers a report: under GDPR, it is a personal data breach likely to create risk for individuals, reported to the data protection authority within 72 hours. Under NIS2, it is a significant incident affecting service delivery, reported to the CSIRT or competent authority starting at 24 hours, whether or not any personal data was touched.
A ransomware attack on a hospital usually triggers both. Article 35 of NIS2 requires the cybersecurity authority to inform the data protection authority when an incident may involve a personal data breach, and it prevents a double fine for the same conduct where a GDPR penalty has already been imposed. GDPR’s ceiling remains the higher one: €20 million or 4% of worldwide turnover.
The friction point for SOC teams is the logs themselves. Security telemetry is full of personal data: usernames, IP addresses, email headers, hostnames tied to named employees. Sending raw logs to an external analyst, an MSSP or an AI service to meet a NIS2 deadline can open a GDPR question about data minimisation and transfers. Pseudonymising identifiers before logs leave the organization, while keeping the key in-house, is how teams satisfy both regimes at once.
Which Organizations NIS2 Affects
NIS2 uses a size-cap rule: medium and large organizations, meaning 50 or more employees or more than €10 million in annual turnover, operating in one of 18 sectors.
- Annex I, sectors of high criticality (11): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration and space.
- Annex II, other critical sectors (7): postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers and research.
Large entities in Annex I, with 250 or more employees or more than €50 million turnover, are typically essential. Most of the rest are important. Some providers are covered regardless of size, including DNS service providers, TLD registries, qualified trust service providers and public electronic communications networks, and Member States can designate small entities that are the sole provider of a critical service.
The practical reach is wider still. Article 21 makes supply chain security an obligation, so in-scope entities push contractual security requirements onto suppliers. A 30-person firmware integrator serving a German car maker, or a refrigeration maintenance contractor serving a supermarket chain, will feel NIS2 through audit questionnaires long before any regulator calls.
LogTotal and OT Logs: The Engine vs. the Ecosystem
LogTotal, which SOC Prime moved from public preview to general release on 15 October 2026, is built for the incident-time version of the log problem. You select a log set, the open-source @socprime/logtotal-sanitizer replaces credentials, IP addresses, hostnames and usernames with stable HMAC tokens inside the browser, and only the tokenised events are uploaded. It processes up to 1.7 million events in under a minute on ordinary hardware, stores nothing after analysis, and the organization keeps the key to map tokens back internally.
The engine itself is format-agnostic. It auto-detects EVTX, CEF, JSON/NDJSON and syslog, so anything that can be expressed as text can be investigated: industrial PC syslogs, SCADA historian and HMI events, engineering workstation logs, or Modbus and BACnet traffic once it has been decoded into text records.
Country Mapping: NIS2 and LogTotal Use Cases Across 10 Markets
NIS2 is EU law, but its pull extends to suppliers, neighbours and candidate countries serving the European market. The common thread across all ten markets below is a reporting clock measured in hours, which makes fast, privacy-preserving log triage a practical necessity rather than a nice-to-have. Status reflects October 2026.
| Country | Regulatory status | Where LogTotal fits |
| Italy | D.Lgs. 138/2024 in force since 16 October 2024. Incident notification to CSIRT Italia live since 15 January 2026; ACN baseline security measures due by 31 October 2026. | Mid-sized food and energy entities rarely run a 24/7 SOC. LogTotal gives them same-day triage to support the 24-hour pre-notification without a SIEM integration project. |
| France | Loi Résilience still pending; the Assemblée nationale pulled it from its 7 and 9 October floor sessions. ANSSI’s ReCyF framework and MonEspaceNIS2 pre-registration are already live. | After CERT-FR alert CERTFR-2026-ALE-012, retailers and refrigeration contractors can correlate VPN, jump host and firewall logs to trace who reached controller management interfaces and from where. |
| Germany | NIS2UmsuCG amendments to the BSIG in force since 6 December 2025; BSI registration was due 6 March 2026. | Automotive and machinery plants generate huge EVTX volumes from engineering workstations. Processing 1.7 million events in under a minute keeps cross-border supplier investigations moving. |
| Ukraine | Law No. 4336-IX in force since 20 April 2025, aligning the national framework with NIS2 under SSSCIP oversight and mandating CISOs. | Under wartime resource constraints, LogTotal runs on ordinary hardware, and the sanitizer CLI works in air-gapped environments for energy and agricultural operators. |
| United Kingdom | NIS Regulations 2018 still apply; the Cyber Security and Resilience Bill passed the Commons on 10 June 2026 and is in the Lords. | UK logistics firms and MSPs serving EU customers face NIS2 supply chain clauses by contract. LogTotal produces quick, shareable evidence that cross-channel logistics data was not tampered with. |
| Spain | No transposition law yet; Royal Decree 43/2021 (NIS1) remains in effect and the Commission referred Spain to the CJEU on 8 July 2026. | Sekoia reported Spain among the countries hit by the refrigeration attacks. Cold-chain operators can rehearse the 24-hour workflow now on raw network exports. |
| Netherlands | Cyberbeveiligingswet in force since 15 August 2026, supervised by NCSC-NL and RDI. | Rotterdam and Amsterdam terminal operators can audit syslog from gate automation and container-tracking systems against port-side OT intrusion patterns. |
| Belgium | NIS2 law of 26 April 2024 in force since 18 October 2024; the CCB supervises, with CyberFundamentals as the reference framework. | HMAC tokenisation strips identifiers before logs go to CERT.be or an external IR firm, while the organization keeps the re-identification key. |
| Poland | Amended KSC Act in force since 3 April 2026; self-registration closed 3 October 2026. | Transport and defence-adjacent operators need to separate routine scanning from nation-state tradecraft. Ranked attack chains mapped to ATT&CK do that triage quickly. |
| Switzerland | Not in the EU, but critical infrastructure must report cyberattacks to the NCSC within 24 hours since 1 April 2025, with fines up to CHF 100,000 since 1 October 2025. | Grid operators synchronised with the European network can run format-agnostic checks on transmission and substation logs ahead of the 14-day follow-up report. |
