NIS2: what it requires, and how to prove you comply
Short answer
NIS2 is an EU directive, applying since 18 October 2024 through national law, for essential and important entities in 18 sectors. It requires risk-management measures (Article 21) and notification of significant incidents within 24 hours, 72 hours and one month (Article 23). ROOTKey maps these requirements onto your existing infrastructure, with verifiable cryptographic proof.
- Maximum fine
- €10Mor 2% of global annual turnover
- Early-warning deadline
- 24hafter detecting a significant incident
- Sectors covered
- 18essential and important entities
- Applies since
- 18 Oct 2024through the national law of each member state
Who is covered and what is at stake
NIS2 covers essential and important entities in 18 sectors and has applied since 18 October 2024 through the national law of each member state. The maximum fine depends on which of the two categories an entity falls into.
| Entity | Maximum fine |
|---|---|
| Essential entities | Up to €10 million or 2% of global annual turnover, whichever is higher |
| Important entities | Up to €7 million or 1.4% of worldwide annual turnover, whichever is higher |
Not sure where you stand? The NIS2 simulator assesses your compliance gap.
Official text: Directive (EU) 2022/2555 on EUR-Lex.
NIS2 in five minutes
A plain-language walkthrough of the directive: who it covers, what it requires, the fines, and where data integrity fits in.
NIS2, DORA and GDPR are explained in the same format in the Compliance playlist on our YouTube channel.
Article 21: risk-management measures
Article 21 requires documented measures for risk analysis, incident handling, business continuity, supply-chain security and access control. This is how each requirement maps onto ROOTKey.
| Article | Requirement | ROOTKey | Status |
|---|---|---|---|
| 21 · 2(a)Risk-analysis policies | Entities must implement documented, versioned policies for risk analysis of information and security systems. | An immutable record of policies with a verifiable cryptographic hash and an anchored history - retroactive tampering is cryptographically detectable. | Covered |
| 21 · 2(b)Incident handling | Documented procedures for detecting, analysing, containing and responding to security incidents, with chain of custody. | Cryptographically signed timestamps for every event. A verifiable chain of custody, exportable to regulators in seconds. Your report states what changed, who, when and where. | Covered |
| 21 · 2(c)Business continuity | Backup, disaster-recovery and crisis-management plans that ensure verifiable operational continuity. | Recovery Points with cryptographic integrity verification - confirmation that backups have not been compromised before they are needed. | Covered |
| 21 · 2(e)Supply-chain security | Security in relationships with suppliers and service providers, including access to critical information systems and data. | Cryptographic access verification by design: every access is authenticated with cryptographic proof, with no implicit trust in any entity. | Covered |
| 21 · 2(j)Authentication & access control | Multi-factor authentication and secure communication solutions as mechanisms for protecting access to critical systems. | MFA with cryptographic verification - strong authentication without exposing credentials, integrated via API on top of existing systems. | Partial |
Article 23: incident notification deadlines
NIS2 Article 23 requires notifying the national authority within 24 hours of a significant incident, a detailed report within 72 hours and a final report within one month. ROOTKey automatically generates the trail of cryptographic evidence needed for all three phases.
| Deadline | Stage | Detail |
|---|---|---|
| T0 | Detection | Immutable timestamped logs - verifiable evidence of when the incident was detected. |
| 24h | Early warning | Notification to the CSIRT within 24h (early warning) after detecting an incident with significant impact. |
| 72h | Interim report | A detailed report within 72 hours. Structured export, ready in minutes. |
| 1 month | Final report | A final report within one month - with the complete trail of cryptographic evidence. |
How ROOTKey fits: on top of your infrastructure, not instead of it
ROOTKey doesn't replace existing systems. It adds a layer of cryptographic verification via API - no migrations, no vendor lock-in.
- Auditable cryptographic evidence
- Every critical action produces an independent proof that external auditors can verify without access to the original data.
- Verifiable recovery points
- Backups with cryptographically verified integrity: date, content and integrity, all verifiable.
- Immutable timestamps
- A chain of custody for every security event, with verifiable evidence of when it happened.
Any file, one kind of proof
PDF, images, Word, Excel, PowerPoint, tables and databases: whatever the file, ROOTKey compares it with its sealed original and shows only what was altered.
- Deployment
- SaaS · Private cloud · On-premise
- Connectors
- SharePoint · OneDrive · Amazon S3 · Cloudflare R2 · tables and databases · REST API and webhooks
Integration: live in days, not months
Documented REST API and webhooks, dedicated enterprise support. ROOTKey adapts to your infrastructure - not the other way round.
Integrate via API
Documented REST API and webhooks. Live in days, without replacing existing infrastructure.
Automatic proofs
Every critical event generates an immutable, auditable cryptographic proof, with minimal operational effort.
Instant reporting
A real-time compliance dashboard and evidence exports for regulators in seconds.
Frequently asked questions
What does NIS2 require for incident reporting?
NIS2 Article 23 requires notifying the national authority within 24 hours of a significant incident, a detailed report within 72 hours and a final report within one month. ROOTKey automatically generates the trail of cryptographic evidence needed for all three phases.
What counts as a significant incident under NIS2?
Significant incidents include those that cause severe operational disruption, financial loss or impact on other entities - covering ransomware attacks, data-integrity breaches and supply-chain compromises.
How does ROOTKey support NIS2 Article 21?
NIS2 Article 21 requires cryptographic policies, access control and incident handling. ROOTKey's continuous integrity verification supports the requirements for cryptographic evidence and provides an immutable audit trail for incident documentation.
What is the fine for non-compliance with NIS2?
Essential entities face fines of up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face up to €7 million or 1.4% of worldwide annual turnover, whichever is higher.