Question 1

What is NIS2?

Accepted Answer

NIS2 (Directive EU 2022/2555) is the EU's updated Network and Information Security Directive, significantly expanding the scope and obligations of its predecessor. It applies to medium and large organisations across 18 essential and important sectors, requiring robust cybersecurity risk management, incident reporting, business continuity measures, and supply chain security.

Question 2

Who does NIS2 apply to?

Accepted Answer

NIS2 applies to medium-sized (50+ employees or €10M+ turnover) and large organisations in sectors including: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space. It also covers important entities in postal services, waste management, chemicals, food production, manufacturing, and digital providers.

Question 3

What are the NIS2 incident reporting requirements?

Accepted Answer

NIS2 mandates a three-stage reporting process for significant incidents: an early warning to the national CSIRT or competent authority within 24 hours of becoming aware; an incident notification with initial assessment within 72 hours; and a final report within one month. Significant incidents are those causing severe operational disruption or financial loss, or affecting other organisations or persons.

Question 4

What are the penalties for NIS2 non-compliance?

Accepted Answer

NIS2 introduces significantly higher penalties than its predecessor. Essential entities face fines of up to €10 million or 2% of global annual turnover (whichever is higher). Important entities face fines of up to €7 million or 1.4% of global annual turnover. Member state supervisory authorities may also issue binding instructions, suspend certifications, and impose temporary management bans.

Question 5

What cybersecurity measures does NIS2 require?

Accepted Answer

NIS2 requires appropriate technical, operational and organisational measures including: risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, network security and vulnerability handling, policies on the effectiveness of cybersecurity measures, basic cyber hygiene practices and training, cryptography and encryption policies, human resources security, access control policies, and multi-factor authentication.

Question 6

How does ROOTKey help with NIS2 compliance?

Accepted Answer

ROOTKey addresses NIS2 compliance through verifiable data integrity and audit traceability. The platform creates cryptographic proofs of data authenticity, immutable audit logs for all data operations, tamper-evident incident records for regulatory reporting, and post-incident recovery validation to prove operational continuity. ROOTKey generates the evidence needed to demonstrate to supervisory authorities that your organisation has maintained data integrity throughout an incident.

Is your organization ready for NIS2?

Is your organization ready for NIS2?