NIS2: What Businesses Need to Know Before 2025

NIS2: what businesses need to know in November 2026

NIS2 makes cybersecurity a management responsibility, not simply an IT project. For businesses within its scope, the practical challenge is to identify the applicable obligations, reduce operational risks and demonstrate that safeguards actually work.

The original preparation deadline is no longer a useful organising principle. The NIS2 Directive, EU 2022/2555, required Member States to transpose it by 17 October 2024 and apply those measures from 18 October 2024. However, that European deadline must not be confused with completed implementation in every country.

A credible compliance programme therefore combines a national legal assessment with a risk-based improvement plan. Neither a generic checklist nor a collection of policies is enough.

Start with the right national position

NIS2 is a directive. National legislation determines important practical details, including competent authorities, registration procedures and supervisory arrangements. Businesses operating across borders should check jurisdiction rather than assume that their headquarters answers every question.

For France, the ANSSI NIS2 information page available for this review describes transposition as ongoing. Its published guidance does not establish a verified November 2026 completion date. Before relying on a French deadline, confirm the promulgated legislation, implementing texts and authority instructions then applicable.

That uncertainty is not a reason to delay security improvements. Existing legal, contractual and sector-specific obligations continue to matter. Keep a dated legal watch and distinguish binding requirements from draft national guidance.

Is your organisation covered?

Sector, activity and size all matter

Articles 2 and 3 and Annexes I and II establish the European scope. Relevant activities include energy, transport, health, digital infrastructure, managed ICT services, postal services, waste management and certain manufacturing activities.

The usual starting point is whether an organisation operates in a listed category and qualifies as a medium-sized enterprise, or exceeds those ceilings, under the referenced EU enterprise-size rules. Do not reduce this to “more than 50 employees or €10 million turnover”. Staff, financial measures and relationships with partner or linked enterprises require a proper assessment.

Some entities are covered regardless of size, including certain DNS and trust-service providers. National identification provisions can also matter. A small organisation should not assume that its headcount automatically excludes it.

Essential is not simply another word for important

The classification depends on the directive's criteria, not merely how critical the business considers itself. Large Annex I entities are generally essential, with specific additional categories and exceptions. Other covered entities are generally important.

Both categories face risk-management and reporting duties. Their supervision differs: essential entities can face proactive supervision, while supervision of important entities is generally triggered by evidence or indications of non-compliance. Record the reasoning behind your classification and review it after acquisitions or significant changes in activity.

What management must own

Article 20 requires management bodies to approve cybersecurity risk-management measures and oversee their implementation. It also requires management-body training; Member States must encourage regular employee training.

In practice, leaders need decisions they can understand and challenge:

• Which services must remain available during disruption?
• Which risks need treatment, and who owns the work?
• Which supplier dependencies could interrupt delivery?
• What evidence shows that controls work?
• Which unresolved risks require an explicit management decision?

Document approvals, resources, training and follow-up. Delegating implementation to a security team or provider does not remove management oversight.

Turn Article 21 into operational controls

Article 21 requires appropriate and proportionate technical, operational and organisational measures. These include incident handling, business continuity, supply-chain security, vulnerability handling, effectiveness assessment, cyber hygiene, training and access security.

Start with service dependencies. Connect important business processes to applications, infrastructure, data, people and suppliers. Use a structured risk analysis to decide which scenarios deserve priority.

For example, a recovery plan is not persuasive merely because it exists. Identify the recovery owner, protect backup access, test restoration and record what failed. Similarly, access reviews need evidence of removed permissions, not only a signed policy.

Supplier reviews should address the service delivered, privileged access, incident cooperation, vulnerabilities and alternatives. Ask for evidence that informs a decision rather than sending the same questionnaire to every supplier.

Prepare incident reporting before an incident

Article 23 sets a staged process for significant incidents, measured from awareness:

• An early warning without undue delay and within 24 hours.
• An incident notification without undue delay and within 72 hours, with a specific shorter rule for trust-service providers.
• A final report generally within one month after the incident notification; ongoing incidents follow the directive's progress-report arrangements.

These are not requirements to report every technical alert. Define significance, escalation and decision ownership, then confirm national channels and any applicable sector rules.

Keep a notification worksheet with discovery time, affected services, suspected cause, impact and mitigation. Do not wait for a complete forensic investigation before escalating a potentially significant incident. If personal data is involved, assess GDPR duties separately.

Understand penalties without making them the strategy

Article 34 requires national maximum administrative fines for relevant infringements to be at least €10 million or 2% of total worldwide annual turnover for essential entities, whichever is higher. For important entities, the corresponding minimum maximum is €7 million or 1.4%, whichever is higher.

These are requirements for national penalty ceilings, not an automatic fine for an incident. Actual enforcement depends on the infringement, circumstances and national implementation. Business continuity and defensible management decisions remain better programme objectives than fear of a headline amount.

A practical implementation sequence

1. Confirm scope. Document activities, size assessment, countries, classification and authority contacts.
2. Assign accountability. Name executive sponsors, operational owners and escalation deputies.
3. Map dependencies. Identify important services, assets, suppliers and recovery priorities.
4. Assess gaps. Compare existing safeguards with applicable obligations and test the evidence.
5. Prioritise remediation. Address realistic high-impact scenarios, with owners and acceptance criteria.
6. Exercise response. Rehearse reporting, management decisions and restoration together.
7. Maintain assurance. Review changes, close findings and retain evidence of effectiveness.

Keep compliance connected to daily work

Domyno combines a cyber-governance SaaS platform with a dedicated human expert: agents prepare work and a human validates it. Its controls and compliance module brings together a shared control library, evidence and action plans, helping teams connect requirements to accountable work.

That organisation supports a NIS2 programme; it does not replace legal assessment, technical implementation or management decisions. The objective is a living record of risks, controls and improvements, rather than a document collection assembled before an audit.

To explore how this approach could support your organisation, request a demo.