nis2

Classification under NIS2 Art. 3 depends on sector and size. Annex I entities exceeding the large-enterprise ceiling (250+ employees, or turnover above €50M with balance sheet above €43M) are essential; medium-sized Annex I and in-scope Annex II entities are important. Some entities like DNS providers and TLD registries are essential regardless of size.

NIS2 Art. 23 requires an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month. Reports go to the national CSIRT or competent authority, and a parallel GDPR Art. 33 notification may be required if personal data is affected.

ISO 27001:2022 certification evidences much of Art. 21 but does not satisfy all NIS2 obligations. Gaps remain for Art. 23 reporting timelines, Art. 20 management body accountability and training, Art. 27 registration, and the explicit MFA and cryptography expectations of Art. 21(2)(h) and (j).

No, Regulation 2024/2690 binds only DNS providers, TLD registries, cloud, data centre, CDN, MSP, MSSP, online marketplace, search, social platform, and trust service providers. For other sectors it is persuasive best practice rather than directly binding law.

Under Art. 34, essential entities face fines of at least €10,000,000 or 2% of worldwide annual turnover, whichever is higher. Important entities face at least €7,000,000 or 1.4% of turnover, and Member States may set higher maximums in national transposition.

DORA (Regulation (EU) 2022/2554) is lex specialis under its Art. 4, so financial entities follow DORA's ICT risk management and incident reporting instead of NIS2 Arts. 21 and 23. They remain registered under NIS2 but report incidents to financial supervisors rather than the CSIRT.