NIS2

Directive (EU) 2022/2555 — NIS2 — has applied since 17 October 2024, when Member States were required to have transposed it. It replaces NIS1 and covers a much wider population: energy, transport, banking, health, water, digital infrastructure, public administration, postal services, waste, food, manufacturing, digital providers and research.

NIS2 is a directive, so the law you obey is national

DORA is a regulation and applies as written. NIS2 is a directive: it binds through each Member State’s transposing law, and those differ — in registration mechanics, in supervision, and in the deadlines around the initial notification. Vendorica models the directive; check your national act for the detail, and expect your regulator’s own portal to be where anything gets filed.

Are you in scope

Two questions decide it, and neither is about what you think of yourself:

1. Sector. Annex I lists essential sectors, Annex II important ones.
2. Size. Broadly, medium-sized and above — with exceptions that catch small entities anyway where they are a sole provider or critical to society.

The essential/important split does not change the security obligations much; it changes supervision. Essential entities get proactive supervision; important ones are supervised after the fact, when something suggests they should be.

What it asks for

Article 21 is the heart of it — cybersecurity risk-management measures, proportionate to the risk. The ten families it names map onto the registers you already keep:

Article 21(2) measure	Where it lives
Risk analysis and information-system security policies	Risk registers, Policies
Incident handling	Incidents
Business continuity, backup, crisis management	Controls and their evidence
Supply-chain security	The vendor register, contracts
Security in acquisition, development and maintenance	Controls
Policies to assess effectiveness	Control tests
Cyber hygiene and training	Training
Cryptography and encryption	Controls
HR security, access control, asset management	Access reviews, assets
MFA, secured communications, emergency comms	Controls

Article 23 is the reporting obligation, and it is the one with a clock: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.

Article 20 puts it on management. Governing bodies approve the measures and can be held liable, and they are required to follow training. That is worth reading twice if your programme has no board-level artefact — a report on a cadence is the cheapest way to create one.

Adopting it

Adopt NIS2 from Compliance → Frameworks the way you would any framework; see Adopting a framework. Vendorica carries the directive as citations at article and paragraph level, so a control maps to Art. 21(2)(d) rather than to “supply chain” in general — which is what makes the mapping defensible when someone asks why you consider a requirement met.

If you also do DORA

Then you have probably noticed the overlap, and DORA mostly wins: for a financial entity, DORA is lex specialis — Article 4 of NIS2 defers to sector-specific Union acts where their requirements are at least equivalent. In practice that means your ICT risk management, incident reporting and third-party rules follow DORA, and NIS2 may still reach parts of your group that DORA does not.

Vendorica does not decide that for you. It lets one control satisfy both citations, which is the shape you want when your answer to a supervisor is “the same control, evidenced once”.