NIS2, formally Directive (EU) 2022/2555, expands the scope of EU cybersecurity regulation significantly. More sectors are covered, the requirements are more demanding, and the expectations have shifted from 'do you have policies in place?' to 'can you demonstrate that your controls actually work, continuously?'. Article 21 mandates specific risk-management measures, including risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, access control, and policies regarding the use of cryptography and encryption. Article 23 introduces strict incident reporting timelines: an early warning within 24 hours, a full notification within 72 hours, and a detailed report within one month of a significant incident.
Updated description with detailed requirements from NIS2 and added new tags related to operational readiness and continuous risk management.
Initial creation
