NIS2

→ What NIS2 is

The original NIS directive (NIS1, 2016) was the EU's first attempt to lift cybersecurity across member states by setting technical and organisational requirements for operators of critical services and harmonising the level of security EU-wide. NIS2 — Directive (EU) 2022/2555 — replaces it and goes considerably further.

It applies to operators of societally critical services and now reaches far beyond the original set. Where NIS1 focused on sectors like telecoms, finance, energy, health, transport and water, NIS2 widens the net to include areas such as food production, manufacturing, waste management and digital service providers. The reasoning is unchanged: attacks on critical sectors carry large societal risk.

→ Who it covers — essential vs important

NIS2 splits covered entities into two tiers based on how critical and how large they are. The requirements are essentially the same for both; the difference is in supervision intensity and the sanction ceiling.

→ Management accountability

One of the sharpest changes from NIS1: NIS2 puts cybersecurity on the management table and keeps it there. Leadership must:

• Approve the cyber risk-management measures and oversee their implementation.
• Take training so they can identify risks and assess management practices — competence is expected, not delegated away.
• Carry personal accountability for failures; sanctions can reach individuals, including potential board-level consequences.

This is the governance hook: NIS2 is not an IT-department problem, it's a board-level obligation.

→ The security measures (risk management)

Covered entities must implement a set of cyber risk-management measures, taking an all-hazards, risk-based approach. The directive's Article 21 lists the minimum areas — they read like a condensed ISMS:

• Risk-analysis and information security policies.
• Incident handling (detection, response, reporting).
• Business continuity — backup, disaster recovery, crisis management.
• Supply-chain security, including security in relationships with direct suppliers.
• Security in acquisition, development and maintenance of systems, plus vulnerability handling and disclosure.
• Policies to assess the effectiveness of the measures.
• Basic cyber hygiene and security-awareness training.
• Cryptography and, where relevant, encryption.
• Human-resources security, access-control policies and asset management.
• Multi-factor authentication, secured communications and secured emergency communications where appropriate.

→ Incident reporting — the clock

Significant incidents must be reported to the relevant authority on a fixed ladder. Miss the window and you're non-compliant regardless of how well you handled the incident technically.

In Denmark, incident notifications go in via Virk.dk, the national CSIRT role sits with the Defence Intelligence Service (FE), and CFCS provides technical support. Test and document the reporting procedure in advance so roles are clear across operations, helpdesk and management when something actually happens.

→ Supply-chain reach

NIS2 doesn't directly regulate the suppliers of a covered entity — but it reaches them indirectly. Because supply-chain security is one of the mandatory measures, a covered entity must assess the security of its relationships with suppliers and service providers, and will pass relevant requirements down its contracts.

So even if you're not in scope yourself, you may feel NIS2 through a customer who is: expect contractual security minimums, audit rights and incident-reporting clauses. The requirements should be proportional to how important your delivery is to the customer's security — a risk-based approach, not a blanket maximum.

→ Denmark — where things stand

Denmark missed the EU's 17 October 2024 transposition deadline and took a multi-sector route rather than one single statute: a general cross-sector law plus sector-specific rules for energy, telecoms, finance and more. An entity can therefore be covered by both the general law and a sector law at once, which makes the compliance picture more complex than in countries with one unified text.

→ Mapping to ISO 27001 and CIS

NIS2 tells you what to achieve but not how. The established frameworks fill that gap, and the directive explicitly encourages using recognised international standards (Articles 21 and 25):

• ISO 27001 gives the management-system backbone — leadership commitment, risk assessment, policies and continual improvement line up directly with NIS2's risk-based, board-anchored approach.
• ISO 27002 / Annex A supplies the concrete control guidance, and ISO 27005 the risk-management method.
• The CIS Controls (v8.1) map across to the same measures as a prioritised, technical companion, and ISO 22301 covers the business-continuity angle NIS2 stresses.

In short: adopt ISO 27001 as the frame, implement with ISO 27002 / CIS, drive it with ISO 27005 risk, and NIS2 compliance largely falls out of good governance rather than a separate parallel project.