What is NIS2?

In 30 seconds

• NIS2 is the European directive that requires companies in critical sectors to prove they protect themselves, not just say so.
• If your company sells to them, it affects you even if you're not on the list: they'll ask you for security evidence to sign or renew.
• ISO 27001 is the best starting point, although the directive adds obligations of its own.

What exactly is NIS2?

NIS2 is Directive (EU) 2022/2555, in force in the EU since January 2023. It replaces the 2016 NIS directive and is the most ambitious cybersecurity framework the European Union has adopted.

Its goal is that companies in critical sectors can't claim they "didn't know" they had to protect themselves. It requires security measures that are active, documented and provable, not just declared.

Maximum fines reach €10 million or 2% of global turnover for essential entities, and €7 million or 1.4% for important ones.

Which companies does NIS2 directly cover?

Generally, medium and large companies (50 or more employees, or over €10 million in both turnover and balance sheet) in a regulated sector:

• Essential: energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space.
• Important: postal services, waste management, chemicals, food, manufacturing of critical products, digital providers and research.

There are exceptions by activity: some companies are covered whatever their size, such as providers of public communications networks or services, trust service providers, domain registries and DNS providers, or the sole provider of an essential service in their country.

And if they suffer a significant incident, they have to report it in steps:

Why does NIS2 affect you even if you're not on the list?

This is what most SMEs overlook.

NIS2 requires regulated companies to manage the security of their entire supply chain: the security of their suppliers and subcontractors is one of the minimum measures it sets.

In practice: if you sell software, cloud services, IT consulting or any service with access to a covered company's systems or data, that company will want to assess your security before hiring you and periodically after that.

As El Español noted in February 2026, companies that keep their focus on their internal cybersecurity perimeter are playing on an interconnected board: a company's security no longer ends at its own systems, but at its suppliers'.

And the trend is growing. In January 2026, the European Commission proposed a new Cybersecurity Act with rules for ICT supply chain risks in NIS2 sectors. More pressure on suppliers, not less.

Does ISO 27001 help with NIS2?

It's the key question for preparing without duplicating work. ISO 27001 is the base: many of its measures help with NIS2 too.

Careful: that doesn't mean ISO 27001 covers NIS2. The directive adds obligations of its own, such as reporting incidents within set deadlines or management accountability, which have to be covered separately.

Even so, it's the best shortcut: if you already have ISO 27001 with evidence, a good part of the NIS2 work is done. And in Kardu that evidence is reused without uploading it again.

What do NIS2-covered clients actually ask for?

When a covered company assesses its suppliers, the usual tool is a security questionnaire that asks about:

• a documented information security policy;
• access management and authentication;
• backups and the recovery plan;
• incident management and how incidents are reported;
• staff cybersecurity training;
• a periodic risk assessment.

Without a system that centralises all this, answering can take weeks. With Kardu, the answer comes from the measures and evidence you already keep up to date.

How to prepare if you supply a NIS2 company

1. Check whether any of your clients is covered. If they operate in energy, banking, health or digital services and are medium-sized or large, probably yes. You can check your case with the NIS2 assessment.
2. Compare what you have against ISO 27001. It's the most efficient starting point for NIS2.
3. Keep the evidence for each measure. The questionnaire won't ask you to say you have it, but to prove it.
4. Keep it up to date. A measure that worked six months ago but has no recent evidence won't pass an audit.

Kardu takes care of steps 2, 3 and 4. If you'd like to see how it applies to your case, talk to us. And for the directive in detail, read our NIS2 guide.

Information reviewed in October 2026. Always check the current text on EUR-Lex and the European Commission's official page, including the status in Spain.

Frequently asked questions

01What is NIS2?

NIS2 is the European cybersecurity directive (Directive (EU) 2022/2555). It requires companies in essential and important sectors to have active, provable security measures, and to report significant incidents with an early warning within 24 hours.

02Which companies does NIS2 directly cover?

Generally, medium and large companies (50 or more employees, or over €10 million in both turnover and balance sheet) in sectors such as energy, transport, banking, health, water, digital infrastructure or ICT services. Some are covered whatever their size, such as providers of public communications, trust services or DNS.

03Why does NIS2 affect suppliers who aren't on the list?

Because covered companies have to manage the security of their supply chain. In practice, they send you security questionnaires and ask for evidence before signing or renewing. If you can't prove it, the contract stalls.

04When does NIS2 apply in each country?

When each country's transposition law takes effect. The deadline was October 2024, but several countries are still finishing theirs; in Spain, as of October 2026, the law is still going through parliament, and the European Commission sent Spain a reasoned opinion over the delay in May 2025. Meanwhile, your covered clients can already ask you for evidence.