The NIS2 Directive – Essential Updates And Reminders

Particularly for small and medium-sized businesses with limited resources, regulatory compliance is an additional burden. So what can you do to lighten the load?

A key factor is preparation; it’s essential to ensure your processes, documents, and data are well-organized and secure. 

Here’s a reminder of what you should know about NIS2.

What is NIS2? 

The NIS2 Directive (EU Directive (EU) 2022/2555) is an update to the original Network and Information Security Directive (NIS), introduced by the EU to establish a high level of cybersecurity across its member states. 

The directive aims to bolster cybersecurity resilience by ensuring companies are prepared to manage risks effectively, handle incidents efficiently, and report breaches promptly. Compared with its predecessor, NIS2:

• broadens the scope of sectors covered.
• increases obligations on businesses.
• introduces stricter enforcement measures.

Who is impacted by NIS2?

NIS2 applies to a broader range of organizations than the original directive, covering sectors such as energy, transport, health, financial market infrastructures, digital infrastructure, public administration, and many more. See full details on the EU’s website

The directive targets a wide range of companies, meaning even smaller and medium-sized businesses providing critical services are now within its scope. For that reason, these companies will need additional tools to structure and secure their data appropriately.

When does NIS2 come into effect?

The NIS2 Directive was adopted by the European Parliament in 2022, with EU member states required to transpose the directive into their national laws by October 2024. Right now it’s under implementation in most EU member states, but only fully transposed in a handful of countries.

Countries like Denmark had to establish the necessary legal frameworks to enforce NIS2 by the deadline given. For companies, the deadline to comply varies by member state, but it’s important that all businesses start preparing now.

In Denmark, the bill was submitted on February 6th, 2025 and will come into force on July 1st, 2025. In the interim period, the bill is being heard in the Danish Parliament. It’s expected to be finalized by May 2025. Organisations falling under the directive’s scope are expected to be compliant shortly after the directive is transposed into national legislation. 

To comply, companies must ensure their systems and data governance practices align with the NIS2 Directive to avoid penalties and disruption to their business. 

Ready for NIS2? How to determine your current status  

To assess your readiness for NIS2 compliance, ask these questions of your organization:  

• Have we identified the systems and processes covered by NIS2?  
• Do we have clear incident detection and reporting procedures?  
• Is our documentation organized, accessible, and compliant?  
• Are we regularly auditing our cybersecurity measures?  

If you’re unsure about any of these questions, it’s time to take action! 

Start with a solid data structure 

While not in itself a compliance tool, a WorkPoint 365 solution helps Microsoft-based businesses like yours bring structure and governance to your documents and data:

• Data governance: Integrated within the Microsoft ecosystem, WorkPoint 365 helps you establish governance over internal documents and data, making it easier to identify gaps, organize information, and maintain a clear audit trail.  

• Document management: With features designed to streamline workflows and enhance collaboration, WorkPoint 365 also ensures your critical information is structured and accessible, giving you confidence as you tackle compliance with NIS2 head-on. 

Navigating compliance with NIS2 is challenging, but the right tools can make it easier. If you’re a Microsoft-based organization, a WorkPoint 365 solution is a great place to start.

Want to learn more about how NIS2 impacts your business and how to properly prepare?

Read our article, The NIS2 directive: what it is and how it might impact your organization, below