NIS2
The EU directive on a high common level of cybersecurity, Directive (EU) 2022/2555. It requires essential and important entities in listed sectors to manage cybersecurity risk and report significant incidents, starting with an early warning within 24 hours; member states had to apply it from 18 October 2024.
- Also called
- NIS 2
Covered in
NIS2 and DORA for software suppliers: what reaches you and the evidence to keep
Work out whether NIS2 applies to your software company directly or only through customers, what Article 21 risk-management measures and DORA's ICT third-party rules ask of suppliers, and how to keep one assurance pack and register data sheet for both.
Build a runbook for CRA vulnerability and incident reporting
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 and 72 hours. Decide what is reportable, start the clock at the right moment, file through the platform and keep an evidence trail.