Is NIS2 just the IT team’s job?

No. Management must approve the security measures and check that they work. Your IT, operations and supplier teams each own part of the work.

Does an ISO 27001 certificate cover NIS2?

No. ISO 27001, the international security management standard, helps with much of the NIS2 work. National rules and incident reporting still need their own check.

Can NIS2 apply to a smaller organisation?

Yes. Size, your services and national rules all count, and national authorities can name specific organisations. We check this against what your company does.

Is NIS2 the same in every EU country?

No. NIS2 is a directive, so each EU country writes it into its own law. The authority you register and report with, and some details, differ by country.

When did NIS2 start to apply?

EU countries had until 17 October 2024 to put NIS2 into national law. The date it applies to you depends on when your country’s law took effect.

What is the difference between essential and important entities?

The duties are largely the same. Essential entities can face inspections and regular audits at any time. Important entities are checked when the authority has evidence or signs that they may not comply.

Does NIS2 apply to my company in Lithuania, and how do I register?

It does if your company meets the criteria of Lithuania’s Cyber Security Law, which implements NIS2. The law also covers some organisations NIS2 doesn’t, such as hosting providers. If you meet them, you give the NKSC your details and it registers you. Your duties start from that registration.

EU cybersecurity directive

NIS2 requirements and what they mean for your organisation

NIS2 is an EU cybersecurity law for medium and large organisations in sectors such as energy, transport, health and digital services. Management must oversee security risks and serious incident reporting.

Discuss your NIS2 priorities See our NIS2 Compliance service

Type: EU directive, applied through national laws
Coverage: 18 critical sectors
Two groups: Essential and important entities
Usual size: 50+ staff, or turnover and balance-sheet total above €10m

Who it applies to

Sectors where NIS2 can apply

Energy, transport, water, banking and healthcare organisations.
Digital infrastructure operators and some digital service providers.
Some manufacturers, food processors and wholesalers, postal and waste services, and other sectors listed by NIS2.
Public administration bodies, depending on national law.

Your sector is only the first test. Size, group structure and national rules also count.

Answer a few questions about your sector and size to see whether NIS2 is likely to cover your organisation.

Take the free NIS2 scope check

Dates to plan for

NIS2 dates across the EU

January 2023
NIS2 entered into force.
17 October 2024
Deadline for EU countries to put NIS2 into national law.
18 October 2024
NIS2 replaced the first NIS directive, from 2016.

National law

NIS2 in Lithuania

Lithuania implements NIS2 through its Cyber Security Law, in force in its updated form since 18 October 2024. The National Cyber Security Centre (NKSC) keeps the register of organisations the law covers and receives their incident reports. An organisation that meets the law’s criteria gives the NKSC its details, and its duties start once the NKSC registers it.

Take the free NIS2 scope check

18 October 2024
Lithuania’s updated Cyber Security Law, which implements NIS2, took effect.
17 April 2025
Deadline for the NKSC to enter organisations in the register of cybersecurity entities.
17 April 2026
Deadline for organisations registered in April 2025 to meet the organisational requirements.
17 April 2027
Deadline for organisations registered in April 2025 to meet the technical requirements.
Within 12 months of registration
The organisational cybersecurity requirements must be in place.
Within 24 months of registration
The technical requirements must be in place.
No transition period
Some digital providers, such as cloud, data centre and managed service providers, and trust service providers must meet their requirements from registration.
At least every 3 years
An independent cybersecurity audit by a certified auditor, following the NKSC’s method.
At least every 2 years
Cybersecurity training for members of the management bodies, the head of the organisation and any person they authorise.

What it asks of you

Put NIS2 duties into practice

Give management responsibility
Your board approves security measures, checks progress and takes relevant training.
Address your security risks
Identify what could interrupt important services and put suitable safeguards in place.
Report serious incidents fast
Send an early warning within 24 hours of becoming aware of a significant incident, followed by an incident notification within 72 hours of awareness. A final report is generally due within one month of that notification. Follow the national reporting rules.
Test recovery and suppliers
Practise restoring important services and check the security of suppliers you depend on.
Register where your country requires it
Some national laws ask organisations under NIS2 to register with a national authority.

How we help

From NIS2 assessment to ongoing implementation

We assess applicability, prioritise gaps and coordinate implementation with your team. Our specialists support security measures, incident readiness and management responsibilities, with ongoing help to keep the work current.

NIS2 ComplianceImplement NIS2 requirements with proportionate security measures, expert assessment and ongoing CISO support. Cybersecurity Audit & Risk AssessmentAn independent assessment of security and compliance, with risk-based findings and practical recommendations. CISO-as-a-ServiceA senior security lead to plan the work, guide your teams and report to your board. Security Awareness & Management TrainingPractical cybersecurity training that helps staff recognise threats and leaders manage security risks.

Common questions

Related regulations and standards

DORA
Financial firms under DORA follow its security and reporting rules instead of NIS2’s. Other companies in the same group can still fall under NIS2.
ISO 27001
The security management standard behind the certificate many customers ask for. It helps with much of the NIS2 work, but not with national rules or incident reporting.

Free 30-minute call

Plan your next steps for NIS2

In a free 30-minute call, we discuss what applies, what is already in place and where your team needs support with implementation.

Discuss your NIS2 priorities hello@guardera.tech