NIS2 Directive

The EU cybersecurity directive that obliges organisations in essential and important sectors to manage risk across their own supply chains.

[01]What It Means

NIS2 covers eighteen sectors including energy, health, transport, manufacturing and digital infrastructure, and requires regulated entities to secure their suppliers as well as themselves. Vendors are pulled in indirectly but bindingly: the obligation reaches you through your customer’s procurement.

[02]Why It Matters

For a software vendor selling into Europe, NIS2 is a sales gate. Buyers must evidence supplier risk management, and management bodies carry personal liability for failures, which makes procurement slower and more sceptical than most entry plans assume.

[03]Where It Goes Wrong

Assuming an ISO 27001 certificate answers the whole questionnaire – it covers much of the ground but not incident workflows or management accountability.No contractual ability to support a customer’s incident reporting deadlines.Discovering the requirement in the security review instead of designing for it.

[04]Related Terms