NIS2 anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-121 min readanchors
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary text, operating bodies, Member State transposition, related instruments, reference resources.

Primary text

  • Directive (EU) 2022/2555 — NIS2 Directive. Published OJEU 27 December 2022. Free at eur-lex.europa.eu.
  • Recitals — 144 recitals.
  • Articles — 46 articles.
  • Annexes — Annex I (essential-entity sectors), Annex II (important-entity sectors).

Predecessors

  • Directive (EU) 2016/1148 — original NIS Directive (NIS1). Replaced by NIS2 from 18 October 2024.

Operating bodies

  • European Commission — DG CNECT.
  • ENISA (European Union Agency for Cybersecurity) — implementation support, guidelines, threat-landscape reporting.
  • Cooperation Group — EU-level cooperation among Member States, Commission, ENISA.
  • CSIRTs network — operational cooperation among national CSIRTs.
  • EU-CyCLONe — Cyber Crisis Liaison Organisation Network. Large-scale incident coordination.
  • National competent authorities — Member State-designated.

DE transposition

  • NIS2UmsuCG (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz) — DE implementing law.
  • BSI (Bundesamt für Sicherheit in der Informationstechnik) — primary national authority.
  • BNetzA (Bundesnetzagentur) — telecoms/digital infrastructure aspects.

Other Member State transpositions

  • France: transposition via Loi du 30 avril 2024.
  • Netherlands: Cyberbeveiligingswet (transition).
  • Italy: D.Lgs. 138/2024.
  • Spain: Real Decreto-ley 7/2024.
  • Other Member States: varying.

Adjacent EU legislation

  • DORA (Reg 2022/2554) — financial services ICT resilience. NIS2 lex specialis for financial services.
  • Cyber Resilience Act (Reg 2024/2847) — digital product cybersecurity. Complements NIS2.
  • EU AI Act (Reg 2024/1689) — high-risk AI cybersecurity overlap.
  • GDPR (Reg 2016/679) — incident reporting parallel obligations.
  • Critical Entities Resilience Directive (Dir 2022/2557) — physical resilience companion to NIS2.

Reference resources

  • digital-strategy.ec.europa.eu/en/policies/nis2-directive — Commission NIS2 hub.
  • enisa.europa.eu — ENISA NIS2 resources.
  • BSI.bund.de — DE national authority hub.
  • Various Member State authority sites — country-specific guidance.

Named voices

  • ENISA leadership — Juhan Lepassaar (Executive Director).
  • Various national authority heads.
  • DigitalEurope, ECSO — industry associations engaged.
  • Various national CERT directors.

See also