How NIS 2 Redefines Cybersecurity Standards For Companies Worldwide

Forbes

08-08-2025

Prof. Dr. Dennis-Kenji Kipker is a cybersecurity expert and works as Scientific Director of the cyberintelligence.institute.
In December 2022, the NIS 2 Directive was adopted in the European Union. Countless EU member states have already transposed it into national law, with most other European member states set to follow. This means the new cybersecurity directive applies to all companies doing business in the EU—and, therefore, to companies worldwide.
It is well worth looking at the largest European legal act on cybersecurity to date, both to avoid fines and to strengthen your own corporate cybersecurity best practices.
The NIS 2 Directive affects not only companies that are critical infrastructures but also all central economic enterprises, their suppliers and their digital supply chains. In this way, cybersecurity is becoming a task of general economic protection—a trend that characterizes the EU and that more countries worldwide are taking up.
As many companies covered by NIS 2 pass on the increased cybersecurity requirements in their contracts, particular caution will be required in the future when providing evidence and documentation of their own cybersecurity standards.
The directive affects companies from the following sectors:
• Energy
• Transport
• Banking
• Financial market infrastructure
• Healthcare
• Drinking water
• Wastewater
• Digital infrastructure operators
• IT service management
• Public administration and government institutions
• Space
• Postal and courier services
• Waste disposal
Additionally, it affects countless manufacturing companies, including chemical companies, mechanical and vehicle engineering, food production and providers of digital services such as cloud computing, online marketplaces and online search engines. The new cybersecurity obligations also cover private research institutions.
However, sectoral affiliation is not the only decisive factor in whether NIS 2 affects a company; organizations must also achieve minimum values for turnover and number of employees. Companies that employ at least 50 people or have annual turnover and balance sheets that each exceed €10 million are obliged to implement a cybersecurity management system in the EU.
In particular, many medium-sized companies—as well as companies from other countries around the world that do business in the EU—are facing increasingly strict cybersecurity compliance obligations. Regarding best practices, however, the new standards don't require an absolute level of digital security but, rather, a level that is appropriate to the given risks.
For example, companies that are newly covered by NIS 2 must first and foremost implement cybersecurity risk management that is based on state-of-the-art technology. Measures to be taken could include the following:
• Systems for attack detection
• Use of AI tools for automated prevention and response to cyber incidents in the company
• Network segmentation
• Access control (in particular, zero-trust policies)
• Awareness for management and employees
• Network mapping and network segmentation
• Vulnerability management and update policies
Cybersecurity is also increasingly becoming a task of holistic digital resilience. With the recent revelation that IT workers from North Korea have even successfully infiltrated large Fortune 500 companies in the United States, every company's cybersecurity policy must increasingly and actively incorporate the factors of industrial espionage and trade secret protection. This is the Achilles' heel of countless companies, as IT management and employee management must increasingly be considered holistically.
In an age of global threats, however, the risk analysis for cybersecurity doesn't end here, as non-technical risk factors and the protection of the (digital) supply chain must increasingly be included. This means that in the age of cloud computing, companies themselves are responsible for ensuring their contractors also demonstrably verify the cybersecurity, availability and data confidentiality of their IT systems.
On the other hand, bottlenecks in the supply of hardware, for example—which still largely originates in Asia, particularly Taiwan and the People's Republic of China—must also be taken into account.
According to the NIS 2 Directive, it's also essential for companies to document every cybersecurity measure they take. Such technical and organizational documentation is not only in the company's own interest to continuously develop an information security management system, but it can also be helpful when it comes to preparing for cybersecurity audits and certifications or when official inspections are pending—which is also possible under European law. As the individual EU member states are responsible for implementing the NIS 2 Directive, the national cybersecurity authorities carry out such reviews.
This means that documenting the cybersecurity measures taken can also help to ward off fines, which can easily run into the millions in the event of serious breaches since NIS 2 defines standardized European fine thresholds for breaches in line with the EU GDPR. The maximum fine for significant entities is either €10 million or 2% of global annual turnover, whichever is higher. The documentation to defend against civil claims for damages following IT failures is of similar relevance.
However, documentation is also required beyond this, as the NIS 2 Directive stipulates official reporting obligations in the event of cyber incidents. Maximum reporting deadlines of 24 and 72 hours apply to the content of the reports, which must always be submitted immediately. In case of doubt, competent authorities may carry out random on-site inspections of cybersecurity standards in the companies, for which the management can be held liable.
As a result, the NIS 2 Directive and its current implementation in all EU member states could massively increase the level of cybersecurity for globally active companies by the end of this year at the latest. Good cybersecurity best practices will become a general corporate warranty responsibility. All international companies operating in the EU are also required to check whether they fall within the scope of the directive and, if so, to establish suitable best practices to defend against digital threats within the company.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?