thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

NIS2 Directive

EU Directive (2022/2555) imposing cybersecurity risk-management and incident-reporting obligations on essential and important entities.

Definition

NIS2 replaced the original NIS Directive, with a member-state transposition deadline of 17 October 2024. It expands covered sectors, classifies entities as essential or important, requires risk management measures including supply chain security, and mandates incident reporting (24-hour early warning, 72-hour notification, one-month final report). Management bodies must approve measures and can be held liable; fines reach 10 million euros or 2 percent of turnover for essential entities.

Example

A mid-sized EU energy supplier must report a significant ransomware incident to its CSIRT within 24 hours.

Exam tip

Remember the 24h/72h/1-month reporting sequence and management accountability.

Related terms