What is: NIS2

NIS2 is an EU cybersecurity directive (in Greece Law 5160/2024) that requires thousands of businesses to apply specific security measures and places accountability on management.

NIS2 greatly expands which businesses are in scope, in sectors such as energy, health, food, transport, digital services and manufacturing. Article 21 defines risk-management measures: access control, backup, updates, training, incident response planning.

Key change: responsibility sits with management, and there are incident reporting deadlines (24 hours, 72 hours, 1 month) and fines for non-compliance.