The NIS2 Directive applies to a wide range of public and private entities operating in sectors considered essential or important for the security and functioning of society and the economy. These include: energy, transportation, healthcare, finance, digital infrastructure, public administration, telecommunications, and ICT service providers. It also includes medium-to-large companies with national or European relevance.

NIS2 aims to strengthen the overall level of cybersecurity within the European Union. It sets minimum cybersecurity standards, promotes cooperation between member states, and introduces obligations for risk management, prevention of cybersecurity incidents, and an effective response in the event of an attack.

Obliged entities must adopt adequate technical and organizational measures to protect networks and information systems, conduct risk assessments, report significant incidents within 24 hours, and ensure business continuity. Sanctions for non-compliance with the directive can reach up to 10 million euros or 2% of global annual turnover, in addition to personal liability for executives.