Compliance
What does the NIS2 Directive require of a company’s infrastructure?
The NIS2 Directive, or Directive (EU) 2022/2555, requires essential and important entities in 18 sectors to manage their cybersecurity risks, report significant incidents within fixed deadlines and answer for it at management level. Its measures also reach the supply chain: infrastructure and IT service providers are part of the risk each entity must control.
On this page
What is NIS2, and how does it differ from the original NIS?
NIS2 replaces the 2016 NIS Directive. It widens the sectors covered, replaces the distinction between operators of essential services and digital service providers with that of essential and important entities, toughens penalties and makes management bodies responsible for approving and overseeing cybersecurity measures. Some texts refer to it as NIS 2.0.
Who does NIS2 apply to?
As a general rule, to medium-sized and large companies in the sectors listed in its annexes, and to some entities regardless of their size, such as DNS service providers or certain electronic communications providers. The sectors covered include:
- High criticality
Energy, transport, banking and financial market infrastructures.
- High criticality
Health, drinking water and waste water.
- High criticality
Digital infrastructure, including data centre service providers and cloud computing service providers.
- High criticality
B2B ICT service management: managed service providers and managed security service providers.
- High criticality
Public administration and space.
- Other critical sectors
Postal services, waste management, chemicals, food, manufacturing, digital providers and research.
This means that a medium-sized or large MSP may be an obliged entity in its own right, as well as a supplier to other obliged entities.
Would it be an obliged entity?
Choose the organisation’s sector and size to see how the NIS2 Directive classifies it, in principle.
Indicative classification
Indicative, based on Directive (EU) 2022/2555. The final classification depends on the national transposition and on an analysis of each case.
What measures does NIS2 require?
Article 21 lists the minimum risk management measures:
- a
Policies on risk analysis and information system security.
- b
Incident handling.
- c
Business continuity: backup management, disaster recovery and crisis management.Related: Cloud Backup and Walhalla S3 with immutable backups.
- d
Supply chain security, including relationships with suppliers.As a provider, Walhalla holds ENS high category and ISO/IEC 27001 certification.
- e
Security in the acquisition, development and maintenance of systems, including vulnerability handling.
- f
Policies to assess the effectiveness of the measures.
- g
Basic cyber hygiene and cybersecurity training.
- h
Cryptography and, where appropriate, encryption.
- i
Human resources security, access control and asset management.
- j
Multi-factor authentication and secure communications.
An indicative self-assessment to prepare the conversation with the customer: it does not replace a compliance analysis.
What are the deadlines for reporting an incident?
24 hours
Early warning from becoming aware of a significant incident
72 hours
Incident notification, with an initial assessment
1 month
Final report, from the notification
Penalties
Essential entities
Fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher.
Important entities
Fines of up to €7 million or 1.4% of total worldwide annual turnover, whichever is higher.
The final regime will be set by each Member State’s transposition law.
Status of NIS2 in Spain
The transposition deadline ended on 17 October 2024. In January 2025 the Spanish Government approved the draft Cybersecurity Coordination and Governance Law (Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad), which is still going through the legislative process at the time this page was reviewed. In July 2026 the European Commission referred Spain to the Court of Justice of the EU for failing to transpose it. The specific obligations will depend on that law, but the text of the directive already shows which measures will have to be demonstrated.
On the blog: NIS2 in Spain: what it requires of your infrastructure while the law arrives
DORA, the regulation for the financial sector
Financial entities are also subject to Regulation (EU) 2022/2554, known as DORA, applicable since 17 January 2025, which governs digital operational resilience and ICT third-party risk management. For them, DORA prevails over NIS2 where the two overlap.
How does certified infrastructure help with NIS2 compliance?
No provider can make an entity compliant with the directive: compliance depends on each organisation’s risk management. What infrastructure does provide is measures and evidence at the points where NIS2 looks at the provider:
Supply chain: a provider with ENS high category and ISO/IEC 27001 certified by AENOR, with the certificates available for audit.
Continuity: managed backup services, immutable backup with Walhalla S3 and a data centre in Castellón.
Incident handling: 24/7 ServiceDesk and SOC, automatic escalation and written communication of critical incidents.
Measurable contracts: committed availability per service, with penalties, the monthly availability percentage for each service and, on request, a detailed report.
Data location: infrastructure in Spain, with no transfers outside the European Economic Area for services hosted in Castellón.
For partners: NIS2 as a conversation with the customer
The directive requires many companies to review their suppliers. For a partner, that opens a concrete conversation with the customer: which infrastructure supports their services, what evidence they can present and how they recover from an incident. Walhalla provides the technical documentation for its part and pre-sales support to prepare that conversation.
Frequently asked questions
What is the NIS2 Directive?
It is Directive (EU) 2022/2555, which lays down measures for a high common level of cybersecurity across the European Union and replaces the 2016 NIS Directive.
When does NIS2 apply in Spain?
Its obligations will become enforceable once the Spanish transposition law is published, which is still going through the legislative process at the time this page was reviewed.
Does NIS2 apply to SMEs?
As a general rule, not to small and micro enterprises, except in specific cases set out in the directive. Even so, they may be affected as suppliers to obliged entities.
What is the difference between NIS2 and the DORA regulation?
NIS2 applies to 18 sectors; DORA applies only to the financial sector and, through contracts, to its ICT providers, and prevails over NIS2 for those entities.
Shall we talk about your project?
Tell us your name, company and phone number, a short description of the project and the service you are interested in. A member of our sales team will get back to you.
