The NIS2 directive (Network and Information Security 2) is the European text, adopted in 2022, that imposes cybersecurity obligations on so-called essential and important entities in 18 sectors: energy, transport, banking, health, water, digital infrastructure, cloud providers, managed service providers, public administration and manufacturing, among others. It replaces the 2016 NIS directive and greatly widens the number of organizations concerned.
It requires cyber governance owned by management, risk management measures (access control, MFA, vulnerability management, supplier security) and the reporting of serious incidents: early warning within 24 hours, notification within 72 hours. In France, ANSSI steers its implementation.
Fines can reach 10 million euros or 2% of worldwide turnover for essential entities.
Why it matters when hiring
NIS2 creates needs in organizations that had never structured their security: CISOs, GRC profiles, SOC analysts. A credible candidate can turn the text into a concrete action plan (inventory, priorities, compliance evidence), not just summarize it. The trap: hiring a pure legal profile where an understanding of infrastructure is also needed.