What is happening?
The NIS2 Directive (EU 2022/2555) requires Member States to transpose new cybersecurity rules into national law. Organisations in essential and important sectors must manage cyber risks, report incidents to their national CSIRT within 24 hours, and demonstrably ensure the security of their entire supply chain.
That last requirement — supply-chain due diligence — is why NIS2 also affects SMEs that are not directly in scope. Large contracting entities will require their suppliers to demonstrate compliance, because otherwise they cannot fulfil their own supply-chain obligations.
Key figures
- Transposition deadline
- 17 October 2024 (ongoing)
- Directly in scope
- ~160,000 entities across the EU
- Indirectly via supply chain
- Hundreds of thousands of SME suppliers
- Incident notification
- 24 hours (early warning)
- Max. fine
- €10M or 2% of global turnover
- Supervision
- National competent authorities per Member State
Why NIS2 Radar?
Governments publish legal texts, guidance and entity registers — but none of these sources answer the questions that directors and compliance officers actually have: Am I in scope? What are my suppliers doing? How much time do I have left?
NIS2 Radar is an independent tool — built by someone with a background in fintech, open banking and security — that makes raw government data accessible and combines it with practical decision support. No consultancy funnel, no busywork: direct answers.