NIS-2 Directive — Cybersecurity Compliance

The NIS-2 Directive is a European Union law on cybersecurity that broadens and replaces the earlier Network and Information Security Directive. It sets baseline security-risk-management and incident-reporting obligations for organisations classified as essential or important entities across a wide range of sectors, and requires member states to transpose it into national law. NIS-2 widens the scope of the regime to many more medium and large organisations than its predecessor and strengthens governance, supervision and enforcement. For DACH SMEs, the practical question is whether their sector and size bring them into scope, and how their ERP and related systems support the required controls.

Purpose and scope

NIS-2 aims to raise the overall level of cybersecurity across the EU by harmonising requirements and extending them to more sectors and organisations. It distinguishes between essential entities and important entities, with the classification depending on sector and on size thresholds. Covered sectors include, among others, energy, transport, banking, health, digital infrastructure, public administration, manufacturing of certain products, food, waste and digital service providers. The directive is implemented through national transposition laws, so the precise obligations and authorities that apply to a given organisation are defined at member-state level.

Core obligations

Organisations in scope must adopt appropriate and proportionate technical and organisational measures to manage cybersecurity risk. The directive frames these as a risk-management baseline rather than a fixed checklist, typically covering areas such as:

• Risk analysis and information-system security policies.
• Incident handling, business continuity and crisis management.
• Supply-chain security, including security in supplier relationships.
• Security in acquisition, development and maintenance of systems, and vulnerability handling.
• Access control, asset management and use of multi-factor authentication where appropriate.

NIS-2 also introduces incident-reporting duties to the competent national authority within defined timeframes, and places accountability for cybersecurity measures on management bodies.

Relevance to ERP and connected systems

ERP systems hold core business data and connect to many other applications, so they fall within the scope of an organisation's cybersecurity-risk management under NIS-2. Relevant controls include a sound role concept, single sign-on with strong authentication, logging and an audit trail, and disciplined patch and vulnerability management. Where an organisation runs ERP as SaaS, supplier-security and service-level arrangements with the provider become part of the supply-chain considerations the directive emphasises. Security-monitoring tooling such as a SIEM often supports the detection and reporting obligations.

How to approach NIS-2

Because applicability and exact requirements depend on the national transposition and on an organisation's sector and size, the first step is a scoping assessment rather than a technology purchase. A typical sequence is:

• Determine whether the organisation is an essential or important entity under the applicable national law.
• Map existing security measures against the directive's risk-management areas and identify gaps.
• Establish incident-reporting processes and management oversight.
• Review the security posture of key suppliers, including ERP and cloud providers.

This editorial summary describes scope and intent and is not legal advice; organisations should confirm their specific obligations against the applicable national transposition law and qualified counsel.

Related Topics

• SIEM
• Audit trail
• GoBD