Cybersecurity incidents are escalating at an alarming rate, and critical infrastructure across Europe faces unprecedented threats from both digital attackers and physical disruptions. Organisations that once believed they were too small or too niche to be targeted are now finding themselves squarely within the scope of sweeping new European Union regulations. Although the UK is no longer bound by EU law, these directives impact any UK business operating in or supplying essential services to EU markets.
If your business operates within sectors deemed essential to society’s functioning—from energy and transportation to healthcare and digital services—you’re likely grappling with questions about compliance, implementation timelines, and what these new regulatory frameworks mean for your operational reality. The regulatory landscape has fundamentally shifted, and understanding the intricacies of the NIS2 Directive and the Critical Entities Resilience (CER) Directive is no longer optional for organisations operating within or alongside EU markets.
These two legislative instruments represent the EU’s comprehensive response to evolving security challenges. They acknowledge that modern threats don’t respect the artificial boundaries between cybersecurity and physical security, between digital infrastructure and tangible assets. The interconnected nature of contemporary business operations means that a cyberattack on one entity can trigger cascading failures across multiple sectors, while physical disruptions can have immediate digital consequences. Both directives establish rigorous requirements for risk management, incident reporting, and organisational accountability, yet they target different aspects of resilience and apply to different categories of entities.
What is the NIS2 Directive and why does it matter?
The Network and Information Security Directive 2 (NIS2) represents the EU’s updated and significantly expanded approach to cybersecurity regulation. It replaces the original NIS Directive from 2016, which proved insufficient in addressing the sophisticated and persistent cyber threats that have emerged in recent years. NIS2 came into force in January 2023, with EU member states required to transpose it into national law by October 2024, meaning organisations must be compliant or face substantial penalties.
The directive’s scope is dramatically broader than its predecessor. Where the original NIS Directive covered only a limited number of critical sectors and large operators, NIS2 extends to approximately 160,000 entities across the European Union. This expansion reflects the reality that cybersecurity vulnerabilities in medium-sized enterprises can be just as devastating as those in large corporations, particularly when these businesses form part of critical supply chains or provide essential services.
Key sectors covered under NIS2 include:
- Energy (electricity, oil, gas, hydrogen)
- Transport (air, rail, water, road)
- Banking and financial market infrastructures
- Health sector entities
- Drinking water supply and distribution
- Digital infrastructure and ICT service providers
- Public administration entities
- Space sector operations
- Waste water management
- Manufacturing of critical products (pharmaceuticals, chemicals, food)
- Postal and courier services
- Digital service providers (cloud computing, data centers, content delivery networks)
The directive distinguishes between “essential entities” and “important entities,” with different reporting obligations and supervisory approaches applied to each category. Essential entities typically face stricter scrutiny, but both categories must implement comprehensive cybersecurity risk management measures. These measures include conducting risk analyses, implementing incident handling procedures, ensuring business continuity and crisis management, establishing supply chain security practices, and maintaining policies on the use of cryptography and encryption.
Perhaps most significantly for leadership teams, NIS2 introduces direct accountability for management bodies. Corporate management can now be held personally liable for failures to comply with cybersecurity obligations, a provision designed to ensure that cybersecurity receives appropriate board-level attention and resources. This represents a fundamental shift from viewing cybersecurity as purely a technical concern to recognising it as a governance imperative with legal and financial implications for executive leadership.
Understanding the Critical Entities Resilience Directive
While NIS2 focuses primarily on cybersecurity threats to network and information systems, the Critical Entities Resilience Directive addresses physical security and operational resilience of critical infrastructure. The CER Directive, which also required member state transposition by October 2024, establishes a framework for enhancing the resilience of entities that provide essential services vital to critical societal functions or economic activities.
CER recognises that threats to critical infrastructure extend far beyond the digital realm. Natural disasters, terrorist attacks, insider threats, sabotage, and even extreme weather events driven by climate change can disrupt essential services with devastating consequences for public health, safety, and economic stability. The directive requires member states to adopt national strategies for the resilience of critical entities and establishes minimum requirements that these entities must implement.
The sectors covered by CER overlap significantly with NIS2 but emphasise physical infrastructure and operations:
- Energy generation and distribution facilities
- Transport infrastructure and networks
- Banking infrastructure and financial facilities
- Health sector physical facilities
- Drinking water supply infrastructure
- Waste water treatment plants
- Digital infrastructure facilities
- Public administration buildings and facilities
- Space ground-based infrastructure
Critical entities under CER must conduct comprehensive risk assessments that identify potential threats—both intentional and unintentional—to their physical infrastructure and operations. These assessments form the foundation for implementing appropriate technical, security, and organisational measures designed to ensure resilience. The directive emphasises a holistic approach, requiring entities to consider dependencies on other critical services, supply chain vulnerabilities, and the potential for cascading effects when disruptions occur.
Member states are required to designate competent authorities responsible for implementing and supervising CER compliance, conduct regular inspections or assessments of critical entities, and provide support to help these organisations enhance their resilience capabilities. The directive also encourages information sharing between critical entities and authorities, recognising that collective intelligence about threats and vulnerabilities benefits the entire critical infrastructure ecosystem.
How NIS2 and CER work together
The relationship between NIS2 and CER is complementary rather than redundant. Many organisations will find themselves subject to both directives, requiring an integrated approach to compliance that addresses both cyber and physical security dimensions. This dual applicability reflects the interconnected nature of modern threats and the artificial nature of separating digital and physical security in contemporary operational environments.
| Aspect | NIS2 Directive | CER Directive
|
|---|---|---|
| Primary Focus | Cybersecurity and network security | Physical security and operational resilience |
| Threat Landscape | Cyberattacks, data breaches, system compromises | Natural disasters, physical attacks, infrastructure failures |
| Key Requirements | Cyber risk management, incident response, supply chain security | Physical risk assessments, resilience measures, business continuity |
| Incident Reporting | 24-hour early warning, detailed reports within 72 hours | Notification of significant incidents affecting service provision |
| Enforcement | Substantial fines up to €10 million or 2% of global turnover | Member state-determined penalties and enforcement measures |
| Management Liability | Explicit personal liability for executive management | Organisational responsibility with member state discretion |
Organisations operating critical infrastructure or providing essential services should view these directives as two sides of the same resilience coin. A comprehensive security program must address both the digital vulnerabilities that could be exploited by cyber adversaries and the physical vulnerabilities that could be targeted through traditional means or disrupted by natural events. The most sophisticated threats often combine both dimensions—using cyberattacks to disable physical security systems before conducting physical intrusions, or targeting physical infrastructure to degrade digital services.
The compliance frameworks established by both directives share common elements that allow for integrated implementation. Both require regular risk assessments, though the scope of risks considered differs. Both mandate incident reporting, though the timelines and thresholds vary. Both emphasise the importance of supply chain security, recognising that dependencies on external suppliers and service providers create vulnerabilities that organisations must actively manage. Organisations that approach compliance strategically can develop unified governance structures, risk management frameworks, and incident response capabilities that satisfy requirements under both directives while delivering genuine security improvements.
Practical implications for organisations
The implementation burden created by NIS2 and CER should not be underestimated, particularly for organisations that have historically treated security as a compliance checkbox rather than a core business function. The directives require sustained investment in technical capabilities, personnel expertise, and organisational processes. However, they also create opportunities for organisations to fundamentally strengthen their security posture and operational resilience in ways that deliver competitive advantages beyond mere regulatory compliance.
Resource allocation represents the first major challenge. Organisations must invest in security technologies, hire or train qualified personnel, engage external consultants where expertise gaps exist, and dedicate ongoing resources to monitoring, assessment, and continuous improvement. For many medium-sized enterprises now captured under NIS2’s expanded scope, these requirements represent a significant departure from previous security investment levels. Budget conversations must shift from viewing security spending as overhead to recognising it as essential infrastructure investment that protects organisational viability.
Governance structures require fundamental rethinking. The explicit management liability provisions in NIS2 mean that boards and executive teams can no longer delegate security responsibility entirely to technical teams. Security must become a standing agenda item at the highest levels of organisational governance, with regular reporting on risk posture, incident trends, compliance status, and investment requirements. Management bodies need sufficient technical literacy to ask meaningful questions and make informed decisions about security trade-offs and resource allocation.
Documentation and evidence requirements create ongoing administrative obligations. Both directives require organisations to demonstrate compliance through documented risk assessments, security policies, incident response procedures, training programs, and audit trails. These documentation requirements serve regulatory purposes but also deliver operational value by forcing organisations to formalise previously ad hoc processes, clarify responsibilities, and create institutional memory that survives personnel changes.
Supply chain security emerges as a particularly complex challenge under both directives. Organizations must assess the security posture of their suppliers and service providers, ensure that contracts include appropriate security requirements, and monitor ongoing compliance. This creates cascading compliance obligations throughout supply chains, with large essential entities effectively extending regulatory requirements to their smaller suppliers. Organisations at all levels must be prepared to demonstrate their security capabilities to customers and partners, making compliance a competitive factor in procurement decisions.
The enforcement landscape and penalties
The consequences of non-compliance with NIS2 are severe and explicitly defined. Member states must ensure that penalties are effective, proportionate, and dissuasive, with maximum administrative fines reaching at least €10 million or 2% of total worldwide annual turnover for essential entities, whichever is higher. Important entities face somewhat lower maximum fines of at least €7 million or 1.4% of turnover. These penalty levels place NIS2 in the same category as GDPR in terms of potential financial impact.
Beyond financial penalties, supervisory authorities possess extensive powers including the ability to conduct on-site inspections, require specific security measures to be implemented, and mandate audits at the expense of the non-compliant entity. In extreme cases of persistent non-compliance, authorities can temporarily suspend management from exercising managerial functions within the organisation. These enforcement mechanisms create substantial pressure for genuine compliance rather than superficial checkbox exercises.
CER enforcement varies more significantly between member states, as the directive provides greater flexibility in determining specific penalties. However, member states must ensure that penalties are sufficient to incentivise compliance and deter violations. Organisations should assume that enforcement will be robust and that regulatory authorities will increasingly coordinate across borders to address security gaps that could affect multiple jurisdictions.
The reputational consequences of security failures under these regulatory frameworks may ultimately prove more damaging than direct penalties. Public disclosure requirements for significant incidents mean that security failures become matters of public record, potentially affecting customer confidence, investor sentiment, and competitive positioning. Organisations that experience major incidents due to inadequate security measures face not only regulatory penalties but also potential civil liability from affected parties and lasting damage to brand reputation that can take years to repair.
Moving beyond compliance to resilience
Organisations that view NIS2 and CER purely as compliance obligations miss the strategic opportunity these frameworks represent. The most sophisticated organisations are using these regulatory drivers as catalysts for fundamental transformation in how they approach security and operational resilience. Rather than implementing minimum requirements to avoid penalties, they’re building comprehensive capabilities that position them to adapt to evolving threats and maintain operations under adverse conditions.
This strategic approach recognises that the threat landscape continues to evolve faster than regulatory frameworks can adapt. State-sponsored cyber operations grow more sophisticated, ransomware groups professionalise their operations and target ever-more-critical systems, supply chain compromises become increasingly common, and the convergence of cyber and physical threats creates novel attack vectors that traditional security approaches fail to address. Organisations that merely check compliance boxes remain vulnerable to threats that fall outside regulatory specifications or exploit gaps between different regulatory frameworks.
Building genuine resilience requires moving beyond perimeter defense mentality to assume that both breaches and disruptions will occur. This assumption drives investment in detection capabilities, incident response preparedness, recovery procedures, and redundancy that allows continued operation even when primary systems are compromised. Organisations develop muscle memory through regular exercises that test response procedures under realistic conditions, identifying weaknesses before actual incidents occur. They establish relationships with external partners—law enforcement, industry peers, security vendors—that can be activated quickly when incidents occur.
The convergence of security and business continuity planning represents another dimension of strategic maturity. Organisations recognise that security incidents are business continuity events and that operational disruptions often have security dimensions. Integrated planning ensures that response procedures address both aspects simultaneously, that communication protocols reach all relevant stakeholders, and that recovery prioritisation reflects actual business criticality rather than technical convenience or organisational politics.
