NIS 2 Directive

For an employee, NIS 2 will mainly mean clearer internal rules, in France once the transposition law is in force. Article 21 asks each entity concerned to take a minimum list of measures, including basic cyber hygiene practices, cybersecurity training, access control policies and, as appropriate, multi-factor authentication¹. Article 20 also asks states to encourage entities to train their staff regularly, so that everyone can spot risks and judge security practices¹.

The point that depends most on you is incident reporting. The directive asks an entity to send an early warning to the CSIRT or the competent authority within 24 hours of becoming aware of a significant incident, then an incident notification within 72 hours and a final report within one month after that¹. These deadlines lose their meaning if the information stays stuck along the way. A suspicious email opened on Monday and reported on Thursday means three days during which an attacker could move forward with nobody looking for them.

Under the directive, an incident is "significant" if it causes, or can cause, severe disruption of services or financial loss for the entity, or considerable damage to other people¹. Sorting is up to the security team; your role is to report. If the incident involves personal data, the GDPR adds its own obligation: notify the CNIL no later than 72 hours after a breach that presents a risk to individuals⁴. The article on the GDPR details this procedure.

In the Brain programme, this action matches the reflex "Report any security incident to the cybersecurity team". Also report your own mistakes, an unfortunate click for example: without your report, the security team may never learn that an attack has begun. The article on blame culture explains why fear of being punished leads people to hide incidents.

NIS 2 brings cybersecurity up to the level of management bodies. The directive asks that they approve the risk management measures and oversee their implementation, that they can be held liable if the entity infringes these obligations, and that their members undergo training¹. In France, these obligations will apply once the transposition law is in force.

For fines, states must provide for a ceiling of at least 10 million euros or 2% of worldwide annual turnover, whichever is higher, when an essential entity fails its security or reporting obligations. For an important entity, this ceiling is at least 7 million euros or 1.4%¹. In an essential entity that does not remedy its failings despite the authority's orders, the directive also allows the authority to request that a person with managerial responsibilities, at chief executive or legal representative level, be temporarily banned from exercising those responsibilities in the entity¹.

Supply chain security is among the measures the directive requires, including relationships with direct suppliers and service providers¹: the article on supplier risk assessment is devoted to it. To help organisations, ANSSI has published a working version of its Référentiel Cyber France (ReCyF), which lists the measures it recommends for meeting the security objectives of NIS 2². A tabletop crisis exercise makes it possible to check, before a real incident, that the alert can go out in under 24 hours.

The directive was published in the Official Journal of the European Union on 27 December 2022. States had to transpose it by 17 October 2024 at the latest and apply it from 18 October 2024, the date on which the 2016 NIS Directive was repealed¹. They also had to draw up the list of their essential and important entities by 17 April 2025 at the latest¹.

Article 21 sets a minimum list of measures, based on an "all-hazards" approach¹:

• risk analysis and information system security policies;
• incident handling;
• business continuity, backups and crisis management;
• supply chain security;
• security in the acquisition, development and maintenance of networks and information systems, including vulnerability handling and disclosure;
• assessment of the effectiveness of the measures;
• basic cyber hygiene and cybersecurity training;
• cryptography and, where appropriate, encryption;
• human resources security, access control and asset management;
• multi-factor authentication and secure communications, as appropriate.

Article 23 sets the timetable for reporting a significant incident¹:

Deadlines counted from the moment the entity becomes aware of the significant incident
24 hours       early warning to the CSIRT or the competent authority
72 hours       incident notification, with an initial assessment of severity and impact
on request     intermediate report
1 month        final report, counted from the incident notification

The European Commission sent letters of formal notice on 28 November 2024, then reasoned opinions on 7 May 2025. On 8 July 2026, it brought Ireland, Spain, France and the Netherlands before the Court of Justice of the European Union, asking for a lump sum and daily penalty payments until transposition is complete⁵.

In France, transposition goes through the bill on the resilience of critical infrastructure and the strengthening of cybersecurity. In its tabled version, its Title II, devoted to cybersecurity, refers to Directive (EU) 2022/2555 and defines essential and important entities, with for example a threshold of at least 50 employees for an important entity⁶. The government tabled it in the Senate on 15 October 2024, under the accelerated procedure, and the Senate adopted it on 12 March 2025. The National Assembly's special committee tabled its text on 10 September 2025⁷. The Assembly's Conference of Presidents had scheduled the bill for the sittings of 7 and 9 October 2026⁸, then removed it on 6 October 2026, without setting a new date⁹. At the time of consultation, the legislative file mentions no examination in a public sitting of the Assembly⁷.

Meanwhile, ANSSI invites future essential and important entities to strengthen their security level now, and states that its ReCyF framework may be adjusted as parliamentary debates proceed².