Due 28 OctAUQuarterly BAS Due (July–September) NewUSForm 1099-NEC & Contractor Payment Reporting Check See deadlines ›
Due 31 OctPaper Self Assessment Return Deadline NewSole Trader Allowable Expenses & Simplified Expenses Check See deadlines ›
Due 2 NovForm 941 Quarterly Payroll Tax Return Due (Q3) NewForm 1099-NEC & Contractor Payment Reporting Check See deadlines ›
Due 31 OctEU One Stop Shop (OSS) VAT Return — July to September NewEU Product Liability Directive Readiness Check See deadlines ›
Due 28 OctQuarterly BAS Due (July–September) NewAutomated Decision-Making Privacy Check (Australia) See deadlines ›

AI & Tech European Union For businesses

NIS2 Directive Cybersecurity Compliance Check (EU)

NIS2 compliance check for EU businesses: are you in scope, essential or important entity, Article 21 security measures and 24-hour incident reporting.

Start free check 11 questions · 8 minutes · No signup
Trending now

Did you know? The numbers behind this check.

  • 18 October 2024Applies from
  • Within 24 hoursEarly warning of incidents
  • €10m or 2% of turnoverMax fine (essential entities)
  • €7m or 1.4% of turnoverMax fine (important entities)

Why this matters.

The NIS2 Directive (Directive (EU) 2022/2555) replaced the original NIS Directive and greatly widened who must meet EU cybersecurity rules. Member states had to apply it from 18 October 2024. It generally covers medium and large organisations (50 or more staff, or over €10 million turnover and balance sheet) in the sectors listed in Annex I, such as energy, transport, banking, health, digital infrastructure and managed IT services, and Annex II, such as postal services, waste, chemicals, food, manufacturing and digital providers. Some providers, including DNS and trust service providers, are covered whatever their size. In-scope organisations are either essential or important entities (Article 3), and many must register with their national authority.

NIS2 makes cybersecurity a board-level duty. Management must approve and oversee security measures and take training, and can be held personally liable (Article 20). Organisations must put in place the risk-management measures in Article 21, including incident handling, business continuity and backups, supply chain security, multi-factor authentication and encryption, and report significant incidents within 24 hours (early warning), 72 hours (notification) and one month (final report) under Article 23. Fines reach at least €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities (Article 34). Several member states transposed late, so check your national law as well.

Have these to hand.

  • Your headcount, annual turnover and balance sheet total, including linked or partner companies
  • The EU countries you operate in and the services you provide
  • Your current information security policies or certifications, such as ISO 27001
  • Your incident response plan and a list of key IT suppliers

What you’ll get.

  • 1A score out of 100Where you stand today, at a glance.
  • 2Findings ranked by riskWhat could cost you, highest risk first.
  • 3A plan with timeframesWhat to fix first and by when.

Use this free tool to check whether the NIS2 Directive applies to your business, whether you are an essential or important entity, and which cybersecurity and incident reporting duties you still need to meet.

More in AI & Tech. Checks people run next.

General guidance only, not legal advice. Consult a qualified solicitor or adviser in your jurisdiction for specific issues.