From Warning to Reality: NIS2 and the New Rules of IT Responsibility

_____________

TL;DR

• NIS2 is now enforceable across the EU and directly impacts IT providers working with regulated clients

• Cyber threats such as ransomware, supply chain attacks, and operational disruption are increasing, and NIS2 is the legislative answer

• interworks.cloud & Acronis provides scalable, proven solutions that help partners meet NIS2 requirements through cyber resilience, data protection, and operational readiness

• Watch our webinar on demand to explore how Acronis solutions align with NIS2 compliance

_____________

The Network and Information Security Directive 2 (NIS2) is the EU’s most comprehensive cybersecurity regulation to date. It is designed to ensure that essential services and digital infrastructure across Europe are protected against evolving cyber threats. Covering a wide range of sectors — from energy and healthcare to transport and cloud computing — NIS2 sets minimum requirements for risk management, incident reporting, and overall cyber resilience.

Coming into force in January 2023, EU member states were required to transpose it into national law by October 17, 2024. Now, in May 2025, NIS2 is no longer theoretical. It is enforceable. Regulatory checks are underway, compliance audits are happening, and penalties for non-compliance are real — including multi-million-euro fines and personal liability for senior management.

The urgency is no longer abstract. Cyber incidents are not just happening more often. They are more destructive, more coordinated, and increasingly targeting digital supply chains. High-profile ransomware attacks on critical infrastructure, breaches that shut down hospitals, and cascading failures across IT service networks have accelerated the EU’s response.

NIS2 reflects that reality. It puts pressure on organisations to take cybersecurity seriously and to prove that their processes, systems, and partnerships are resilient by design. This includes cloud platforms, managed services, and digital providers — anyone whose services play a role in the delivery or protection of critical digital infrastructure.

Everyone in the ecosystem should view this moment not simply as a regulatory shift but as a call for coordinated responsibility. The ability to act with knowledge, alignment, and trusted partnerships will define who thrives in this new chapter.

NIS2: A new cybersecurity baseline for Europe

This directive does not simply expand the original NIS framework. It transforms it. NIS2 introduces detailed expectations for both public and private sector entities, with a strong emphasis on operational security and response capability.

Key updates include:

• Broader scope covering essential and important entities across sectors such as health, digital infrastructure, energy, logistics, and public administration

• Stricter obligations for incident detection and reporting, including notification within 24 hours of becoming aware of a significant threat

• Heavier penalties for non-compliance, with fines reaching up to 10 million euros or two percent of global turnover

• Personal accountability for executive leadership and stricter enforcement by national cybersecurity authorities

These changes are not optional. They are enforceable by law and are already shaping vendor relationships, procurement requirements, and service delivery models. Cybersecurity is no longer a supporting function. It is a strategic pillar.