NIS 2

Miss on NIS 2?

The NIS 2 directive is a new regulation of the European Union that establishes new, stricter requirements for the cyber security of companies that provide essential services. It entered into force already in January 2023, but it came into force in Estonia from October 2025.

The NIS2 directive applies to companies that provide services or operate in the EU, are at least medium-sized, i.e. with 50 employees, and whose annual balance sheet volume or annual turnover exceeds 10 million euros

NIS 2 Directive sets requirements for incident reporting arrangements (Article 23)

In Estonia, NIS2 expands the circle of companies that have an obligation to comply with the cyber security law, which is ensured by compliance with E-ITS or ISO27001.

Who has NIS 2?

The NIS 2 directive applies to your company if you operate in the following areas:

Electricity, district heating and cooling

Oil, gas, hydrogen

Air transport, rail transport, water transport, road transport

Banking, financial market infrastructures

Healthcare, research institutions

Drinking water, waste water, waste treatment

Digital infrastructure, ICT service management (business-to-business), digital service providers

Public administration units, postal and courier services

Educational institutions

Manufacturing, production and distribution of chemicals, food production, processing and distribution, manufacturing industry (e.g. manufacturing of computers, electronic and optical equipment)

Remember! If you are in the scope of the NIS 2 directive, you also have an obligation to set up a whistleblower notification channel

Reference: Directive on measures to ensure a uniformly high level of cybersecurity across the Union (Cybersecurity Directive 2) | Shaping Europe's digital future

Get advice on the requirements applied to your organization!

We believe that an informed manager makes better decisions for his company. Our goal is to help bring information closer to you.

Get in touch

Contact info

Our location