Essential and important entities. Supply-chain security obligations. 24-hour incident notification, transposed differently across 27 member states. The Agency keeps your NIS2 evidence trail current and your supply-chain visibility live.
NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. It entered into force on 16 January 2023, with member states required to transpose it into national law by 17 October 2024, and it replaces the original 2016 NIS Directive — widening both who is regulated and what they must do.
It divides entities into essential and important, across sectors including energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management, public administration, space, postal services, waste, chemicals, food, manufacturing and digital providers. The split affects supervision — essential entities face proactive supervision, important entities largely reactive — and the maximum penalty, not the substance of what is required.
Because it is a directive rather than a regulation, the detail varies by member state, and transposition has run at very different speeds. A group operating across several countries faces one set of obligations and several national implementations of them.
The provision that matters most here is Article 21(2)(d): entities are responsible for the security of their direct suppliers and service providers. That makes supply chain security a legal obligation rather than good practice. Our full NIS2 explainer covers scope, the essential-versus-important test and the reporting deadlines in detail.
NIS2 raised the stakes — wider scope, stricter supply-chain obligations, and member-state transpositions that move the goalposts country by country. Your evidence trail has to keep up.
Three of The Agency's leads cover NIS2 end-to-end: continuous gap analysis, regulator-formatted reporting per member state, and supply-chain monitoring that keeps Article 21 obligations evidenced.
Article 21 supply-chain security, continuously evidenced. TARA assesses your supply-chain posture against NIS2 obligations on a rolling basis — and tracks remediation against the deadlines the directive expects.
Incident reports formatted for the right regulator. VANCE generates NIS2 incident packs, board-pack summaries and cross-border evidence bundles — formatted for the supervisory authority actually reviewing them.
Supply-chain visibility kept live, not point-in-time. REX maps your vendors, their vendors, and the breach signal from both — so Article 21 supply-chain security has actual evidence behind it.
NIS2 stops being a sprint to the local transposition deadline and becomes a continuous evidence layer that adapts when each member state moves the goalposts.
Supply-chain posture is mapped, scored and continuously evidenced — not asserted in a slide deck.
REX detects material change continuously; VANCE drafts the notification; your team reviews and submits.
Essential entity vs important entity, with the right evidence depth and reporting cadence per classification.
One evidence layer feeds reports for every member state your operations touch — no re-assembly per regulator.
The brief format is the difference. We stopped getting lists of findings and started getting decisions. That's the bit that was missing.
Scope, timing and the essential-versus-important split are covered on our NIS2 explainer. These are the questions that follow once you know you are in scope.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.