NIS2 Infrastructure Compliance: The Complete Engineering Guide for Essential and Important Entities

The NIS2 Directive (2022/2555) is the most sweeping cybersecurity regulation the EU has produced. Applicable since October 2024, it replaces the original NIS Directive and dramatically expands scope — from a few hundred operators to an estimated 160,000+ entities across 18 sectors. If you provide essential or important services in the EU, NIS2 applies to you. And unlike its predecessor, it has teeth: fines up to €10 million or 2% of global turnover for essential entities.

Who NIS2 Covers

NIS2 categorizes entities into two tiers with different supervisory regimes:

• Essential Entities (Annex I) — Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space
• Important Entities (Annex II) — Postal services, waste management, chemicals, food, manufacturing (medical devices, computers, electronics, machinery, motor vehicles), digital providers (online marketplaces, search engines, social platforms), research

Size matters: medium enterprises (50+ employees or €10M+ turnover) and large enterprises are automatically in scope. Some entities are in scope regardless of size — DNS providers, TLD registries, qualified trust service providers, and others.

Article 21: The Technical Requirements

Article 21 is where NIS2 gets concrete. It mandates "appropriate and proportionate" cybersecurity risk management measures covering at minimum:

• Risk analysis and information system security policies
• Incident handling — detection, response, recovery
• Business continuity and crisis management — backup, disaster recovery, crisis management
• Supply chain security — including security aspects of supplier/service provider relationships
• Security in network and information systems acquisition, development, and maintenance — including vulnerability handling and disclosure
• Policies and procedures to assess cybersecurity risk management effectiveness
• Basic cyber hygiene practices and cybersecurity training
• Policies on cryptography and encryption
• Human resources security, access control, and asset management
• Multi-factor authentication (MFA), secured voice/video/text, and secured emergency communications

Infrastructure Architecture for NIS2

Translating Article 21 into infrastructure means building layered defenses:

• Network segmentation — Isolate critical systems. Zero-trust network architecture with microsegmentation. East-west traffic inspection.
• Identity and access management — Centralized IAM with MFA everywhere. Privileged access management (PAM). Just-in-time access provisioning.
• Encryption — TLS 1.3 in transit, AES-256 at rest. Key management with HSM. Certificate lifecycle automation.
• Monitoring and detection — SIEM with correlation rules. NDR for network anomalies. EDR on all endpoints. 24/7 SOC capability.
• Backup and recovery — 3-2-1 backup strategy. Immutable backups. Tested recovery procedures with documented RTOs/RPOs.

Incident Reporting Under NIS2

NIS2 introduces a multi-stage incident reporting obligation (Article 23):

• Early warning — within 24 hours of becoming aware of a significant incident
• Incident notification — within 72 hours, with initial assessment including severity and impact
• Final report — within one month, with root cause analysis, mitigation measures, and cross-border impact

Your infrastructure must support this. That means automated incident detection and classification, forensic data preservation, and reporting pipeline integration with your national CSIRT.

Supply Chain Security

NIS2's supply chain requirements (Article 21(2)(d)) are particularly challenging for infrastructure teams. You must assess and manage the cybersecurity posture of your suppliers — including their development practices, vulnerability handling, and product security. This directly feeds into your technology procurement process, vendor risk assessments, and contract requirements.

What Open Empower Delivers

As your AI infrastructure partner, we help regulated enterprises implement NIS2-compliant infrastructure from the ground up. Our assessment identifies gaps against all Article 21 requirements, and our implementation delivers hardened platforms with built-in compliance evidence. From network architecture to incident response automation, we build infrastructure that doesn't just check boxes — it actually protects your operations.