NIS2 Directive
Cybersecurity risk-management measures and incident reporting for essential and important entities.
- Issued by
- European Union
- Applies in
- European Union
- Edition
- Directive (EU) 2022/2555
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Art.20Management body approval, oversight and trainingGovernance
- Art.21Cybersecurity risk-management measuresMeasures
- Art.21(2)(d)Supply chain securityMeasures
- Art.23Incident reporting: 24-hour early warning, 72-hour notificationIncidents
How Amoreg keeps you on it.
Enable the NIS2 Directive and the Monitor suggests Official Journal as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 4 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read eur-lex.europa.eu/oj/direct-access.html
- Check the library against 4 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: management body approval, oversight and training
- Rule
- NIS2 Directive, Art.20
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
- Central Bank of Ireland — Operational Resilience & Outsourcing GuidanceThe cross-industry guidance on operational resilience and on outsourcing.Ireland · 4 controls
- MAS Technology Risk Management GuidelinesTechnology risk governance, security, resilience and third-party expectations for financial institutions.Singapore · 5 controls
Also in European Union
- EU Anti-Money Laundering Directives (4AMLD–6AMLD)The directive-based regime transposed into member state law, until the single rulebook applies.European Union · 6 controls
- EU AML Regulation (single rulebook)Directly applicable AML/CFT rules for obliged entities across the Union, supervised by AMLA (operational since July 2025).European Union · 8 controls
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- EU Artificial Intelligence ActRisk-based obligations for providers and deployers of AI systems; general-purpose AI duties from August 2025, high-risk from August 2026.European Union · 6 controls
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- MiFID II / MiFIRInvestor protection, product governance, transparency and transaction reporting for investment firms.European Union · 6 controls
Questions
Does Amoreg watch for changes to the NIS2 Directive?
Yes. Enable it and the Monitor suggests Official Journal of the European Union as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the NIS2 Directive?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Directive (EU) 2022/2555. Editions were last verified in August 2026, and the Monitor records new publications as they appear.