NIS2 Directive
Cybersecurity with personal board liability
The NIS2 Directive requires essential and important entities to implement comprehensive cybersecurity measures, including supply chain risk management and 24-hour incident reporting. Management bears personal liability for non-compliance.
€10M or 2% global annual turnover (essential entities). Personal liability for management.
What It Requires
Cyber risk management measures (Art. 21)
Incident reporting within 24 hours
Supply chain security due diligence
Regular and targeted security audits
Access control and encryption
What Happens If Not Compliant
Fines up to €10M or 2% of global turnover. Personal liability for management. Mandatory security audits and compliance orders from national authorities.
How Arctura Solves It
L5 Governance Add-On: dedicated MCP endpoint, policy controls, audit trail, SIEM export, EU-only deployment. Provides board-level evidence of compliance.
This page provides general information about NIS2 Directive (EU 2022/2555) requirements. It does not constitute legal advice. Consult a qualified cybersecurity compliance specialist for guidance specific to your organization.