How NIS2 relates to the rules around it: what changed from the first NIS Directive, the Critical Entities Resilience Directive, European cybersecurity certification under the Cybersecurity Act, and the targeted NIS2 amendments proposed in January 2026.
The differences between NIS1 and NIS2: operators of essential services versus a size-cap rule, the sectors added, essential and important entities, management accountability, staged reporting deadlines, fines, supervision and the end of the light-touch regime.
How the CER Directive and NIS2 fit together: critical entities as essential NIS2 entities regardless of size, the 11 CER sectors, identification and resilience deadlines, physical resilience measures, 24-hour incident notification and the carve-out for banking and digital infrastructure.
Where Cybersecurity Act certification fits in NIS2: Member States' power to require certified products, the Commission's delegated act power, the EUCC scheme and assurance levels, certification as a mitigating factor, and the 2026 proposal to certify cyber posture.
What the Commission's January 2026 proposal to amend NIS2 contains: the small mid-cap category, companies affected, simpler jurisdiction rules, ransomware data, ENISA's role, the incident reporting single-entry point, and the transposition period if adopted.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.