{"id":19353,"date":"2025-03-06T14:00:41","date_gmt":"2025-03-06T13:00:41","guid":{"rendered":"https:\/\/edorteam.com\/nis2-regulations-obligations-and-requirements-for-companies\/"},"modified":"2026-05-04T17:34:32","modified_gmt":"2026-05-04T15:34:32","slug":"nis2-regulations-obligations-and-requirements-for-companies","status":"publish","type":"page","link":"https:\/\/nova.edorteam.com\/en\/nis2-regulations-obligations-and-requirements-for-companies\/","title":{"rendered":"NIS2 Regulations: Obligations and requirements for companies"},"content":{"rendered":"

NIS2 Regulations: Is your company prepared to comply with the European directive?<\/h2>\n<\/div><\/div>

The NIS2 Directive requires companies in essential sectors<\/strong> to adopt advanced protection and risk management measures. In Spain, this means that thousands of companies must adapt to new requirements<\/strong> for security, risk management, and incident reporting. <\/p>\n<\/div><\/div>

NIS2-required companies<\/a><\/div>
We help you comply with NIS2<\/a><\/div><\/div>
\"NIS2<\/span><\/div><\/div><\/div><\/div>
\"NIS2<\/span><\/div>

Organizations included in these categories must implement new security measures and prepare for strict cybersecurity audits to comply with the NIS2 Regulations.<\/h3>\n<\/div><\/div>
<\/div><\/div><\/div>

Which companies must comply with the NIS2 Regulations?<\/h2>\n

NIS2 expands the scope of the previous regulations (NIS1), including more sectors and companies. There are two main categories of affected entities:<\/p>\n<\/div><\/div><\/div><\/div>

High-criticality sectors<\/h3>\n

Companies with more than 250 employees<\/strong> or an annual turnover exceeding 50 million euros<\/strong> that operate in critical sectors:<\/p>\n

\u26a1 Energy<\/p>\n

\ud83c\udfe6 Banking and financial infrastructures<\/p>\n

\ud83c\udfe5 Healthcare sector<\/p>\n

\ud83d\ude86 Transportation<\/p>\n

\ud83d\udce1 Digital infrastructure<\/p>\n

\ud83d\udca7 Drinking water and sanitation<\/p>\n

\ud83c\udfdb Public administration<\/p>\n

\ud83d\udedc ICT service providers<\/p>\n

\ud83d\ude80 Space<\/p>\n<\/div><\/div><\/div>

Other critical sectors (NIS2 expansion)<\/h3>\n

Companies with more than 50 employees<\/strong> or revenues exceeding 10 million euros<\/strong>, operating in strategic sectors such as:<\/p>\n

\ud83d\udd2c Research and development<\/p>\n

\ud83e\uddea Chemical industry<\/p>\n

\ud83c\udf7d Food production and distribution<\/p>\n

\ud83d\udce6 Postal and courier services<\/p>\n

\ud83d\udcbb Digital service providers<\/p>\n

\ud83c\udfed Industrial manufacturing<\/p>\n

\u267b\ufe0f Waste management<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div>

Obligations of the NIS2 Regulations for companies<\/h2>\n<\/div><\/div>

Failure to comply with the regulations may result in fines of up to 10 million euros or 2% of global turnover,<\/strong> whichever is greater.<\/p>\n<\/div><\/div><\/div>

\uf002<\/span><\/span><\/div>

Cybersecurity risk management in the company<\/h3>

Identification and mitigation of digital threats.<\/p>\n<\/div><\/div><\/div><\/div>

\uf110<\/span><\/span><\/div>

Continuity and recovery plan<\/h3>

Implementation of backups and disaster recovery protocols.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

\uf0c1<\/span><\/span><\/div>

Supply chain protection<\/h3>

Risk assessment with suppliers and third parties.<\/p>\n<\/div><\/div><\/div><\/div>

\uf577<\/span><\/span><\/div>

Access monitoring and control<\/h3>

Security in networks, passwords, and multi-factor authentication.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

\uf0f3<\/span><\/span><\/div>

Cybersecurity incident notification<\/h3>

Mandatory communication of cyberattacks within 24 to 72 hours.<\/p>\n<\/div><\/div><\/div><\/div>

\uf51c<\/span><\/span><\/div>

Cybersecurity training<\/h3>

Training for employees and managers.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div>

Impact of NIS2 on the supply chain<\/h2>\n

The NIS2 Directive has a direct or indirect impact on most companies. If your company belongs to one of the critical sectors mentioned above, even if it has fewer than 50 employees, you will likely need to adapt<\/strong> due to your business relationships with customers or suppliers who are subject to the regulations. <\/p>\n<\/div><\/div>

\u27a1\ufe0f Companies with direct impact<\/h3>

If your company meets any of these conditions, you must comply with the requirements of NIS2:<\/p>\n

\u2714 More than 50 employees<\/strong> and a turnover exceeding 10 million euros<\/strong>.
\u2714 Belonging to a strategic or critical sector in cybersecurity<\/strong> (energy, transport, healthcare, banking, etc.).
\u2714 Dependence on digital infrastructures and essential services<\/strong>.<\/p>\n<\/div><\/div><\/div><\/div>

\ud83d\udd17 Companies with indirect impact (supply chain)<\/h3>

If you work with companies that must comply with NIS2 (suppliers, partners, customers in regulated sectors), it is possible that:<\/p>\n