NIS2 · Directive (EU) 2022/2555 · applies across the European Union

NIS2: security monitoring and incident reporting are now a management responsibility

NIS2 is the EU cybersecurity directive that replaced NIS. Organisations in scope have to manage cyber risk, monitor their systems, detect incidents and report them within fixed deadlines. Each member state implements the directive through its own national law. Check whether NIS2 applies to your organisation and how VIRTUO SOC covers the monitoring and incident side in a single service.

We will help you check whether NIS2 applies to your organisation
We will identify the gaps in monitoring, detection and incident response
We will implement and operate the technical measures that support your NIS2 requirements.

Check whether NIS2 applies to you

16.01.2023

Directive (EU) 2022/2555 entered into force

17.10.2024

Deadline for member states to transpose NIS2 into national law

18.10.2024

National measures apply — duties and deadlines follow your national law

Scope of NIS2

NIS2 reaches far beyond “critical infrastructure”

NIS2 covers many more organisations than the original NIS Directive. It distinguishes two categories — essential entities and important entities — based on the sector listed in Annexes I and II to the directive and on the size of the organisation. Member states may also bring further entities into scope.

Contact

Important entity

Usually medium-sized organisations (from 50 employees, or annual turnover and balance sheet total above EUR 10 million) in sectors such as manufacturing, food, chemicals, digital providers, postal and courier services, waste management or research.

Essential entity

Large organisations (from 250 employees, or turnover above EUR 50 million) and sectors of particular importance: energy, transport, banking and financial market infrastructure, health, drinking water and waste water, digital infrastructure, ICT service management and public administration.

Some organisations are in scope regardless of size — for example DNS service providers, TLD name registries, trust service providers and parts of public administration. Even if NIS2 does not apply to you directly, your clients may pass the requirements down the supply chain. The final classification always follows the national law of the country where you operate.

Talk to a VIRTUO SOC expert

First step

Does NIS2 apply to your organisation?

Before you think about monitoring or documentation, establish whether you are in scope and what your national law asks for. This is how to check it.

Check your sector
Compare what your organisation actually does — not only its registration codes — with the sectors listed in Annex I (essential entities) and Annex II (important entities) to the directive.

Check the size criterion
Check your headcount and financial figures, including linked and partner enterprises. Size usually decides whether you are an essential or an important entity — and some entities are in scope regardless of size.

Check your national implementing law
NIS2 is implemented through national legislation in every member state. Your country’s law sets the registration duties, the competent authority, the CSIRT you report to and the exact deadlines. Poland, for example, implements NIS2 through its KSC Act.
the official EU NIS2 page

Register where required
Many member states require entities in scope to register with the competent authority or the national CSIRT and to keep their contact details up to date. The registration route and the form differ from country to country.

Plan your reporting path
Know in advance who you report to and how: the national CSIRT or competent authority, the 24-hour early warning, the 72-hour notification and the final report. Agreeing this before an incident happens saves hours when it matters.

Not sure where your organisation stands? We will help you work through the scope check and show which technical measures need to be in place.

Full overview of the requirements

Key NIS2 cybersecurity requirements

NIS2 asks for risk-based management of cybersecurity, not for a single system or tool. Article 21 of the directive sets out the minimum measures, and national law may add detail. Below is the full scope, grouped the way it is usually implemented.

Governance

Management approves the cybersecurity risk-management measures and oversees their implementation (Article 20)
Named people responsible for cybersecurity and for contact with the authorities
A decision on the delivery model: an internal team or an external security provider

Risk management and policies

Risk analysis and information system security policies (Article 21(2)(a))
Supply chain security, including requirements for suppliers and service providers (Article 21(2)(d))
Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure (Article 21(2)(e))

Technical measures

Continuous security monitoring of systems, networks and cloud services
Access control, multi-factor authentication, secured communications and cryptography (Article 21(2)(h)–(j))
Asset inventory, endpoint and IT infrastructure protection, and basic cyber hygiene (Article 21(2)(g))

Detection and response

Collection and analysis of threat and vulnerability information
Incident handling: detection, classification, containment and recovery (Article 21(2)(b))
Incident reporting to the competent CSIRT or authority: 24 hours / 72 hours / one month (Article 23)
Business continuity, backup and disaster recovery, and crisis management (Article 21(2)(c))

Documentation and accountability

Security policies, procedures and system documentation
Monitoring reports and incident records that stand up to an audit
Policies and procedures to assess how effective the measures actually are (Article 21(2)(f))

People

Cyber hygiene practices and regular cybersecurity training for staff (Article 21(2)(g))
Cybersecurity training for management, who are accountable under Article 20

Our role

How VIRTUO SOC supports your NIS2 cybersecurity requirements

We help organisations implement cybersecurity measures supporting NIS2 compliance. Here is our contribution in each area.

Governance
we help you check whether and how NIS2 applies to your organisation, and we can act as your external security operations provider — taking over the day-to-day delivery of monitoring, detection and response.
Technical measures
we run continuous security monitoring of your systems, networks and cloud services and keep an up-to-date inventory of the monitored IT assets.
Documentation and accountability
we prepare monthly monitoring reports and incident documentation that your organisation can use as evidence during an audit or an inspection.

Risk management and policies
the choice of safeguards follows from your risk assessment — we deliver the operational side: monitoring, event analysis and support with incident reporting.
Detection and response
we collect threat and vulnerability information, classify events within the agreed SLA and support your team with reports to the competent CSIRT or authority within the deadlines set by your national law.
People
an e-learning cybersecurity programme for teams and dedicated sessions for management, delivered as part of our Cybersecurity Training service.

VIRTUO SOC supports organisations in implementing technical and organisational cybersecurity measures required under NIS2 and applicable national legislation. If you need support beyond monitoring and incident handling, we and our partners can guide your organisation through the wider programme — from the scope assessment to audit preparation.

Our approach

Security measures proportionate to risk — no more than you need

NIS2 itself asks for measures proportionate to the risk, the size of the organisation and the likely impact of an incident. We implement what meets those requirements and stop there — we do not push safeguards that are not justified by your risk or by the law.

Requirements, not overengineering

The service is configured around the measures the directive and your national law actually ask for — not expanded beyond what your risk assessment shows.

Cost aligned with your needs

You pay for safeguards appropriate to the scale and risk of your organisation, not for an entire catalogue of available technologies.

Security proportionate to risk

The choice of technical and organisational measures follows from the risk assessment, not from a predefined “everything at once” checklist.

NIS2 duties and the VIRTUO SOC service

Four NIS2 areas covered directly by VIRTUO SOC

Across the full scope of the directive, monitoring, detection, documentation and incident response are the areas we deliver directly through a single service.

Collection

Article 21(2)(a) and (e)

Collecting and analysing information on cyber threats and vulnerabilities affecting the systems you use to deliver your services.

VIRTUO SOC: a continuous feed of threat and vulnerability data concerning your infrastructure, updated on an ongoing basis.

Detection

Article 21(2)(b)

Detecting and handling security incidents in the systems that support your services.

VIRTUO SOC: continuous monitoring (data collection) across devices, networks and cloud services; identified events are analysed and classified within the agreed SLA.

Documentation

Article 21(2)(f)

Policies and procedures to assess how effective your cybersecurity measures are — which means evidence, not declarations.

VIRTUO SOC: monthly monitoring reports and incident documentation ready for an audit or an inspection.

Response

Article 23

Reporting significant incidents to the competent CSIRT or authority: an early warning within 24 hours, a notification within 72 hours and a final report within one month.

VIRTUO SOC: our analysts classify the incident within the agreed SLA and support your team in preparing the reports within the deadlines set by your national law.

Obligations in practice

When a significant incident happens, every hour counts

NIS2 sets a fixed reporting sequence — the clock starts when you become aware of the incident, not when your IT team has the full picture.

Incident detection and reporting duties apply from day one your organisation is in scope — regardless of how far you have progressed with the remaining measures. Monitoring has to be in place before an incident, not after it.

T + 0

Incident detection

The event is identified and classified as a significant incident based on monitoring and analyst review, within the agreed SLA.

24 h

Early warning

We prepare the data required for the early warning to the competent CSIRT or authority under Article 23 of the directive.

72 h

Incident notification

Support in preparing the full incident notification, including an initial assessment of severity, impact and indicators of compromise.

1 month

Final report

Documentation of the incident, its root cause and the measures applied, ready for the case to be closed.

Which authority receives the reports, in what format, and whether interim reports are required follows the national law that implements NIS2 in your country.

How it works in practice: the monitoring system continuously collects data from your infrastructure. Event analysis, classification and incident response are performed by our team within the SLA agreed with you — not in a fully automated manner.

You do not need to build your own SOC team

Outsourcing under NIS2

NIS2 does not require you to run security operations in-house. The technical measures can be delivered by your own team or by an external provider — but accountability stays with your organisation and its management under Article 20. Some national laws also require you to inform the authority which provider you use.

VIRTUO SOC works as that external provider — we take over the day-to-day delivery of monitoring, detection and response, while decisions about your organisation stay with you.

What is at stake

Missing monitoring and reporting procedures is one of the most common gaps

NIS2 sets maximum administrative fines and makes management accountable for the cybersecurity measures. How supervision and sanctions work in practice follows the national law of the country where you operate.

Essential entity · Article 34(4)

up to EUR 10,000,000 or 2% of worldwide annual turnover

whichever amount is higher.

Important entity · Article 34(5)

up to EUR 7,000,000 or 1.4% of worldwide annual turnover

whichever amount is higher.

Supervisory measures Authorities may also order security audits, issue binding instructions or apply further measures set out in national law.

Management accountability Management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held responsible under Article 20.

Service scope

What exactly do you get from VIRTUO SOC?

One service covering the operational side of NIS2 monitoring and incident duties.

Continuous monitoring (data collection) across devices, networks and cloud services

Incident detection and classification by our team within the agreed SLA

Monthly reports and audit-ready documentation

Collection and analysis of threat and vulnerability information

Support in preparing notifications within 24 hours / 72 hours / one month

Access to a team of analysts during incident handling

Is it worth building this in-house?

In-house NIS2 security operations vs. VIRTUO SOC as a Service

In-house security operations team

Recruiting cybersecurity specialists takes months
Cost of SIEM/EDR licences and monitoring infrastructure
Night and weekend shifts are difficult to staff — while the 24-hour reporting clock never stops
Preparing audit documentation in-house

VIRTUO SOC as a Service

Team and tools ready from day one — no recruitment required
All monitoring tools included in a single subscription
Continuous monitoring with event analysis performed within the agreed SLA
Reports and documentation ready for any inspection or audit

Key dates

Where NIS2 stands today

The milestones of the directive itself. Registration duties, reporting formats and deadlines in your country follow the national law that implements it.

16.01.2023

Directive in force

Directive (EU) 2022/2555 entered into force on 16 January 2023 and replaced the original NIS Directive.

17.10.2024

Transposition deadline

The date by which member states had to transpose NIS2 into national law.

from 18.10.2024

National measures apply

National implementing laws start to apply, with registration, supervision and reporting handled by national authorities.

Ongoing

Check your country

Transposition is at different stages across the EU, so the duties and deadlines that bind you depend on where you operate.

Frequently asked questions

NIS2 questions we hear most often

Check three things: whether your activity falls under a sector listed in Annex I or Annex II to the directive, whether you meet the size criteria (usually from 50 employees or EUR 10 million turnover), and what your national implementing law says — some entities are in scope regardless of size, and member states may add further ones. The section “Does NIS2 apply to your organisation?” above walks through the check step by step.

NIS2 requires measures for incident handling, risk analysis and assessing how effective your safeguards are (Article 21). In practice you cannot detect, classify and report an incident within 24 hours without continuous security monitoring of your systems, networks and cloud services. See also our NIS2 guide, which explains the directive and what it means for companies.

Article 23 sets the sequence: an early warning within 24 hours of becoming aware of a significant incident, a full incident notification within 72 hours and a final report within one month. Your national law designates the CSIRT or authority that receives them and may require interim reports.

They are the two categories of entities under NIS2, set by sector and by the size of the organisation. Essential entities are subject to stricter, proactive supervision and higher maximum fines; important entities are supervised mainly after an incident or a signal of non-compliance.

Yes. NIS2 does not require an in-house SOC — the technical measures can be delivered by an external provider, for example under a SOC as a Service model. Accountability stays with your organisation and its management, and some national laws require you to inform the authority which provider you use.

The directive sets maximum administrative fines: for essential entities up to EUR 10,000,000 or 2% of worldwide annual turnover, whichever is higher; for important entities up to EUR 7,000,000 or 1.4%, whichever is higher. Supervisory powers, procedures and any additional sanctions follow national law.

Yes. Article 21(2)(g) covers cyber hygiene practices and cybersecurity training, and Article 20 requires management to be trained on cybersecurity risk. We deliver this through our Cybersecurity Training.

Contact Us

If you are interested in VIRTUO SOC or would like to learn more, contact our team today. We are ready to provide comprehensive protection against cyber threats and give you peace of mind regarding your IT security.

Contact Form

Use the contact form below. Simply complete the required fields and we will get back to you as soon as possible.

VIRTUO SOC
VIRTUO GROUP Sp. z o.o.
Tytusa Chałubińskiego 9/2,
02-004 Warsaw

Our consultants are available Monday to Friday from 9:00 a.m. to 5:00 p.m. to answer your questions and provide assistance. Feel free to contact us at any time — we are here to help.