The NIS2 Directive: A Plain-English Guide for Business Leaders

The NIS2 Directive is the European Union’s updated framework for cybersecurity obligations across member states. It came into force in January 2023 and required EU member states, including Malta, to transpose it into national law by October 2024. For many organisations, it represents the most significant expansion of cybersecurity compliance obligations they have faced.

This guide is written for business leaders and decision-makers, not technical specialists. It explains what NIS2 is, which organisations it applies to, what those organisations are required to do, and what the consequences of non-compliance look like. It also identifies practical steps organisations can take now to begin closing any gaps.

What NIS2 Is and Why It Exists

The original Network and Information Security (NIS) Directive was adopted in 2016 and represented the EU’s first binding piece of legislation on cybersecurity. It required operators of essential services and digital service providers to implement appropriate security measures and report significant incidents to national authorities.

NIS2 replaces and substantially expands that original framework. The revision was driven by two realities: the threat landscape had changed dramatically since 2016, and the original directive had been implemented inconsistently across member states, creating an uneven level of protection across the single market.

The core logic of NIS2 is simple: more organisations, in more sectors, must take cybersecurity seriously and be held accountable when they do not. It shifts the framing from cybersecurity as an IT concern to cybersecurity as a board-level governance responsibility.

Which Organisations Are Affected

NIS2 significantly broadens the scope of the original directive. It introduces two categories of regulated entities.

Essential entities are organisations in sectors considered critical to society and the economy. These include energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, and space.

Important entities cover a wider range of sectors, including postal and courier services, waste management, chemical manufacturing, food production, general manufacturing of critical equipment, digital providers (online marketplaces, search engines, social networks), and research organisations.

The thresholds for inclusion are primarily size-based. In most cases, organisations with 50 or more employees and an annual turnover or balance sheet of at least EUR 10 million fall within scope. However, size alone does not determine scope; certain organisations are included regardless of size if they are the sole provider of a service in a member state, or if their disruption could have a significant impact on public safety or the economy.

If your organisation sits in any of these sectors and meets the size threshold, you should treat NIS2 as applicable to you and seek legal or compliance advice on your specific obligations under Maltese transposing legislation.

What NIS2 Requires Organisations to Do

NIS2 imposes obligations across two broad areas: risk management and incident reporting.

Cybersecurity risk management requires organisations to implement appropriate and proportionate technical and organisational measures to manage the risks posed to their network and information systems. The directive specifies a minimum set of measures that must be addressed, including:

• Policies on risk analysis and information system security
• Incident handling procedures
• Business continuity and crisis management planning
• Supply chain security: assessing the security practices of suppliers and service providers
• Secure system acquisition, development, and maintenance
• Policies on the use of cryptography and encryption where appropriate
• Human resources security, access control, and asset management
• Multi-factor authentication and continuous authentication solutions where relevant

Importantly, NIS2 holds senior management personally accountable for approving and overseeing the implementation of these measures. Boards and executives cannot delegate cybersecurity compliance entirely to technical staff, they are required to understand the measures in place and the risks their organisation faces.

Incident reporting requires organisations to notify the competent national authority of significant incidents within strict timeframes. An early warning must be issued within 24 hours of becoming aware of an incident, a more detailed notification within 72 hours, and a full incident report within one month. A significant incident is one that causes or could cause serious operational disruption or financial loss, or that affects other natural or legal persons.

Consequences of Non-Compliance

NIS2 provides for substantially higher penalties than its predecessor. For essential entities, fines can reach EUR 10 million or 2% of global annual turnover, whichever is higher. For important entities, the ceiling is EUR 7 million or 1.4% of global annual turnover.

Beyond financial penalties, the directive allows national authorities to issue binding instructions, suspend certifications, and, in cases involving essential entities, temporarily prohibit individuals from holding managerial positions. The reputational and operational consequences of a significant incident that is mishandled or unreported are compounding factors.

Practical Steps Towards Compliance

The most common mistake organisations make when approaching NIS2 is treating it as a documentation exercise. Compliance is not achieved by writing policies, it requires implementing controls, testing them, and maintaining an ongoing posture of risk management.

A realistic starting point is a gap assessment: an honest evaluation of where your organisation currently stands against the requirements listed above. This covers your existing security controls, your incident response capability, your supply chain security practices, and the governance structures around cybersecurity at board level.

From a tooling perspective, two areas are consistently underdeveloped in organisations beginning their compliance journey.

The first is vulnerability management and network visibility. Cerbeyra provides compliance-oriented tooling that supports continuous vulnerability assessment, giving organisations a clear and current picture of their exposure. Understanding what vulnerabilities exist in your environment is a prerequisite for managing them.

The second is network security controls. WatchGuard provides enterprise-grade firewall, endpoint, and multi-factor authentication solutions that directly address several of the technical measures NIS2 requires, network segmentation, access control, and threat detection among them.

4TFront distributes both platforms and can support organisations in understanding how they map to NIS2’s technical requirements. Our role is not to provide legal compliance advice, that belongs with qualified legal and compliance practitioners, but we can help you assess your current security posture and identify the technical gaps that need to be addressed.

Start the Conversation Now

NIS2 is not a future consideration, transposition deadlines have passed and national enforcement frameworks are operational. Organisations that have not yet begun their compliance assessment are already behind.

Contact the 4TFront team for a cybersecurity consultation. We work with organisations across Malta to assess their current environment and identify the solutions and practices that close compliance gaps. Reach us via our contact page, email sales@4tfront.com, or call +356 2124 8205.