Guides
NIS2 and vulnerability management
What the NIS2 directive asks about vulnerabilities, what it means in practice and where a service that tells you every day which ones matter can help.
Who it applies to
Directive (EU) 2022/2555, known as NIS2, requires Member States to impose cybersecurity measures on “essential” and “important” entities in many sectors, including energy, transport, banking, health, water, digital infrastructure, managed services, public administration, postal services, waste, chemicals, food, manufacturing, digital providers and research. It generally covers medium-sized and large companies; some entities are in scope whatever their size.
Member States had to transpose it by 17 October 2024 and apply it from 18 October 2024. Each does so with its own law, and it is the national law that says who is in scope, how to register and by when: check with your national authority.
What it asks about vulnerabilities
- Risk-management measures (Article 21): technical, operational and organisational, appropriate and proportionate. The minimum measures include security in the acquisition, development and maintenance of systems, “including vulnerability handling and disclosure”, together with supply chain security and basic cyber hygiene practices.
- Management responsibility (Article 20): management bodies approve the measures, oversee their implementation and follow training.
- Reporting of significant incidents (Article 23): an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month of the notification.
- European vulnerability database (Article 12): ENISA maintains it, with the description of vulnerabilities, the affected products, their severity and the available fixes.
- Fines (Article 34): maximums of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and of at least EUR 7 million or 1.4% for important ones; whichever is higher applies.
For some digital entities (cloud and data centre services, managed and managed security services, DNS, domain registries, content delivery networks, online marketplaces, search engines, social networks, trust services) Implementing Regulation (EU) 2024/2690 goes into detail, including on security patch management and vulnerability handling.
What it means in practice
The directive does not say which tools to use, nor does it set a deadline for each fix: it asks for measures proportionate to the risk, and for being able to show them. This usually means:
- knowing which systems and products you use, and which are exposed to the internet;
- keeping informed every day, from reliable sources, about the vulnerabilities that affect them;
- having a priority criterion (exploitation, exposure, severity) and response times;
- keeping track of decisions: fixed, mitigated in another way or risk accepted;
- assigning responsibilities and involving management.
Where DefenceLevel helps
- Every day at 05:00 UTC, only the vulnerabilities that matter, with the level, the affected products, the fixed versions and what to do; an immediate alert at DEFCON 1 and 2.
- My Defence: you map your infrastructure, zone by zone, with the products you use, and receive alerts and briefings only on those.
- The briefing archive, in the dashboard: what was known and when, to document decisions.
DefenceLevel does not make an organisation compliant with NIS2 and does not replace risk analysis, internal procedures or the advice of a consultant: it is one of the sources for knowing, every day, which vulnerabilities matter.
Frequently asked questions
Is my company in scope of NIS2?
It depends on the sector and the size, under the law of your country. Your national authority publishes the criteria and the registration instructions.
Does NIS2 require a threat intelligence service?
No. It asks for vulnerabilities to be handled with appropriate measures; where the information comes from is up to the organisation.
How quickly must a vulnerability be fixed?
The directive does not set deadlines for fixes: it asks for timing proportionate to the risk. Vulnerabilities actively exploited on exposed systems come first; the guide on CVSS, EPSS and KEV explains how to set an order.
Must an attack that succeeded through a vulnerability be reported?
If it is a significant incident, yes: early warning within 24 hours, notification within 72 hours and final report within one month, to the national authority or CSIRT.