The key objectives of the NIS2 Directive are to increase the general level of cybersecurity in the EU by improving risk management practices for entities with critical infrastructure, promoting cooperation between member states, and stricter incident reporting requirements.

The NIS2 Directive applies to all ''important'' and ''essential'' entities that provide services necessary for the normal functioning of the societa, the economy, and the internal market.

The main differences include broader coverage of sectors, defined penalties for non-compliance, introducing new security requirements, strengthened cooperation and incident reporting mechanisms.

The difference between important and essential entities lies primarily in the size of the entity and the impact extent of the incidents on both society and the economy. Delays and disruption within essential entities can lead to greater consequences, including economic instability, threats to public safety as well as significant social disruption. For important entities, althought the impact of these consequences exists, they are signiifcantly less harmful.

Essential entities include all private and public companies operationg in the sectors of energy, transport, banking, financial market infrastructure, healthcare, water and wastewater, digital inrastructure, ICT service management (B2B), space, and the public sector.

Important entities include all private and public companies engaged in postal and courirer services, waste management, chemical manufacturing and distribution, manufacturing (of machinery, medical products, electrical equipment,etc.), food production, processing and distribution, digital services, research, and education.

Not necessarily. An organization that is not within the criteria for the categorization of important and essential entities may still be included:
• if it is the only provider of a services crucial for social or economic activities;
• if a disruption in the provision o services or activities of the entity would have a major impact on public safety, public protection, or public health;
• if a disruption in the provision of services or activities of the subject would cause systemic risks;
• if i is significant for the sector, service, or independent sectors (in the Republic of Croatia).

Essential entities are all organizations that exceed the upper limits for medium-size enterprises. These limits are 250 employees with and annual turnover exceeding 50 million EUR and a balance sheet exceeding 43 million EUR.

Entities subject to special criteria may be categorized as essention even if they don't meet the organization size criteria.

Important entities are all oranizations with 50 to 250 employees and an annual turnover of less than or equal to 50 million EUR and a balance sheet of less than or equal to 43 million EUR or exceeding these tresholdes, and are engaged in important services.
They also include all enitites with 50 to 250 employees, an annual turnover of less than or equal to 50 million EUR, and a balance sheet of less than or equal to 43 million EUR, which are not categorized as significant, but operate in key sectors.
These criteria are not entirely exclusive. Entities subject to specific criteria may be categorised as significant event if they do not meet the criteria for organization size.

In case your organization is categorizes as both important and essential entity, essential entity requirements are applied.

According to the NIS2 directive, all entities are obligated to inform the competent authorities about all incident that affect the continuity of the services they provide.
In the event of an incident, essential and important entities are required to submit an initial notification of the incident with a description of the incident and an assessment of its cross-border impact within 24 hours. Following, within 72 hours, they are required to submit an interim incident report in which they describe the incident, and within 30 days, a final incident report in which they determine the severity and impact of the incident, the type and cause of the threat, the mitigation measures applied, and the cross border impact of the incident.

NIS2 readiness can be assessed by completing the GAP questionnaire to compare the current state of cybersecurity against the requirements within the NIS2 Directive.

The time to reach NIS2 compliace depends on the organization's initial readiness level, size, complexity of operations, and other country specific factors. According to expert estimates, the avearge time to reach full NIS2 compliance for most entities is 12 months.

Fines for essential entities that fail to comply with the directive's requremnts can be up to 10 million EUR, or 2% of global annual revenue, whichever is greater.

Fines for important entities are up to 7 million EUR, or 1.4% of global annual revenue, whichever is greater.