NIS 2: secure what you exchange with your clients and suppliers too.
The NIS 2 Directive extends cybersecurity obligations to thousands of organizations. It covers your systems, but also your exchanges: with your suppliers, your partners, and the authorities.
- Text
- Directive (EU) 2022/2555
- Transposition
- Due from Member States by October 17, 2024; in France, the bill is still in progress
- Authority in France
- ANSSI, the National Cybersecurity Agency of France
- Penalties
- Up to €10 million or 2% of worldwide turnover (essential entities)
01Who is concerned
Essential and important entities in 18 sectors.
As a rule, medium and large companies (50 employees or more, or more than €10 million in turnover) in the sectors listed by the directive, and some entities regardless of their size.
Sectors of high criticality
Energy, transport, banking, financial market infrastructures, health, drinking water and waste water, digital infrastructure, managed ICT services, public administration, space.
Other critical sectors
Postal services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles), digital providers, research.
Essential and important entities
The same security obligations, but stronger supervision and penalties for essential entities.
02What the text requires
What the directive requires.
Risk-management measures, accountable management, and fast incident reporting.
Accountable management
Management bodies approve the measures, oversee their implementation, follow training, and can be held liable.
Article 20Risk-management measures
Risk analysis, incident handling, business continuity and crisis management, supply chain security, cryptography, access control, multi-factor authentication, training.
Article 21The supply chain
Assess the security of your suppliers and service providers, and address it in your contractual relationships.
Article 21Report significant incidents
An early warning within 24 hours, an incident notification within 72 hours, a final report within one month.
Article 23
03Your document exchanges
Where your document exchanges come in.
NIS 2 talks about systems, but much of the work is done in documents.
- Gathering security certificates, policies, and questionnaires from dozens of suppliers, and chasing the ones who do not answer.
- Sharing sensitive documents with service providers without exposing them as attachments.
- Showing who had access to what, and when, during an audit or after an incident.
- Keeping crisis procedures within reach on the day your usual tools are not.
04What Nestor brings
What Nestor brings.
Nestor helps you meet certain requirements: traceability, access control, hosting in France. Compliance remains your organization's responsibility.
- Your need
Assess your suppliers
A campaign sends the same questionnaire and the same document requests to every supplier, each in their own space, with automatic reminders and tracking supplier by supplier.
Learn more - Your need
Secure exchanges
One space per file, reserved for invited people, with permissions set space by space.
Learn more - Your need
Control access
Two-factor authentication with a passkey, SSO with SAML 2.0 or OpenID Connect, a choice of sign-in methods.
Learn more - Your need
Keep a trail
The activity log of each space, campaign, and portal, exportable as CSV.
Learn more - Your need
Assess Nestor, your supplier
Nestor is pursuing ISO/IEC 27001:2022 certification; the documents of this process are available on request.
Learn more - Your need
Keep going during a crisis
Coming soonComing soon: the Safe Room, a crisis space you can reach from a browser when your usual tools stop responding.
Learn more
05Frequently asked questions
Frequently asked questions
Does Nestor make me NIS 2 compliant?
No. NIS 2 covers your entire risk management. Nestor helps with one part: the security and traceability of document exchanges, the assessment of your suppliers, access control. Compliance remains your organization's responsibility.
Does NIS 2 already apply in France?
The directive was due to be transposed by October 17, 2024. In France, transposition goes through the bill on the resilience of critical infrastructure and the strengthening of cybersecurity (projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité). Check MonEspaceNIS2, the ANSSI website, for the status of the obligations.
I am a bank: NIS 2 or DORA?
For financial entities, DORA takes precedence over NIS 2 for ICT risk management and incident reporting, as a sector-specific act.
Sources and related pages
These pages are for information only and do not replace legal advice.
Suppliers to assess for NIS 2?
Tell us how many service providers you track and what you ask them for, and we will show you the matching campaign.
- Fully sovereign European hosting
- No account to create for the people you work with