{"id":20600,"date":"2024-02-06T09:54:14","date_gmt":"2024-02-06T09:54:14","guid":{"rendered":"https:\/\/www.stroople.com\/?page_id=20600"},"modified":"2026-08-16T13:49:11","modified_gmt":"2026-08-16T13:49:11","slug":"nis2","status":"publish","type":"page","link":"https:\/\/www.stroople.com\/fr\/nis2\/","title":{"rendered":"Directive sur la s\u00e9curit\u00e9 des r\u00e9seaux et de l'information"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"20600\" class=\"elementor elementor-20600\" wpc-filter-elementor-widget=\"1\" data-elementor-post-type=\"page\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5e9913e elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"5e9913e\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9101229 syd-sticky-section-no\" data-id=\"9101229\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-376932b syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"376932b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a99eaf9 elementor-section-height-min-height elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-items-middle syd-sticky-section-no\" data-id=\"a99eaf9\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-b33a692 syd-sticky-section-no\" data-id=\"b33a692\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-18c6573 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"18c6573\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Network and Information Security (NIS2) Directive<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8047f07 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"8047f07\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Cybersecurity is no longer a technical decision. It&#8217;s a governance one.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cd4d8d8 elementor-align-center elementor-widget__width-auto syd-sticky-section-no elementor-widget elementor-widget-button\" data-id=\"cd4d8d8\" data-element_type=\"widget\" data-e-type=\"widget\" data-no-translation=\"\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>.elementor-element-cd4d8d8{display:none !important}<\/style>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f7af98 elementor-align-center elementor-widget__width-auto syd-sticky-section-no elementor-widget elementor-widget-button\" data-id=\"8f7af98\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/www.stroople.com\/contact\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Talk to an expert<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-0794805 syd-sticky-section-no\" data-id=\"0794805\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-73e4b66 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"73e4b66\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-023ae3e syd-sticky-section-no\" data-id=\"023ae3e\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-566bc18 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"566bc18\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-6c4e626 syd-sticky-section-no\" data-id=\"6c4e626\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5066b73 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"5066b73\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Is NIS2?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5f5c40 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"c5f5c40\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d2d1ab4 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"d2d1ab4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj?locale=fr\"><strong>NIS2 (Directive (EU) 2022\/2555)<\/strong><\/a> is the EU directive that sets a common cybersecurity baseline for essential and important entities across 18 critical sectors. It replaces the original 2016 NIS Directive and expands its scope roughly tenfold, from around 15,000 entities under NIS1 to an estimated 160,000 across the EU.<\/p><p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">France, like several Member States, has not yet completed its national transposition. National transposition is expected by the end of 2026. The ANSSI nonetheless recommends starting compliance work now: the substance of the requirements is already settled, even where the exact enforcement date isn&#8217;t.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-cbecc22 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"cbecc22\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7e57845 syd-sticky-section-no\" data-id=\"7e57845\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-a49c5b7 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"a49c5b7\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-f74e223 syd-sticky-section-no\" data-id=\"f74e223\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-15ec41f syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"15ec41f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Who is affected?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-02734f9 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"02734f9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f4d4a3d syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"f4d4a3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">NIS2 covers 18 critical sectors, split into two tiers, and applies based on your organisation&#8217;s size within those sectors.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-27507c5 syd-sticky-section-no elementor-widget elementor-widget-html\" data-id=\"27507c5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>\n@keyframes nisFadeIn { from{opacity:0; transform:translateY(4px);} to{opacity:1; transform:translateY(0);} }\n.nis-row { opacity:0; animation:nisFadeIn 0.4s ease-out forwards; }\n.nis-card { opacity:0; animation:nisFadeIn 0.5s ease-out forwards; }\n@media (prefers-reduced-motion: reduce) {\n  .nis-row, .nis-card { animation:none !important; opacity:1 !important; }\n}\n<\/style>\n\n<div style=\"background:#ffffff; padding:8px; max-width:900px; margin:0 auto;\">\n\n<div style=\"display:grid; grid-template-columns:repeat(auto-fit, minmax(320px, 1fr)); gap:40px; margin-bottom:40px;\">\n\n<div>\n<p style=\"color:#09025F; font-size:15px; font-weight:700; margin:0 0 4px;\">Highly critical sectors<\/p>\n<p style=\"color:#999; font-size:11px; margin:0 0 16px;\">Annex I \u2014 11 sectors<\/p>\n<div style=\"display:flex; flex-direction:column; gap:9px;\">\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.05s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Energy<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.1s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Transport<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.15s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Banking<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.2s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Financial market infrastructures<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.25s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Health<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.3s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Drinking water<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.35s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Waste water<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.4s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Digital infrastructure<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.45s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">ICT service management (B2B)<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.5s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Public administration<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.55s;\"><span style=\"width:8px; height:8px; background:#00A7C4; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Space<\/span><\/div>\n<\/div>\n<\/div>\n\n<div>\n<p style=\"color:#09025F; font-size:15px; font-weight:700; margin:0 0 4px;\">Other critical sectors<\/p>\n<p style=\"color:#999; font-size:11px; margin:0 0 16px;\">Annex II \u2014 7 sectors<\/p>\n<div style=\"display:flex; flex-direction:column; gap:9px;\">\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.05s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Postal and courier services<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.1s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Waste management<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.15s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Chemicals<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.2s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Food production and distribution<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.25s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Manufacturing<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.3s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Digital providers<\/span><\/div>\n<div class=\"nis-row\" style=\"display:flex; align-items:center; gap:10px; animation-delay:0.35s;\"><span style=\"width:8px; height:8px; background:#09025F; flex-shrink:0;\"><\/span><span style=\"font-size:13px; color:#333;\">Research<\/span><\/div>\n<\/div>\n<\/div>\n\n<\/div>\n\n<div style=\"border-top:1px solid #eee; padding-top:32px;\">\n<p style=\"color:#09025F; font-size:15px; font-weight:700; margin:0 0 20px;\">Size determines your obligations<\/p>\n\n<div style=\"display:grid; grid-template-columns:repeat(auto-fit, minmax(240px, 1fr)); gap:20px;\">\n\n<div class=\"nis-card\" style=\"border-left:3px solid #00A7C4; padding:4px 0 4px 16px; animation-delay:0.1s;\">\n<p style=\"font-size:12px; color:#999; margin:0 0 4px;\">250+ employees or \u20ac50M+ turnover<\/p>\n<p style=\"font-size:15px; font-weight:700; color:#09025F; margin:0 0 6px;\">Large entities<\/p>\n<p style=\"font-size:12.5px; color:#666; margin:0;\">Generally classified as essential entities, the strictest supervision tier.<\/p>\n<\/div>\n\n<div class=\"nis-card\" style=\"border-left:3px solid #00A7C4; padding:4px 0 4px 16px; animation-delay:0.2s;\">\n<p style=\"font-size:12px; color:#999; margin:0 0 4px;\">50 to 250 employees or \u20ac10M to \u20ac50M turnover<\/p>\n<p style=\"font-size:15px; font-weight:700; color:#09025F; margin:0 0 6px;\">Medium entities<\/p>\n<p style=\"font-size:12.5px; color:#666; margin:0;\">Generally classified as important entities, with lighter obligations.<\/p>\n<\/div>\n\n<div class=\"nis-card\" style=\"border-left:3px solid #ccc; padding:4px 0 4px 16px; animation-delay:0.3s;\">\n<p style=\"font-size:12px; color:#999; margin:0 0 4px;\">Under 50 employees<\/p>\n<p style=\"font-size:15px; font-weight:700; color:#666; margin:0 0 6px;\">Small entities<\/p>\n<p style=\"font-size:12.5px; color:#666; margin:0;\">Generally out of scope, except for specific sectors regardless of size.<\/p>\n<\/div>\n\n<\/div>\n<\/div>\n\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a416a77 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"a416a77\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0ee59dc syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"0ee59dc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Estimates for France range from roughly 10,000 to 18,000 entities, essential and important combined. Check your own eligibility directly on ANSSI&#8217;s registration portal, <a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/monespacenis2.cyber.gouv.fr\/\">MonEspaceNIS2<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f879f6 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"8f879f6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-15b114d syd-sticky-section-no elementor-widget elementor-widget-html\" data-id=\"15b114d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>\n.nis-cta-banner {\n  background:#04C0CE;\n  color:#ffffff !important;\n  transition: background-color 0.25s ease, color 0.25s ease;\n}\n.nis-cta-banner:hover {\n  background:#ffffff;\n  color:#09025F !important;\n}\n<\/style>\n\n<div style=\"background:#ffffff; padding:40px 32px; max-width:420px; margin:0 auto; border-radius:8px; overflow:hidden;\">\n\n<p style=\"color:#09025F; font-size:24px; font-weight:700; text-align:center; margin:0 0 28px;\">Identify if you're affected<\/p>\n\n<p style=\"color:#09025F; font-size:16px; text-align:center; margin:0 0 32px;\">Visit <a href=\"https:\/\/monespacenis2.cyber.gouv.fr\" style=\"color:#09025F; text-decoration:underline;\">monespacenis2.cyber.gouv.fr<\/a><\/p>\n\n<div style=\"text-align:center; margin:0 0 32px;\">\n<img decoding=\"async\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/ANSSI.png\" alt=\"ANSSI, French National Cybersecurity Agency\" style=\"width:180px; height:auto; max-width:100%;\">\n<\/div>\n\n<\/div>\n\n<a href=\"https:\/\/www.stroople.com\/contact-stroople-cybersecurity\/\" class=\"nis-cta-banner\" style=\"color:#ffffff; display:block; text-align:center; padding:22px 24px; font-size:17px; font-weight:700; text-decoration:none; max-width:420px; margin:0 auto;\">\nTalk to an expert to assess whether your company is affected\n<\/a>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<div class=\"elementor-element elementor-element-ee8648c syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"ee8648c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a0ba7b syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"6a0ba7b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-af03780 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"af03780\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-180eeef syd-sticky-section-no\" data-id=\"180eeef\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-665e660 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"665e660\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-c917263 syd-sticky-section-no\" data-id=\"c917263\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-612f6ef syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"612f6ef\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Sanctions and personal liability<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7d5e4ea syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"7d5e4ea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c21372 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"9c21372\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Non-compliance carries serious consequences. Essential entities face fines of up to \u20ac10 million or 2% of worldwide annual turnover, whichever is higher. Important entities face up to \u20ac7 million or 1.4%.<\/p><p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Beyond the financial penalty, NIS2 introduces personal liability for management bodies: executives can be held accountable for failing to implement adequate risk-management measures, including a duty to approve and oversee cybersecurity measures under Article 20.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4f00b5f elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"4f00b5f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ebe8829 syd-sticky-section-no\" data-id=\"ebe8829\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-9c631b0 elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"9c631b0\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-9a38945 syd-sticky-section-no\" data-id=\"9a38945\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-80e8308 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"80e8308\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The baseline measures NIS2 requires<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-be52141 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"be52141\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-82cdee1 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"82cdee1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Article 21 sets out ten categories of minimum security measures every essential and important entity must implement: risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in system acquisition and development, policies to assess the effectiveness of measures, basic cyber hygiene and training, cryptography and encryption, human resources security and access control, and the use of multi-factor authentication.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3529af0 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"3529af0\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e2449a9 syd-sticky-section-no\" data-id=\"e2449a9\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-3131b0b elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"3131b0b\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-979907c syd-sticky-section-no\" data-id=\"979907c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3c73443 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"3c73443\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">France's technical reference: the ReCyF<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-895ffd8 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"895ffd8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-338f6f5 syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"338f6f5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Ahead of the law&#8217;s final adoption, the ANSSI published a technical reference, the <a href=\"https:\/\/messervices.cyber.gouv.fr\/nis2#exigences\"><strong>R\u00e9f\u00e9rentiel Cyber France (ReCyF)<\/strong><\/a>: 20 security objectives for essential entities, 15 for important entities, organised around four pillars: Governance, Protection, Defence and Resilience. It isn&#8217;t legally binding yet, but it is already the de facto benchmark auditors and clients use to judge readiness.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-08a3b44 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"08a3b44\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9040b1a syd-sticky-section-no\" data-id=\"9040b1a\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-246f37e elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"246f37e\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-a8e891f syd-sticky-section-no\" data-id=\"a8e891f\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-721ac58 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"721ac58\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How our four practices answer NIS2<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c86bd25 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"c86bd25\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-18f92cd syd-sticky-section-no elementor-widget elementor-widget-text-editor\" data-id=\"18f92cd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ul><li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Governance<\/strong> \u2192 <strong><a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/governance-and-risk-compliance\/\">Cyber Advisory &amp; GRC<\/a> <\/strong>\u2014 CISO as a Service and a governance framework that satisfies Article 20&#8217;s management training and oversight duties.<\/li><li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Protection<\/strong> \u2192 <strong><a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/offensive-security\/\">Offensive Security<\/a><\/strong> \u2014 penetration testing and vulnerability management that directly fulfil Article 21(2)(e)&#8217;s obligation to test the effectiveness of your security measures.<\/li><li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Defence<\/strong> \u2192 <strong><a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/managed-cyber-defense\/\">Managed Cyber Defense<\/a> <\/strong>\u2014 24\/7 detection and response, covering the continuous monitoring and incident notification duties of Articles 21 and 23.<\/li><li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Resilience<\/strong> \u2192 <a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/cyber-crisis-management\/\"><strong>Cyber Crisis Management<\/strong><\/a> \u2014 crisis plans and exercises that satisfy Article 21&#8217;s business continuity requirement.<\/li><\/ul><p>Two further obligations run across all four: <strong><a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/ict-third-party-risk-management\/\">ICT Third-Party Risk Management<\/a><\/strong> answers Article 21(2)(d)&#8217;s supply chain security requirement, and <strong><a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"https:\/\/www.stroople.com\/cybersecurity-training\/\">Training<\/a><\/strong> answers Article 21(2)(g)&#8217;s staff cyber hygiene obligation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9496f63 ha-card--top ha-card--tablet-top ha-card--mobile-top syd-sticky-section-no elementor-widget elementor-widget-ha-card happy-addon ha-card\" data-id=\"9496f63\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ha-card.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n\t\t\t\t\t<figure class=\"ha-card-figure\">\n\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg\" class=\"attachment-full size-full wp-image-29117\" alt=\"European Parliament in Strasbourg, home of the NIS2 directive\" srcset=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg 640w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive-300x200.jpg 300w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive-18x12.jpg 18w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive-230x153.jpg 230w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive-350x234.jpg 350w, https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive-480x320.jpg 480w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/>\t\t\t\t\t\t\t\t\t<div class=\"ha-badge ha-badge--top-right\">White paper<\/div>\n\t\t\t\t\t\t\t<\/figure>\n\t\t\n\t\t<div class=\"ha-card-body\">\n\n\t\t\t<h2 class=\"ha-card-title\">Practical Guide to NIS2<\/h2>\n\t\t\t\t\t\t\t<div class=\"ha-card-text\">\n\t\t\t\t\t<p>Gain the clarity and perspective you need.\n\n\n\n\n\n\n<\/p>\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t<a class=\"ha-btn\" href=\"https:\/\/www.stroople.com\/nis2-compliance-guide\/\"><span class=\"ha-btn-text\">Download<\/span><\/a>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0f47a5 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"f0f47a5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-67b8cdf elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"67b8cdf\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-bb371a7 syd-sticky-section-no\" data-id=\"bb371a7\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4eabcde ha-layout-block ha-align-left syd-sticky-section-no elementor-widget elementor-widget-ha-advanced-heading happy-addon ha-advanced-heading happy-addon-pro\" data-id=\"4eabcde\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ha-advanced-heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n\t\t<h2 class=\"ha-advanced-heading-tag\">\n\t\t\t\t\t\t<div class=\"ha-advanced-heading-wrap\" data-background-text=\"FAQ\">\n\t\t\t\t<span class=\"ha-advanced-heading-before\"><\/span>\n\t\t\t\t<span class=\"ha-advanced-heading-center\">Questions<\/span>\n\t\t\t\t<span class=\"ha-advanced-heading-after\"><\/span>\n\t\t\t\t<span class=\"ha-advanced-heading-border\"><\/span>\n\t\t\t<\/div>\n\t\t\t\t\t<\/h2>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-d3152ee syd-sticky-section-no\" data-id=\"d3152ee\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7dbb927 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"7dbb927\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Frequently Asked Questions<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3194195 syd-sticky-section-no elementor-widget elementor-widget-heading\" data-id=\"3194195\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">General questions about regulatory compliance<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fab6237 ha-accordion--icon-right syd-sticky-section-no elementor-widget elementor-widget-ha-accordion happy-addon ha-accordion happy-addon-pro\" data-id=\"fab6237\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"ha-accordion.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t        <div class=\"ha-accordion__wrapper\" role=\"tablist\">\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2621\" class=\"ha-accordion__item-title\" data-tab=\"1\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2621\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">What is NIS2?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2621\" class=\"ha-accordion__item-content\" data-tab=\"1\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2621\">\n                        <p>NIS2 is the EU directive (2022\/2555) that sets a common cybersecurity baseline for essential and important entities across 18 critical sectors, replacing the original 2016 NIS Directive with a far broader scope and stricter enforcement.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2622\" class=\"ha-accordion__item-title\" data-tab=\"2\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2622\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">Who is affected by NIS2?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2622\" class=\"ha-accordion__item-content\" data-tab=\"2\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2622\">\n                        <p>Organisations operating in one of NIS2&#8217;s 18 critical sectors, above the size thresholds, broadly 50 or more employees or \u20ac10 million or more in annual turnover, plus a small number of entities subject regardless of size. Check your own eligibility on ANSSI&#8217;s <a href=\"https:\/\/beta.gouv.fr\/startups\/nis2.html\"><strong>MonEspaceNIS2 portal<\/strong><\/a>.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2623\" class=\"ha-accordion__item-title\" data-tab=\"3\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2623\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">How can I determine whether my company, which operates in several countries, particularly across Europe, may fall within the scope of NIS2 in some or all European countries?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2623\" class=\"ha-accordion__item-content\" data-tab=\"3\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2623\">\n                        <p data-start=\"179\" data-end=\"415\">The rules determining whether an entity falls within the scope of NIS2 are intended to be consistent across countries. It is therefore very likely that an entity will be subject to the Directive in all countries where it is established.<\/p><p data-start=\"417\" data-end=\"731\" data-is-last-node=\"\" data-is-only-node=\"\">Under Article 26, each entity is subject to the legislation of the country in which it is established, except for specific cases concerning digital services, telecommunications, and public administration. Applicability will therefore depend on the nature of the establishments operating in the different countries.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2624\" class=\"ha-accordion__item-title\" data-tab=\"4\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2624\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">To be subject to the regulation, is it necessary to meet all the criteria (company size\/revenue + sector), or can the size\/revenue criterion alone be sufficient?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2624\" class=\"ha-accordion__item-content\" data-tab=\"4\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2624\">\n                        <p data-start=\"179\" data-end=\"415\">The companies concerned are subject to the regulation when they meet the criteria defining them as medium-sized or large enterprises (in most cases) <strong data-start=\"316\" data-end=\"323\">and<\/strong> operate in one of the sectors listed in the annexes to the European legislation. Regarding the size and revenue criteria, both must be met cumulatively.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2625\" class=\"ha-accordion__item-title\" data-tab=\"5\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2625\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">How is NIS2 different from DORA?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2625\" class=\"ha-accordion__item-content\" data-tab=\"5\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2625\">\n                        <p>NIS2 applies broadly across 18 critical sectors, while DORA applies specifically to financial entities and their ICT providers. A financial institution can fall under both at once, and where they do, the two sets of obligations overlap substantially, particularly on incident reporting and third-party risk.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2626\" class=\"ha-accordion__item-title\" data-tab=\"6\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2626\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">What technical measures does NIS2 require, and do they differ between essential and important entities?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2626\" class=\"ha-accordion__item-content\" data-tab=\"6\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2626\">\n                        <p>Article 21 sets ten categories of measures for both tiers, covering risk analysis, incident handling, business continuity, supply chain security, secure system development, effectiveness testing, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. The categories are identical, but the expected depth isn&#8217;t: essential entities face stricter supervision, while important entities can prioritise progressively. In France, ANSSI&#8217;s ReCyF reflects this directly, 20 security objectives for essential entities, 15 for important entities.<\/p>                    <\/div>\n                <\/div>\n                            <div class=\"ha-accordion__item\">\n                    <div id=\"ha-accordion__item-title-2627\" class=\"ha-accordion__item-title\" data-tab=\"7\" role=\"tab\" aria-controls=\"ha-accordion__item-content-2627\">\n                                                    <span class=\"ha-accordion__item-icon ha-accordion__icon\" aria-hidden=\"true\">\n                                                                    <span class=\"ha-accordion__icon--closed\"><i class=\"fas fa-angle-right\"><\/i><\/span>\n                                                                                                    <span class=\"ha-accordion__icon--opened\"><i class=\"fas fa-angle-down\"><\/i><\/span>\n                                                            <\/span>\n                                                <div class=\"ha-accordion__item-title-inner\">\n                                                        <span class=\"ha-accordion__item-title-text\">Does NIS2 change what I need to require contractually from subcontractors and subsidiaries?<\/span>\n                        <\/div>\n                    <\/div>\n                    <div id=\"ha-accordion__item-content-2627\" class=\"ha-accordion__item-content\" data-tab=\"7\" role=\"tabpanel\" aria-labelledby=\"ha-accordion__item-title-2627\">\n                        <p>Yes, on both counts. Under Article 21(2)(d), outsourcing a function never transfers your own compliance liability, French courts have already confirmed that a regulated entity remains fully responsible for its subcontractors&#8217; security failures. In practice, this makes the wording of your security clauses matter: vague references to &#8220;applicable standards and international usages&#8221; have already been challenged in French courts, providers have been ordered to pay damages for breaching explicit secure-development clauses, and courts have separately treated cybersecurity as an implicit essential quality of an IT contract even without one. For groups, NIS2 applies subsidiary by subsidiary and activity by activity, never automatically at group level: one subsidiary can fall into scope while another, in the same group, doesn&#8217;t.<\/p>                    <\/div>\n                <\/div>\n                    <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-913d201 elementor-section-stretched elementor-section-boxed elementor-section-height-default elementor-section-height-default syd-sticky-section-no\" data-id=\"913d201\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;stretch_section&quot;:&quot;section-stretched&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e01ca67 syd-sticky-section-no\" data-id=\"e01ca67\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b60dc3e syd-sticky-section-no elementor-widget elementor-widget-html\" data-id=\"b60dc3e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"NIS2 is the EU directive (2022\/2555) that sets a common cybersecurity baseline for essential and important entities across 18 critical sectors, replacing the original 2016 NIS Directive with a far broader scope and stricter enforcement.\"}},{\"@type\":\"Question\",\"name\":\"Who is affected by NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Organisations operating in one of NIS2's 18 critical sectors, above the size thresholds, broadly 50 or more employees or \u20ac10 million or more in annual turnover, plus a small number of entities subject regardless of size. Check your own eligibility on ANSSI's MonEspaceNIS2 portal.\"}},{\"@type\":\"Question\",\"name\":\"How can I determine whether my company, which operates in several countries, particularly across Europe, may fall within the scope of NIS2 in some or all European countries?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"NIS2's scoping rules are meant to be applied uniformly, so an entity is likely to fall under the directive in every country where it's established. Under Article 26, each entity is generally subject to the national law of the country where it operates, with specific exceptions for digital infrastructure, telecoms and public administration providers, which can be centralised under the law of a single Member State.\"}},{\"@type\":\"Question\",\"name\":\"To be subject to the regulation, is it necessary to meet all the criteria (company size\/revenue + sector), or can the size\/revenue criterion alone be sufficient?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Both criteria have to be met together. An organisation falls under NIS2 only if it operates in one of the 18 sectors listed in Annexes I and II and meets the relevant size threshold; meeting the size threshold alone, outside one of those sectors, doesn't bring an organisation into scope.\"}},{\"@type\":\"Question\",\"name\":\"How is NIS2 different from DORA?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"NIS2 applies broadly across 18 critical sectors, while DORA applies specifically to financial entities and their ICT providers. A financial institution can fall under both at once, and where they do, the two sets of obligations overlap substantially, particularly on incident reporting and third-party risk.\"}},{\"@type\":\"Question\",\"name\":\"What technical measures does NIS2 require, and do they differ between essential and important entities?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Article 21 sets ten categories of measures for both tiers, covering risk analysis, incident handling, business continuity, supply chain security, secure system development, effectiveness testing, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. The categories are identical, but the expected depth isn't: essential entities face stricter supervision, while important entities can prioritise progressively. In France, ANSSI's ReCyF reflects this directly, 20 security objectives for essential entities, 15 for important entities.\"}},{\"@type\":\"Question\",\"name\":\"Does NIS2 change what I need to require contractually from subcontractors and subsidiaries?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, on both counts. Under Article 21(2)(d), outsourcing a function never transfers your own compliance liability, French courts have already confirmed that a regulated entity remains fully responsible for its subcontractors' security failures. In practice, this makes the wording of your security clauses matter: vague references to applicable standards and international usages have already been challenged in French courts, providers have been ordered to pay damages for breaching explicit secure-development clauses, and courts have separately treated cybersecurity as an implicit essential quality of an IT contract even without one. For groups, NIS2 applies subsidiary by subsidiary and activity by activity, never automatically at group level: one subsidiary can fall into scope while another, in the same group, doesn't.\"}}]}<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba3d53e syd-sticky-section-no elementor-widget elementor-widget-html\" data-id=\"ba3d53e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Qu'est-ce que NIS2 ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"NIS2 est la directive europ\u00e9enne (2022\/2555) qui fixe un socle commun de cybers\u00e9curit\u00e9 pour les entit\u00e9s essentielles et importantes r\u00e9parties sur 18 secteurs critiques, rempla\u00e7ant la directive NIS de 2016 par un p\u00e9rim\u00e8tre bien plus large et une application plus stricte.\"}},{\"@type\":\"Question\",\"name\":\"Qui est concern\u00e9 par NIS2 ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Les organisations op\u00e9rant dans l'un des 18 secteurs critiques de NIS2, au-del\u00e0 des seuils de taille, g\u00e9n\u00e9ralement 50 salari\u00e9s ou 10 millions d'euros de chiffre d'affaires annuel, ainsi qu'un nombre restreint d'entit\u00e9s soumises quelle que soit leur taille. V\u00e9rifiez votre propre \u00e9ligibilit\u00e9 sur le portail MonEspaceNIS2 de l'ANSSI.\"}},{\"@type\":\"Question\",\"name\":\"Comment savoir si ma soci\u00e9t\u00e9, pr\u00e9sente dans plusieurs pays notamment en Europe, pourrait entrer dans le p\u00e9rim\u00e8tre d'application de NIS2 dans certains ou tous les pays europ\u00e9ens ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Les r\u00e8gles de qualification de NIS2 se veulent uniformes, il est donc probable qu'une entit\u00e9 soit soumise \u00e0 la directive dans chacun des pays o\u00f9 elle est \u00e9tablie. Selon l'article 26, chaque entit\u00e9 rel\u00e8ve en principe de la l\u00e9gislation du pays o\u00f9 elle est \u00e9tablie, avec des exceptions sp\u00e9cifiques pour les prestataires d'infrastructure num\u00e9rique, de t\u00e9l\u00e9communications et d'administration publique, qui peuvent \u00eatre centralis\u00e9s sous la loi d'un seul \u00c9tat membre.\"}},{\"@type\":\"Question\",\"name\":\"Pour \u00eatre soumis \u00e0 la r\u00e9glementation, faut-il cumuler tous les crit\u00e8res (taille\/chiffre d'affaires et secteur), ou le seul crit\u00e8re de taille\/chiffre d'affaires peut-il suffire ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Les deux crit\u00e8res doivent \u00eatre r\u00e9unis ensemble. Une organisation rel\u00e8ve de NIS2 uniquement si elle op\u00e8re dans l'un des 18 secteurs list\u00e9s aux annexes I et II et qu'elle atteint le seuil de taille correspondant. Atteindre seul le seuil de taille, en dehors de l'un de ces secteurs, ne suffit pas \u00e0 entrer dans le p\u00e9rim\u00e8tre.\"}},{\"@type\":\"Question\",\"name\":\"En quoi NIS2 diff\u00e8re-t-elle de DORA ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"NIS2 s'applique largement \u00e0 18 secteurs critiques, tandis que DORA vise sp\u00e9cifiquement les entit\u00e9s financi\u00e8res et leurs prestataires TIC. Une institution financi\u00e8re peut relever des deux \u00e0 la fois, et lorsque c'est le cas, les deux ensembles d'obligations se recoupent largement, notamment sur la notification des incidents et la gestion des risques tiers.\"}},{\"@type\":\"Question\",\"name\":\"Quelles mesures techniques NIS2 exige-t-elle, et diff\u00e8rent-elles entre entit\u00e9s essentielles et importantes ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"L'article 21 fixe dix cat\u00e9gories de mesures pour les deux niveaux : analyse des risques, gestion des incidents, continuit\u00e9 d'activit\u00e9, s\u00e9curit\u00e9 de la cha\u00eene d'approvisionnement, d\u00e9veloppement s\u00e9curis\u00e9 des syst\u00e8mes, \u00e9valuation de l'efficacit\u00e9 des mesures, hygi\u00e8ne cyber et formation, cryptographie, contr\u00f4le d'acc\u00e8s et gestion des actifs, authentification \u00e0 plusieurs facteurs. Les cat\u00e9gories sont identiques, mais pas le niveau d'exigence attendu : les entit\u00e9s essentielles font l'objet d'une supervision plus stricte, tandis que les entit\u00e9s importantes peuvent prioriser progressivement. En France, le ReCyF de l'ANSSI refl\u00e8te directement cette diff\u00e9rence, avec 20 objectifs de s\u00e9curit\u00e9 pour les entit\u00e9s essentielles et 15 pour les entit\u00e9s importantes.\"}},{\"@type\":\"Question\",\"name\":\"NIS2 change-t-elle ce que je dois exiger contractuellement de mes sous-traitants et de mes filiales ?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Oui, sur les deux plans. Au titre de l'article 21(2)(d), externaliser une fonction ne transf\u00e8re jamais votre propre responsabilit\u00e9 de conformit\u00e9, les tribunaux fran\u00e7ais ont d\u00e9j\u00e0 confirm\u00e9 qu'une entit\u00e9 r\u00e9gul\u00e9e reste pleinement responsable des manquements de s\u00e9curit\u00e9 de ses sous-traitants. En pratique, cela rend la formulation de vos clauses de s\u00e9curit\u00e9 d\u00e9terminante : des r\u00e9f\u00e9rences vagues \u00e0 des normes standards et usages internationaux ont d\u00e9j\u00e0 \u00e9t\u00e9 contest\u00e9es devant les tribunaux fran\u00e7ais, des prestataires ont \u00e9t\u00e9 condamn\u00e9s \u00e0 des dommages-int\u00e9r\u00eats pour manquement \u00e0 une clause explicite de d\u00e9veloppement s\u00e9curis\u00e9, et les tribunaux ont par ailleurs trait\u00e9 la cybers\u00e9curit\u00e9 comme une qualit\u00e9 essentielle implicite d'un contrat informatique, m\u00eame en l'absence de clause. Pour les groupes, NIS2 s'applique filiale par filiale et activit\u00e9 par activit\u00e9, jamais automatiquement au niveau du groupe : une filiale peut entrer dans le p\u00e9rim\u00e8tre pendant qu'une autre, au sein du m\u00eame groupe, en reste exclue.\"}}]}<\/script>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6761058 syd-sticky-section-no elementor-widget elementor-widget-spacer\" data-id=\"6761058\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Network and Information Security (NIS2) Directive Cybersecurity is no longer a technical decision. It&#8217;s a governance one. Talk to an expert What [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":29117,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-20600","page","type-page","status-publish","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Network and Information Security Directive - Stroople<\/title>\n<meta name=\"description\" content=\"NIS2 directive: 18 critical sectors, one governance decision. See how Stroople turns compliance into a structured, audit-ready programme.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.stroople.com\/fr\/nis2\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Network and Information Security Directive - Stroople\" \/>\n<meta property=\"og:description\" content=\"NIS2 directive: 18 critical sectors, one governance decision. See how Stroople turns compliance into a structured, audit-ready programme.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.stroople.com\/fr\/nis2\/\" \/>\n<meta property=\"og:site_name\" content=\"Stroople\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-16T13:49:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"427\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Stroople1\" \/>\n<meta name=\"twitter:label1\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/\",\"name\":\"Network and Information Security Directive - Stroople\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/european-parliament-strasbourg-nis2-directive.jpg\",\"datePublished\":\"2024-02-06T09:54:14+00:00\",\"dateModified\":\"2026-08-16T13:49:11+00:00\",\"description\":\"NIS2 directive: 18 critical sectors, one governance decision. See how Stroople turns compliance into a structured, audit-ready programme.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/european-parliament-strasbourg-nis2-directive.jpg\",\"contentUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/european-parliament-strasbourg-nis2-directive.jpg\",\"width\":640,\"height\":427,\"caption\":\"European Parliament in Strasbourg, home of the NIS2 directive\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/nis2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.stroople.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Network and Information Security Directive\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#website\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/\",\"name\":\"Stroople\",\"description\":\"Cybersecurity Expertise\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.stroople.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#organization\",\"name\":\"Stroople Cybersecurity\",\"alternateName\":\"Stroople\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Logo-Stroople-responsive.png\",\"contentUrl\":\"https:\\\/\\\/www.stroople.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Logo-Stroople-responsive.png\",\"width\":1000,\"height\":1000,\"caption\":\"Stroople Cybersecurity\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stroople.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Stroople1\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/stroople\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC_kTnaswN04kjIrHU0Pi_qg\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Directive sur la S\u00e9curit\u00e9 des R\u00e9seaux et de l'Information - Stroople","description":"Directive NIS2 : 18 secteurs critiques, une seule d\u00e9cision de gouvernance. D\u00e9couvrez comment Stroople transforme la conformit\u00e9 en un programme structur\u00e9 et pr\u00eat pour l'audit.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.stroople.com\/fr\/nis2\/","og_locale":"fr_FR","og_type":"article","og_title":"Network and Information Security Directive - Stroople","og_description":"NIS2 directive: 18 critical sectors, one governance decision. See how Stroople turns compliance into a structured, audit-ready programme.","og_url":"https:\/\/www.stroople.com\/fr\/nis2\/","og_site_name":"Stroople","article_modified_time":"2026-08-16T13:49:11+00:00","og_image":[{"width":640,"height":427,"url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@Stroople1","twitter_misc":{"Dur\u00e9e de lecture estim\u00e9e":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.stroople.com\/nis2\/","url":"https:\/\/www.stroople.com\/nis2\/","name":"Directive sur la S\u00e9curit\u00e9 des R\u00e9seaux et de l'Information - Stroople","isPartOf":{"@id":"https:\/\/www.stroople.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.stroople.com\/nis2\/#primaryimage"},"image":{"@id":"https:\/\/www.stroople.com\/nis2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg","datePublished":"2024-02-06T09:54:14+00:00","dateModified":"2026-08-16T13:49:11+00:00","description":"Directive NIS2 : 18 secteurs critiques, une seule d\u00e9cision de gouvernance. D\u00e9couvrez comment Stroople transforme la conformit\u00e9 en un programme structur\u00e9 et pr\u00eat pour l'audit.","breadcrumb":{"@id":"https:\/\/www.stroople.com\/nis2\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.stroople.com\/nis2\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stroople.com\/nis2\/#primaryimage","url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg","contentUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/08\/european-parliament-strasbourg-nis2-directive.jpg","width":640,"height":427,"caption":"European Parliament in Strasbourg, home of the NIS2 directive"},{"@type":"BreadcrumbList","@id":"https:\/\/www.stroople.com\/nis2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.stroople.com\/"},{"@type":"ListItem","position":2,"name":"Network and Information Security Directive"}]},{"@type":"WebSite","@id":"https:\/\/www.stroople.com\/#website","url":"https:\/\/www.stroople.com\/","name":"Stroople","description":"Expertise en cybers\u00e9curit\u00e9","publisher":{"@id":"https:\/\/www.stroople.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.stroople.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.stroople.com\/#organization","name":"Stroople Cybers\u00e9curit\u00e9","alternateName":"Stroople","url":"https:\/\/www.stroople.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stroople.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/05\/Logo-Stroople-responsive.png","contentUrl":"https:\/\/www.stroople.com\/wp-content\/uploads\/2026\/05\/Logo-Stroople-responsive.png","width":1000,"height":1000,"caption":"Stroople Cybersecurity"},"image":{"@id":"https:\/\/www.stroople.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Stroople1","https:\/\/www.linkedin.com\/company\/stroople\/","https:\/\/www.youtube.com\/channel\/UC_kTnaswN04kjIrHU0Pi_qg"]}]}},"_links":{"self":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/pages\/20600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/comments?post=20600"}],"version-history":[{"count":47,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/pages\/20600\/revisions"}],"predecessor-version":[{"id":29234,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/pages\/20600\/revisions\/29234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/media\/29117"}],"wp:attachment":[{"href":"https:\/\/www.stroople.com\/fr\/wp-json\/wp\/v2\/media?parent=20600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}