NIS2 has gone from distant EU law to everyday Danish reality: the act is in force, the registration deadline has passed, and supervision is under way.
Even so, many businesses are still unsure whether they are covered, what the requirements actually mean, and where to start. This guide brings it all together with references to the official sources, so you can use it as a working document and not just as reading material.
Shortcut: If you would rather have the requirements solved than read about them, see our complete programme for NIS2 and DORA compliance, or look up the short definition in the glossary.
What is NIS2?
NIS2 is the EU directive on network and information security, Directive (EU) 2022/2555 of 14 December 2022, which replaces the original NIS Directive from 2016. The directive sets binding requirements for cybersecurity and risk management in businesses and organisations within 18 critical sectors, including energy, transport, health, food, digital infrastructure and manufacturing.
Covered entities must, among other things, carry out systematic risk management, handle supplier security, report significant incidents to the authorities within fixed deadlines (first warning within 24 hours) and anchor accountability with management, which can be held liable if it fails.
In Denmark, the directive has been implemented through the NIS2 Act, which entered into force on 1 July 2025, with registration and supervision handled by Styrelsen for Samfundssikkerhed (the Danish Agency for Civil Protection) and the sector authorities. Non-compliance can trigger fines of up to EUR 10 million or 2 % of global annual turnover.
NIS2 vs. the old NIS Directive
The original NIS Directive from 2016 only applied to a narrow group of operators of essential services and selected digital service providers.
NIS2 repeals the old directive and expands it on three decisive points: far more sectors and company sizes are covered, the requirements are more concrete and consistent across the EU, and enforcement now has teeth in the form of fixed fine levels and direct management accountability.
Where NIS1 could in practice be handled as an IT task in the operations department, NIS2 is designed as a management matter: it is management that must approve risk management, oversee it and answer for it to the supervisory authorities.
Who is covered by NIS2?
The directive covers 18 sectors split across two annexes: Annex I with sectors of high criticality (including energy, transport, banking, health, drinking water, waste water, digital infrastructure and public administration) and Annex II with other critical sectors (including postal services, waste management, chemicals, food, manufacturing of critical products and digital providers).
The act divides covered entities into essential and important entities based on criticality and size:
- The general rule for coverage is that your business operates in one of the 18 sectors and is medium-sized or larger: at least 50 employees or an annual turnover and balance sheet above EUR 10 million.
- Essential entities are typically the large players in the Annex I sectors: at least 250 employees or more than EUR 50 million in turnover and more than EUR 43 million in balance sheet, plus, among others, government authorities and entities covered by the CER Directive.
- There are exceptions both ways: certain entities are covered regardless of size (for example parts of the digital infrastructure), and municipalities and regions can be covered for selected activities.
The requirements for the two categories are essentially the same, but the category determines how supervision is carried out and how large the fines can be.
Then there is the point many overlook: the supply chain. Even if your business is not directly covered, your customers may be, and they must set security requirements for their suppliers. NIS2 therefore reaches much further than the list of registered entities.
If you are in doubt, Styrelsen for Samfundssikkerhed has published guidance on the scope, and MI Support IT helps with the clarification as the first step in a NIS2 compliance programme.
The concrete requirements in NIS2
Risk management: ten minimum measures
The core of NIS2 is the requirement for appropriate and proportionate technical, operational and organisational measures. The directive lists ten minimum areas that must be covered as a minimum, including:
- Policies for risk analysis and information security
- Incident handling, from detection to reporting
- Business continuity: backup, disaster recovery and crisis management
- Supplier security across the entire supply chain
- Security in development and maintenance, including vulnerability handling
- Encryption and procedures for assessing the effectiveness of the measures
- Basic cyber hygiene and training for employees and management
- Access control, MFA and secured communication
The structure resembles a classic information security management system. If you already work according to ISO 27001 or similar, you are well on your way, and the rest is documented IT security in operations.
Management accountability
Management must approve the risk management measures, oversee their implementation and take cybersecurity training themselves. Accountability cannot be delegated away to the IT department or a supplier: in the event of non-compliance, management can be held liable. This is the biggest cultural change in NIS2, and in practice the one that moves the most, because it forces security up to executive and board level.
Incident reporting: 24 hours, 72 hours, one month
Significant incidents must be reported in three steps with fixed deadlines (Article 23 of the directive):
- Early warning without undue delay and in any event within 24 hours of the business becoming aware of the incident.
- Incident notification without undue delay and within 72 hours, with an assessment of the nature, severity and impact of the incident.
- Final report no later than one month after the incident notification, with a detailed description, the cause, the remediation and any cross-border impact.
In Denmark, notifications are submitted through the shared digital entry point on Virk.dk. The deadlines are short enough that they must be rehearsed in advance: without a tested contingency plan you spend the first 24 hours on panic instead of on warning and containment.
Supplier management
You must manage security in your supply chain: assess your suppliers' security level, set requirements in contracts and follow up. Conversely, this also means that your own customers will set the same requirements for you, and that documentable security is becoming a condition of sale in B2B, exactly as seen with DORA in the financial sector.
Deadlines and Danish implementation
The EU deadline for national transposition was 17 October 2024, with application from 18 October 2024 (Article 41 of the directive). Denmark was delayed: the NIS2 Act (Act no. 434 of 6 May 2025, lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau, the Act on measures to ensure a high level of cybersecurity) was adopted on 29 April 2025 and entered into force on 1 July 2025.
From that date the requirements apply, regardless of when registration was completed. Sector-specific rules may also be laid down in executive orders from the sector authorities, so always check the current rules for your specific sector with Styrelsen for Samfundssikkerhed and in the legal text on Retsinformation (the official Danish legal information database).
Registration and supervision
Covered entities must register themselves. The framework is as follows:
- Registration is done via a digital form on virk.dk with login via MitID Erhverv (the Danish business digital ID).
- The deadline was 1 October 2025. If your business becomes covered later, you must register it no later than two weeks after it becomes subject to the act, and changes to the information must be submitted within three months.
- Registration includes, among other things, the entity's name, sector and subsector, contact details, IP information and the EU countries where you provide services.
- Supervision is handled by the sector authorities, with Styrelsen for Samfundssikkerhed (samsik.dk) as the central authority. The agency has published guidance on, among other things, the scope, the cybersecurity measures, incident notification and the role of management.
If you have missed the registration deadline, the right response is not to wait, but to register the business and get started on compliance: the requirements have applied since 1 July 2025.
How to get started: checklist
- Clarify coverage: match your activities against Annexes I and II and the size requirements, and determine whether your business is an essential or important entity.
- Register the business on virk.dk if you are covered and have not already done so.
- Anchor accountability in management: appoint owners, put cybersecurity on the agenda and plan management's own training.
- Run a gap analysis against the ten minimum measures, for example as an IT security check with prioritised findings.
- Close the technical gaps: MFA everywhere, patch management, endpoint protection and tested backup.
- Write and rehearse the contingency plan, so the 24-hour warning can be met in practice. You can use the contingency plan template as a starting point.
- Get your suppliers under control: map critical suppliers, set requirements in contracts and document the follow-up.
- Build documentation into operations: policies, an annual cycle and reporting, so compliance can be demonstrated continuously rather than reconstructed before an audit. See also the glossary overview of IT compliance.
NIS2 vs. DORA
The two regulations share a purpose, but not a form: NIS2 is a directive that covers 18 sectors and has been transposed into Danish law, while DORA is a regulation aimed at the financial sector, which applies directly in all EU countries and has applied since 17 January 2025.
For financial entities, DORA is the specific rule that takes precedence over the general requirements of NIS2 within its area.
If you are a bank or a pension company, DORA is your primary framework; if you are, for example, a food or manufacturing business, it is NIS2. If you work in both worlds, for example as an IT supplier, the full programme is described under NIS2 and DORA compliance.
NIS2 FAQ
Who is covered by NIS2?
Businesses and organisations in 18 critical sectors (Annexes I and II of the directive), as a general rule from medium size: at least 50 employees or an annual turnover and balance sheet above EUR 10 million. Essential entities are typically the large players in the sectors of high criticality (at least 250 employees or more than EUR 50 million in turnover), and certain entities are covered regardless of size.
If your customers are covered, they must set security requirements for you as a supplier, even if you are not required to register yourself.
What are the NIS2 requirements?
Ten minimum measures for risk management, including policies for risk analysis, incident handling, business continuity with backup and crisis management, supplier security, encryption, access control with MFA and training for employees and management. On top of that come management accountability, registration with the authorities and incident reporting in three steps: early warning within 24 hours, incident notification within 72 hours and a final report no later than one month after.
When does NIS2 enter into force in Denmark?
The NIS2 Act (Act no. 434 of 6 May 2025) entered into force on 1 July 2025, and the requirements have applied since then. The registration deadline with Styrelsen for Samfundssikkerhed via virk.dk was 1 October 2025; if you become covered later, you must register the business no later than two weeks after. The EU deadline for national transposition was originally 17 October 2024, which Denmark therefore missed.
How large are the fines under NIS2?
The directive requires that essential entities can be fined up to at least EUR 10 million or at least 2 % of total global annual turnover, whichever is higher. For important entities, the ceiling is at least EUR 7 million or at least 1.4 %. On top of that come orders and, as a last resort, management liability.
What should you do first?
Clarify coverage, register the business, and then run a gap analysis against the ten minimum requirements, so you get a prioritised plan instead of a gut feeling. The work on risk management and documentation takes months, not weeks, so the most important decision is to get started.
How MI Support IT helps
NIS2 turned into concrete, documented IT operations: that is what MI Support IT helps with. The programme consists of clarifying coverage, a gap analysis via an IT security check, implementation of the technical controls, an IT contingency plan that has been rehearsed in practice, and ongoing IT security with documentation built in.
The full programme is described under NIS2 and DORA compliance, and you are always welcome to contact us for a no-obligation assessment of where you stand.
Sources
- The NIS2 Directive, Directive (EU) 2022/2555 (EUR-Lex): Article 23 (incident reporting), Article 34 (fines), Article 41 (transposition deadline)
- The NIS2 Act, Act no. 434 of 6 May 2025 (Retsinformation)
- Styrelsen for Samfundssikkerhed: NIS 2, including registration and the agency's NIS 2 guidance
