NIS2 vs NIS1 what changed in EU cyber compliance

Applies to public or private entities of types listed in Annex I or Annex II that meet the size-cap rule, plus specific regardless-of-size categories and Member State special cases.

Applied to Member State-identified operators of essential services and to digital service providers in the NIS1 service model.

Rerun scoping under NIS2 Article 2 and Article 3; a NIS1 operator designation is useful context but not enough for current classification.

Essential and important entities must act, and their management bodies must approve cybersecurity risk-management measures, oversee implementation, and follow training.

Operators of essential services and digital service providers carried the security and notification duties, while Member States, competent authorities, single points of contact, and CSIRTs ran the national framework.

Add board or management-body ownership to the NIS2 evidence map instead of leaving the program solely with security operations or compliance.

The trigger starts with Annex I or Annex II entity type, medium-sized-or-larger status unless an exception applies, essential or important classification, and any national registration or list process.

The trigger depended on Member State identification of operators of essential services and on whether a provider fell within the NIS1 digital service provider category.

Do not rely on the old national identification process alone; document the current NIS2 sector, size, special-case, and Member State facts.

NIS2 combines governance, Article 21 cybersecurity risk-management measures, Article 23 significant-incident reporting, information-sharing rules, registration duties for specified entities, and supervisory evidence.

NIS1 required appropriate and proportionate technical and organisational security measures and incident notification for operators of essential services and digital service providers.

Map each reused NIS1 control to a specific NIS2 Article 21 item, then separately check Article 20 governance and Article 23 reporting evidence.

Keep Article 2 and Article 3 classification, entity-list or registration details where applicable, Article 20 approvals and training, Article 21 control evidence, Article 23 reports, supplier-risk evidence, and supervision correspondence.

Keep NIS1 national designation records, lists of essential services, security policies, audit evidence, incident notifications, and communications with competent authorities or CSIRTs.

Label each legacy record as reused for a current NIS2 duty, superseded by NIS2, or retained only for historical audit traceability.

Member States had to adopt and publish NIS2 transposition measures by 17 October 2024 and apply them from 18 October 2024. Article 23 uses a 24-hour early warning, 72-hour incident notification, and final-report sequence for significant incidents.

NIS1 required Member States to transpose by 9 May 2018, identify operators of essential services by 9 November 2018, and use national incident-notification rules before repeal.

Close legacy NIS1 deadlines as historical milestones and run current incident clocks against NIS2 Article 23 and national transposition law.

NIS2 gives competent authorities supervisory and enforcement powers for essential and important entities, with proactive-style powers for essential entities and ex post supervision for important entities.

NIS1 gave competent authorities powers to assess operators of essential services and take ex post action for digital service providers, with penalties set through national implementing rules.

Use the current national NIS2 competent authority route for supervision questions and keep NIS1 enforcement material only as background.

NIS2 maps many NIS1 topics forward: security measures, incident notification, competent-authority requests, standards, penalties, and review all have correlation-table links to NIS2 articles.

NIS1 evidence may support continuity because the correlation table links earlier security and notification provisions to NIS2 Article 21 and Article 23.

Reuse older evidence only after confirming the current NIS2 article, national rule, owner, and evidence quality; do not treat correlation as automatic compliance.

For NIS2, write the current sector, entity classification, Member State, national law or authority path, Article 20/21/23 duties, evidence owner, and reassessment trigger.

For NIS1, write what the record proves historically: operator or digital-service-provider status, security measure, incident notification, authority correspondence, or old national deadline.

Close the migration only when every legacy NIS1 item is either remapped to a current NIS2 duty, retained as historical evidence, or removed from the active compliance plan.