Under NIS2, penalties can be severe. For infringements of certain obligations, Member States must provide for fines of at least up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher.
NIS2 places clear accountability on management bodies: they must approve and oversee the organization’s cybersecurity risk-management measures and can be held liable under national law for relevant infringements.
NIS2 implementation can be fast-tracked if you clearly understand what is required and what is missing. In fact, a quick gap analysis can significantly accelerate the process.