NIS2: EU cyber-security requirements that reach Ukrainian suppliers

Who NIS2 applies to

The directive covers 18 sectors: energy, transport, banking, health, digital infrastructure, cloud and managed services, data centres, digital providers and more. A Ukrainian company is usually not directly in scope, but Article 21(2)(d) requires NIS2 entities to manage supply-chain risk — so your European customers must assess you and put requirements into the contract.

Ukraine is also aligning its legislation with NIS2 as part of EU integration, so the requirements are gradually becoming national.

The 10 measures of Article 21

1. Risk analysis and information-system security policies
2. Incident handling
3. Business continuity, backups, disaster recovery, crisis management
4. Supply-chain security
5. Security in acquisition, development and maintenance, vulnerability handling
6. Assessing the effectiveness of measures
7. Cyber hygiene and training
8. Cryptography and encryption
9. HR security, access control, asset management
10. Multi-factor authentication and secured communications

All ten map directly to ISO 27001:2022 controls and the SOC 2 criteria. If you already hold one of them, the NIS2 dossier comes together quickly.

Incident reporting

NIS2 introduces three-stage reporting: an early warning within 24 hours, an incident notification within 72 hours, a final report within one month. Your NIS2-entity customers will pass these deadlines on to you as a supplier. We build a procedure that can meet them and test it with exercises.