The EU's NIS2 Directive is changing how organizations think about cybersecurity. Unlike GDPR, which focuses on protecting personal data, NIS2 is designed to strengthen the resilience of critical and important organizations against cyber threats. It raises the baseline for cybersecurity across Europe by requiring organizations to implement stronger security measures, improve governance, and report significant incidents.

For many organizations, cloud services are central to daily operations. Whether you're storing sensitive files, collaborating with external partners, or managing business-critical information, the cloud provider you choose can play an important role in supporting your NIS2 compliance efforts.

Who does NIS2 apply to?

Security and risk management requirements under NIS2

NIS2 adopts a risk-based approach to cybersecurity. Rather than prescribing specific technologies, it requires organisations to implement measures that are appropriate for their risk profile and operations.

Risk management

Organisations must identify, assess, and manage cybersecurity risks that could affect their systems, services, and data. This includes understanding where sensitive information resides, who has access to it, and how it is shared both internally and externally.

Supply-chain security

One of the most significant additions under NIS2 is its focus on supplier and third-party risk. Organisations are expected to evaluate the security practices of software vendors, cloud providers, contractors, and other service providers that support critical business operations. Using a cloud provider does not eliminate responsibility for protecting sensitive information.

Incident response and business continuity

Organisations must be prepared to detect, respond to, and recover from cyber incidents. This includes having documented incident response plans, clear escalation procedures, defined responsibilities, and tested recovery processes. Business continuity planning is equally important to ensure critical services remain available during a disruption.

Access control and asset management

Knowing what assets need protection is fundamental to cybersecurity. Organisations should maintain visibility of their systems and ensure employees, partners, and contractors can access only the information necessary for their role. Granular access controls become particularly important when sensitive information is shared through cloud platforms.

Encryption techniques to safeguard data 

To comply with NIS2, organizations must ensure their workplace encryption methods offer a robust defense against cyber threats and breaches.

Reporting and governance obligations under NIS2

NIS2 is not only about implementing technical security controls. It also introduces significant governance responsibilities.

Cybersecurity is now a leadership responsibility

One of the biggest changes introduced by NIS2 is increased management accountability. Senior leadership and boards are expected to actively oversee cybersecurity risk management rather than treating cybersecurity as solely an IT responsibility. This includes:

• Approving cybersecurity measures
• Overseeing implementation
• Ensuring sufficient resources are allocated to resilience initiatives
• Understanding how cyber risks could affect business operations

Incident reporting requirements

When a significant cybersecurity incident occurs, organisations must notify the appropriate national authorities within required timeframes. Although implementation details vary slightly between Member States, reporting typically includes:

• An initial early warning after a significant incident is detected
• A more detailed notification as investigations progress

• A final report outlining the incident's cause, impact, response actions, and lessons learned 

Effective reporting requires organisations to have visibility into incidents, clear internal escalation processes, and documented response procedures.

Demonstrating compliance

NIS2 is not simply about having security measures in place. Organisations should also be able to demonstrate that those measures are functioning effectively. This may include maintaining:

• Security policies
• Risk assessments
• Incident response documentation
• Training records
• Supplier security reviews
• Audit logs and activity records

What should organisations look for in cloud services under NIS2?

Choosing a cloud provider should involve more than evaluating storage capacity or productivity features. Organisations should consider whether providers support their security, governance, and compliance obligations.

End-to-end encryption

Encryption plays a key role in protecting sensitive information under NIS2. However, not all encryption approaches provide the same level of protection. Many cloud services encrypt data while it is stored and transmitted, but some providers may still retain the technical ability to access the content. End-to-end encryption adds an additional layer of protection by ensuring that only authorised users can decrypt and access files. This becomes especially important when sharing confidential documents with customers, suppliers, regulators, auditors, or external partners.

Granular access controls

Administrators should be able to define who can access information, from which devices, and under which conditions.

Audit trails and activity monitoring

Comprehensive activity logs should be available to help organisations investigate incidents, demonstrate accountability, and support compliance requirements.

Centralised security policy management

Consistent enforcement of security policies helps reduce risk across teams and locations. Features such as multi-factor authentication requirements, sharing restrictions, and device controls can help strengthen organisational resilience.

Secure external collaboration

Many cyber risks emerge when information leaves organisational boundaries. Cloud platforms should enable employees to securely share information with customers, suppliers, auditors, and partners without resorting to unsecured file-sharing tools or email attachments.

Resilience and recovery capabilities

Organisations should understand how providers approach backup, redundancy, incident response, and disaster recovery to support continuity requirements.

How NIS2 relates to DORA and the Critical Entities Resilience Directive

NIS2 forms part of a broader EU resilience framework. The Critical Entities Resilience (CER) Directive focuses on protecting organisations from a wide range of operational and physical threats. Meanwhile, the Digital Operational Resilience Act (DORA) establishes specific resilience requirements for financial institutions and their ICT providers.

Together, these frameworks encourage organisations to strengthen risk management, improve incident preparedness, and build resilience against disruption.

NIS2 compliance is about resilience

NIS2 represents a shift from reactive cybersecurity toward organizational resilience.

Rather than focusing solely on preventing attacks, the directive encourages organizations to understand their risks, strengthen governance, secure their supply chains, and prepare for incidents before they occur.

Cloud services are only one piece of that puzzle, but they are an important one. Choosing a provider with strong security controls, transparent operational practices, and features that support secure collaboration can help organizations build a stronger cybersecurity foundation while simplifying day-to-day security management.

Ultimately, NIS2 compliance is not about finding a cloud provider that promises compliance. It's about selecting technology that enables your organization to manage cyber risks effectively, demonstrate accountability, and remain resilient in an increasingly complex threat landscape.