{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1","L2/L3 → NIS2 links: implements, explains"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":5,"total":5,"capped":false,"cap":2000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/nis2/map","url":"https://www.headlesslaw.com/nis2/map","title":"Map of the law — NIS2","work_id":"nis2","date_state":"current","as_of":"2026-11-02"},"act":{"work_id":"nis2","name":"NIS2","path":"/nis2","title":"Directive (EU) 2022/2555","celex":"32022L2555"},"as_of":"2026-11-02","date_state":"current","select":null,"selection":null,"filters":{"level":["L2","L3"],"type":["implements","explains"]},"parts":[{"key":"I","name":"Chapter I — General provisions"},{"key":"II","name":"Chapter II — Coordinated cybersecurity regulatory frameworks"},{"key":"III","name":"Chapter III — Cooperation at Union and international level"},{"key":"IV","name":"Chapter IV — Cybersecurity risk-management measures and reporting obligations"},{"key":"V","name":"Chapter V — Jurisdiction and registration"},{"key":"VI","name":"Chapter VI — Information sharing"},{"key":"VII","name":"Chapter VII — Supervision and enforcement"},{"key":"VIII","name":"Chapter VIII — Delegated and implementing acts"},{"key":"IX","name":"Chapter IX — Final provisions"}],"articles":[{"key":"act","kind":"act","label":"Whole act","heading":null,"path":"/nis2","part":"","status_on_date":"anchor","x_index":0},{"key":"recitals","kind":"recitals","label":"Recitals","heading":null,"path":"/nis2/recitals","part":"","status_on_date":"in_force","x_index":1},{"key":"1","kind":"article","label":"Article 1","heading":"Subject matter","path":"/nis2/articles/1","part":"I","status_on_date":"in_force","x_index":2},{"key":"2","kind":"article","label":"Article 2","heading":"Scope","path":"/nis2/articles/2","part":"I","status_on_date":"in_force","x_index":3},{"key":"3","kind":"article","label":"Article 3","heading":"Essential and important entities","path":"/nis2/articles/3","part":"I","status_on_date":"in_force","x_index":4},{"key":"4","kind":"article","label":"Article 4","heading":"Sector-specific Union legal acts","path":"/nis2/articles/4","part":"I","status_on_date":"in_force","x_index":5},{"key":"5","kind":"article","label":"Article 5","heading":"Minimum harmonisation","path":"/nis2/articles/5","part":"I","status_on_date":"in_force","x_index":6},{"key":"6","kind":"article","label":"Article 6","heading":"Definitions","path":"/nis2/articles/6","part":"I","status_on_date":"in_force","x_index":7},{"key":"7","kind":"article","label":"Article 7","heading":"National cybersecurity strategy","path":"/nis2/articles/7","part":"II","status_on_date":"in_force","x_index":8},{"key":"8","kind":"article","label":"Article 8","heading":"Competent authorities and single points of contact","path":"/nis2/articles/8","part":"II","status_on_date":"in_force","x_index":9},{"key":"9","kind":"article","label":"Article 9","heading":"National cyber crisis management frameworks","path":"/nis2/articles/9","part":"II","status_on_date":"in_force","x_index":10},{"key":"10","kind":"article","label":"Article 10","heading":"Computer security incident response teams (CSIRTs)","path":"/nis2/articles/10","part":"II","status_on_date":"in_force","x_index":11},{"key":"11","kind":"article","label":"Article 11","heading":"Requirements, technical capabilities and tasks of CSIRTs","path":"/nis2/articles/11","part":"II","status_on_date":"in_force","x_index":12},{"key":"12","kind":"article","label":"Article 12","heading":"Coordinated vulnerability disclosure and a European vulnerability database","path":"/nis2/articles/12","part":"II","status_on_date":"in_force","x_index":13},{"key":"13","kind":"article","label":"Article 13","heading":"Cooperation at national level","path":"/nis2/articles/13","part":"II","status_on_date":"in_force","x_index":14},{"key":"14","kind":"article","label":"Article 14","heading":"Cooperation Group","path":"/nis2/articles/14","part":"II","status_on_date":"in_force","x_index":15},{"key":"15","kind":"article","label":"Article 15","heading":"CSIRTs network","path":"/nis2/articles/15","part":"III","status_on_date":"in_force","x_index":16},{"key":"16","kind":"article","label":"Article 16","heading":"European cyber crisis liaison organisation network (EU-CyCLONe)","path":"/nis2/articles/16","part":"III","status_on_date":"in_force","x_index":17},{"key":"17","kind":"article","label":"Article 17","heading":"International cooperation","path":"/nis2/articles/17","part":"III","status_on_date":"in_force","x_index":18},{"key":"18","kind":"article","label":"Article 18","heading":"Report on the state of cybersecurity in the Union","path":"/nis2/articles/18","part":"III","status_on_date":"in_force","x_index":19},{"key":"19","kind":"article","label":"Article 19","heading":"Peer reviews","path":"/nis2/articles/19","part":"III","status_on_date":"in_force","x_index":20},{"key":"20","kind":"article","label":"Article 20","heading":"Governance","path":"/nis2/articles/20","part":"IV","status_on_date":"in_force","x_index":21},{"key":"21","kind":"article","label":"Article 21","heading":"Cybersecurity risk-management measures","path":"/nis2/articles/21","part":"IV","status_on_date":"in_force","x_index":22},{"key":"22","kind":"article","label":"Article 22","heading":"Union level coordinated security risk assessments of critical supply chains","path":"/nis2/articles/22","part":"IV","status_on_date":"in_force","x_index":23},{"key":"23","kind":"article","label":"Article 23","heading":"Reporting obligations","path":"/nis2/articles/23","part":"IV","status_on_date":"in_force","x_index":24},{"key":"24","kind":"article","label":"Article 24","heading":"Use of European cybersecurity certification schemes","path":"/nis2/articles/24","part":"IV","status_on_date":"in_force","x_index":25},{"key":"25","kind":"article","label":"Article 25","heading":"Standardisation","path":"/nis2/articles/25","part":"IV","status_on_date":"in_force","x_index":26},{"key":"26","kind":"article","label":"Article 26","heading":"Jurisdiction and territoriality","path":"/nis2/articles/26","part":"V","status_on_date":"in_force","x_index":27},{"key":"27","kind":"article","label":"Article 27","heading":"Registry of entities","path":"/nis2/articles/27","part":"V","status_on_date":"in_force","x_index":28},{"key":"28","kind":"article","label":"Article 28","heading":"Database of domain name registration data","path":"/nis2/articles/28","part":"V","status_on_date":"in_force","x_index":29},{"key":"29","kind":"article","label":"Article 29","heading":"Cybersecurity information-sharing arrangements","path":"/nis2/articles/29","part":"VI","status_on_date":"in_force","x_index":30},{"key":"30","kind":"article","label":"Article 30","heading":"Voluntary notification of relevant information","path":"/nis2/articles/30","part":"VI","status_on_date":"in_force","x_index":31},{"key":"31","kind":"article","label":"Article 31","heading":"General aspects concerning supervision and enforcement","path":"/nis2/articles/31","part":"VII","status_on_date":"in_force","x_index":32},{"key":"32","kind":"article","label":"Article 32","heading":"Supervisory and enforcement measures in relation to essential entities","path":"/nis2/articles/32","part":"VII","status_on_date":"in_force","x_index":33},{"key":"33","kind":"article","label":"Article 33","heading":"Supervisory and enforcement measures in relation to important entities","path":"/nis2/articles/33","part":"VII","status_on_date":"in_force","x_index":34},{"key":"34","kind":"article","label":"Article 34","heading":"General conditions for imposing administrative fines on essential and important entities","path":"/nis2/articles/34","part":"VII","status_on_date":"in_force","x_index":35},{"key":"35","kind":"article","label":"Article 35","heading":"Infringements entailing a personal data breach","path":"/nis2/articles/35","part":"VII","status_on_date":"in_force","x_index":36},{"key":"36","kind":"article","label":"Article 36","heading":"Penalties","path":"/nis2/articles/36","part":"VII","status_on_date":"in_force","x_index":37},{"key":"37","kind":"article","label":"Article 37","heading":"Mutual assistance","path":"/nis2/articles/37","part":"VII","status_on_date":"in_force","x_index":38},{"key":"38","kind":"article","label":"Article 38","heading":"Exercise of the delegation","path":"/nis2/articles/38","part":"VIII","status_on_date":"in_force","x_index":39},{"key":"39","kind":"article","label":"Article 39","heading":"Committee procedure","path":"/nis2/articles/39","part":"VIII","status_on_date":"in_force","x_index":40},{"key":"40","kind":"article","label":"Article 40","heading":"Review","path":"/nis2/articles/40","part":"IX","status_on_date":"in_force","x_index":41},{"key":"41","kind":"article","label":"Article 41","heading":"Transposition","path":"/nis2/articles/41","part":"IX","status_on_date":"in_force","x_index":42},{"key":"42","kind":"article","label":"Article 42","heading":"Amendment of Regulation (EU) No 910/2014","path":"/nis2/articles/42","part":"IX","status_on_date":"in_force","x_index":43},{"key":"43","kind":"article","label":"Article 43","heading":"Amendment of Directive (EU) 2018/1972","path":"/nis2/articles/43","part":"IX","status_on_date":"in_force","x_index":44},{"key":"44","kind":"article","label":"Article 44","heading":"Repeal","path":"/nis2/articles/44","part":"IX","status_on_date":"in_force","x_index":45},{"key":"45","kind":"article","label":"Article 45","heading":"Entry into force","path":"/nis2/articles/45","part":"IX","status_on_date":"in_force","x_index":46},{"key":"46","kind":"article","label":"Article 46","heading":"Addressees","path":"/nis2/articles/46","part":"IX","status_on_date":"in_force","x_index":47},{"key":"annex-ii","kind":"annex","label":"Annex II","heading":"OTHER CRITICAL SECTORS","path":"/nis2/annexes/annex-ii","part":"Annexes","status_on_date":"in_force","x_index":48},{"key":"annex-i","kind":"annex","label":"Annex I","heading":"SECTORS OF HIGH CRITICALITY","path":"/nis2/annexes/annex-i","part":"Annexes","status_on_date":"in_force","x_index":49},{"key":"annex-iii","kind":"annex","label":"Annex III","heading":"CORRELATION TABLE","path":"/nis2/annexes/annex-iii","part":"Annexes","status_on_date":"in_force","x_index":50}],"nodes":[{"work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","href":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","level":"L2","label":"2024/2690","short_title":"Implementing act — Cybersecurity risk-management measures [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Regulation (EU) 2024/2690 · binding · OJ L, 2024/2690, 18.10.2024 · dated 17 Oct 2024 [in force]"},{"work_id":"spaces/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists","path":"/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists","href":"/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists","level":"L3","label":"C(2023) 6070","short_title":"Guideline — Entity lists [final]","legal_nature":"not_legislation","source_line":"Guidelines by the European Commission · not legislation · dated 13 Sep 2023 [final]"},{"work_id":"spaces/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts","path":"/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts","href":"/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts","level":"L3","label":"C(2023) 6068","short_title":"Guideline — Sector-specific acts [final]","legal_nature":"not_legislation","source_line":"Guidelines by the European Commission · not legislation · dated 13 Sep 2023 [final]"},{"work_id":"spaces/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration","path":"/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration","href":"/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration","level":"L3","label":"NIS Cooperation Group","short_title":"Guideline — Recommendations for implementing NIS2 Article 28 [final]","legal_nature":"not_legislation","source_line":"Guidelines by the NIS Cooperation Group · not legislation [final]"}],"edges":[{"edge_id":"78ecd4caa9ac0e7ec81e","type":"guides","layer":"explains","scope":"unit","src":"spaces/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists","src_unit":"spaces/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists/page","dst_unit":"3","src_from":"2023-09-13","src_until":null},{"edge_id":"43247a01f7d5a9053d57","type":"guides","layer":"explains","scope":"unit","src":"spaces/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts","src_unit":"spaces/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts/page","dst_unit":"4","src_from":"2023-09-13","src_until":null},{"edge_id":"6ca61b97e46ffe31d644","type":"implements","layer":"implements","scope":"unit","src":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","src_unit":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/head","dst_unit":"21","src_from":"2024-11-07","src_until":null},{"edge_id":"c045b379c735709dd072","type":"implements","layer":"implements","scope":"unit","src":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","src_unit":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/head","dst_unit":"23","src_from":"2024-11-07","src_until":null},{"edge_id":"38f0b5d4c0fabb34474a","type":"guides","layer":"explains","scope":"unit","src":"spaces/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration","src_unit":"spaces/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration/page","dst_unit":"28","src_from":"0001-01-01","src_until":null}],"counts":{"articles_with_links":5,"l2_nodes":1,"l3_nodes":3,"edges":5,"act_level_edges":0,"undated_edges":1,"not_in_force_sources":0},"map_url":"https://www.headlesslaw.com/nis2/map","note":"edges = the relations of the act's units on as_of (same rule as <page>/relations?at=); src_from 0001-01-01 = no date recorded for the source (shown on every date)"}