{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/recitals/82","url":"https://www.headlesslaw.com/nis2/recitals/82","title":"Recital 82","family":"l1_recital_view","work_id":"nis2","view_of":"/nis2/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Directive (EU) 2022/2555, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","valid_from":"2022-12-27","valid_until":null,"content_id":"f5b967995aad2ef4","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/recitals/82/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/recitals/82/versions/2022-12-27/rev/f5b967995aad2ef4","versions_url":"https://www.headlesslaw.com/nis2/recitals/82/versions","relations_url":"https://www.headlesslaw.com/nis2/recitals/82/relations","act_url":"https://www.headlesslaw.com/nis2/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"nis2","path":"/nis2/recitals","name":"NIS2","number":"Directive (EU) 2022/2555","celex":"32022L2555","title_official":null,"document_date":null},"position":{"kind":"recital","key":"82","index":82,"articles":144,"annexes":0},"prev":{"path":"/nis2/recitals/81","key":"81","title":"Recital 81"},"next":{"path":"/nis2/recitals/83","key":"83","title":"Recital 83"},"act_anchor":""}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","check":{"result":"matched","checked_at":"2026-11-01","against":"EUR-Lex"},"repo_path":"spaces/nis2/recitals.md","unit_text_sha256":"dc2ddafa8904c74c7c9dae565c55e28e15ff0948eac04517558a574f4261a3a5","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"nis2/recitals/rec/82","kind":"recital","key":"82","heading":"","text":"Cybersecurity risk-management measures should be proportionate to the degree of the essential or important entity’s exposure to risks and to the societal and economic impact that an incident would have. When establishing cybersecurity risk-management measures adapted to essential and important entities, due account should be taken of the divergent risk exposure of essential and important entities, such as the criticality of the entity, the risks, including societal risks, to which it is exposed, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.","marks":[],"text_hash":"dc2ddafa8904c74c7c9dae565c55e28e15ff0948eac04517558a574f4261a3a5","revision":1,"blocks":[{"locator":"nis2/recitals/rec/82/block/1","text_hash":"dc2ddafa8904c74c7c9dae565c55e28e15ff0948eac04517558a574f4261a3a5","revision":1}]}}