--- title: "EU NIS2 Directive: Requirements, Scope and the Physical Access Gap - Key2XS" description: What NIS2 (EU 2022/2555) requires, who is in scope, where every member state stands on a live tracker, the Dutch Cyberbeveiligingswet, and how identity governance closes the directive's physical access gap. --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=en) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) [CER Directive](https://key2xs.com/cer-directive?hsLang=en) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) Industries [Government](https://key2xs.com/sectors/government?hsLang=en) [Utilities](https://key2xs.com/sectors/utilities?hsLang=en) [Water management](https://key2xs.com/sectors/water-management?hsLang=en) [Transport](https://key2xs.com/sectors/transport?hsLang=en) [Telecom](https://key2xs.com/sectors/telecom?hsLang=en) Platform [Product](https://key2xs.com/products?hsLang=en) [How it works](https://key2xs.com/?hsLang=en#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=en) [One Identity](https://key2xs.com/partners/one-identity?hsLang=en) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=en) [Okta](https://key2xs.com/partners/okta?hsLang=en) [OpenText](https://key2xs.com/partners/opentext?hsLang=en) [iLOQ](https://key2xs.com/partners/iloq?hsLang=en) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=en) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=en) Resources [Resource center](https://key2xs.com/resources?hsLang=en) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) [Events](https://key2xs.com/events?hsLang=en) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=en) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=en) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) [FAQ](https://key2xs.com/?hsLang=en#faq) [News](https://key2xs.com/news-archive?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Home](https://key2xs.com?hsLang=en) > NIS2 Directive EU Directive (EU) 2022/2555 · In force since 16 January 2023 # EU NIS2 Directive Europe's cybersecurity law does not stop at software. NIS2 makes management bodies accountable for risk measures that explicitly include **access control, asset management and the physical environment** of network and information systems. Transposition deadline **17 Oct 2024** NL: Cyberbeveiligingswet in force **15 Aug 2026** EU transposition: live tracker below [See the live EU tracker](https://key2xs.com/nis2-tracker?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Where NIS2 stands ## From directive to enforcement, the clock so far NIS2 replaced the first NIS directive in January 2023. Transposition is nearly complete across the EU, and in the Netherlands the obligations became national law in August 2026. Today 1. 16 Jan 2023Directive in force across the EU 2. 17 Oct 2024National transposition deadline; most member states missed it 3. 17 Apr 2025Member states list their essential and important entities 4. Jul / Aug 2026NL referred to the EU Court of Justice (8 Jul); Cyberbeveiligingswet in force 15 Aug 5. 2027 →Registration, supervision, audits and enforcement In the Netherlands, registration for in-scope organisations is mandatory from 15 August 2026; duty-of-care and incident-notification obligations follow under sector supervision. What it requires ## Six obligations that decide your NIS2 posture NIS2 defines security of network and information systems to include their **physical environment**. These are the articles that matter most for organisations running critical operations. ART. 20 ### Governance and accountability Management bodies must approve cybersecurity risk measures, oversee their implementation and can be held personally liable. Training for boards is mandatory. ART. 21(2)(a–c) ### Risk management and continuity Policies on risk analysis, incident handling, business continuity, backup and crisis management, proportionate to the risk and all-hazards in scope. ART. 21(2)(d) ### Supply chain security Security in supplier relationships, including service providers and contractors with access, digital or physical, to your systems and sites. ART. 21(2)(i) ### Access control and asset management Human resources security, access control policies and asset management. The clause that pulls physical keys, cabinets and access points into cybersecurity scope. ART. 21(2)(j) ### Authentication Multi-factor or continuous authentication and secured communications wherever appropriate, for people as well as systems. ART. 23 ### Incident reporting Early warning within 24 hours, incident notification within 72 hours and a final report within one month, to the CSIRT or competent authority. Who is in scope ## Essential and important entities across 18 sectors NIS2 applies automatically to medium-sized and larger organisations in the sectors of Annex I and II, with member states able to designate smaller entities that are critical regardless of size. In the Netherlands the Cyberbeveiligingswet is expected to cover roughly 8,000 organisations. [Energy↗](https://key2xs.com/sectors/utilities?hsLang=en)[Transport↗](https://key2xs.com/sectors/transport?hsLang=en)Health[Public administration↗](https://key2xs.com/sectors/government?hsLang=en)Manufacturing[Drinking & waste water↗](https://key2xs.com/sectors/water-management?hsLang=en)[Digital infrastructure↗](https://key2xs.com/sectors/telecom?hsLang=en)ICT service managementBanking & financial marketsSpacePostal & courierChemicalsFoodWaste managementResearch+ digital providers and more in Annex II Where the directive meets physical access ## NIS2 asks for control. Physical access is where it breaks. Most NIS2 programmes govern digital identity well and stop at the server-room door. Identity-governed physical access extends the same lifecycle, policy and audit model to keys, cabinets and sites. ART. 21(2)(i) Access control policies and asset management, including the physical environment of systems. Every key, locker and cabinet is a governed asset bound to an identity, with request, approval, issue and return controlled by policy. ART. 21(2)(d) Security in supplier relationships and service provider access. Contractors and field engineers receive time-boxed physical access tied to their identity lifecycle. Off-boarded means revoked, the same day. ART. 20 Management bodies accountable for measures and their implementation. Board-ready evidence: who could open what, when, approved by whom, exportable per audit period. ART. 23 Incident timelines of 24 hours, 72 hours and one month. One audit trail across digital and physical access, so incident reconstruction is a query, not an investigation. ART. 21(2)(c) Business continuity and crisis management. Emergency and break-glass access is governed, logged and certifiable, instead of a key box that runs on trust. [See how the platform works →](https://key2xs.com/?hsLang=en#how-it-works) Live from EUR-Lex ## Live: NIS2 transposition across the EU The NIS2 Directive (EU 2022/2555) requires every member state to transpose it into national law. We track the implementing measures notified to EUR-Lex in real time, so you always know where each country stands. Loading implementation data... 0 / 27 EU Countries 0 Countries implemented 0% Compliance rate 0 Countries pending - Latest notification [View full tracker](https://key2xs.com/cer-tracker?hsLang=en) [View source data on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/NIM/?uri=oj:JOL_2022_333_R_0004) In the Netherlands ## Cyberbeveiligingswet (Cbw) The Netherlands transposed NIS2 through the Cyberbeveiligingswet, approved by the Senate on 7 July 2026 and in force since 15 August 2026, weeks after the European Commission referred the Netherlands to the EU Court of Justice for late transposition. Registration for in-scope organisations is mandatory from day one; duty-of-care and incident-notification obligations follow under sector supervision. In force 15 August 2026 Applies to ± 8,000 organisations Registration Mandatory from 15 Aug 2026 Replaces Wbni (2018) [Rijksoverheid](https://www.rijksoverheid.nl/actueel/nieuws/2026/07/07/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-15-augustus-2026-van-kracht)[NCSC on the Cbw](https://www.ncsc.nl/cyberbeveiligingswet-nis2) The other half ### Run critical infrastructure? Then CER applies too. NIS2 covers the cyber side. The Critical Entities Resilience Directive imposes physical resilience duties on many of the same organisations, with its own 2026 and 2027 deadlines. [Explore the CER Directive](https://key2xs.com/cer-directive?hsLang=en) Keep reading ## Latest on NIS2 [All coverage →](https://key2xs.com/news-archive?hsLang=en) ### [Insight2026 Why Identity Security Must Extend Beyond the Digital World Read article](https://key2xs.com/news/why-identity-security-must-extend-beyond-the-digital-world?hsLang=en) ### [ComplianceNov 2025 The Strategic Importance of NIS2 and CER Reporting, and Why Key2XS Makes It Operational Read article](https://key2xs.com/news/the-strategic-importance-of-nis2-and-cer-reporting-and-why-key2xs-makes-it-operationally-mandatory?hsLang=en) ### [ComplianceJul 2025 The Overlap Between NIS2 and CER: What Critical Entities Need to Know Read article](https://key2xs.com/news/the-overlap-between-nis2-and-cer-what-critical-entities-need-to-know?hsLang=en) ## Make NIS2 evidence a by-product, not a project See how identity-governed physical access produces the access-control and asset-management evidence NIS2 asks for, from the same lifecycle that already governs your digital world. [Book a demo](https://key2xs.com/contact?hsLang=en) [Build your business case](https://key2xs.com/roi-calculator?hsLang=en) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) - [Product](https://key2xs.com/products?hsLang=en) - [Integrations](https://key2xs.com/integrations?hsLang=en) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=en) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=en) - [Resource center](https://key2xs.com/resources?hsLang=en) - [Events](https://key2xs.com/events?hsLang=en) - [News](https://key2xs.com/news-archive?hsLang=en) - [Contact](https://key2xs.com/contact?hsLang=en) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=en) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=en) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V.