NIS2 and email security: Article 21 measures and the reporting clock

NIS2 applies to public and private entities of a type listed in Annex I (sectors of high criticality) or Annex II (other critical sectors) that are at least medium-sized under the EU definition in Recommendation 2003/361/EC. In practice that means 50 or more staff, or annual turnover or balance sheet above EUR 10 million. Some entities are covered regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and entities identified as critical under the CER Directive.

Banks and other financial entities are a special case. Where DORA applies, its ICT risk and incident rules take precedence as sector-specific law. See the DORA page for those obligations.

Suppliers are reached indirectly. Article 21(2)(d) requires covered entities to manage supply chain security, including the security practices of their direct suppliers. That is why NIS2 questionnaires arrive at companies the directive never names.

Not as UK law. The UK left the EU before NIS2 was adopted and has not transposed it. NIS2 still reaches UK companies in three ways, because Article 2(1) applies it to in-scope entities that “provide their services or carry out their activities within the Union”.

• EU subsidiaries and establishments. A UK group’s subsidiary established in a member state falls under that member state’s jurisdiction (Article 26(1)) and its national NIS2 law, if it meets the sector and size tests.
• Digital providers with no EU establishment. DNS service providers, TLD registries, domain registration services, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines and social networking platforms that offer services in the EU without being established there “shall designate a representative in the Union” (Article 26(3)). Without one, any member state where they provide services may take legal action against them.
• Supply chains. EU customers covered by NIS2 must manage the security of their direct suppliers (Article 21(2)(d)), so UK suppliers receive NIS2 questionnaires and contract clauses even when the directive does not apply to them.

The UK’s own rules: NIS Regulations 2018 and the Cyber Security and Resilience Bill

In the UK, the Network and Information Systems Regulations 2018 (SI 2018/506) apply. They cover operators of essential services and relevant digital service providers: online marketplaces, online search engines and cloud computing services. A relevant digital service provider must have its head office in the UK or nominate a UK representative, and micro and small enterprises are excluded.

The Cyber Security and Resilience (Network and Information Systems) Bill amends the 2018 Regulations. It was introduced in the House of Commons on 12 November 2025, passed its Commons third reading on 16 June 2026, had its Lords second reading on 14 July 2026 and completed Lords committee stage in September 2026. As of 20 October 2026, UK Parliament lists Lords report stage for 26 October 2026; the Bill is not yet law. Published analysis of the Bill describes bringing data centres and managed service providers into scope, with much of the detail left to secondary legislation.

For the email layer the controls are the same under both regimes: protection against phishing and BEC, an inventory of connected apps, and incident detection fast enough for a 24-hour clock. This section is general guidance, not legal advice; confirm scope with counsel in each jurisdiction.

Article 34 sets minimum ceilings that national law must provide for. For essential entities the maximum is at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities it is at least EUR 7 million or 1.4%. Member states can set higher maximums.

Article 20 makes management bodies approve the risk-management measures, oversee their implementation and be liable for infringements. Members of management bodies must follow training. That is why NIS2 programs usually start in the boardroom, not the SOC.

Sentaro is one control in a NIS2 program, not the program. Be clear about the boundary before an auditor or supervisor asks.

• It does not run your risk analysis, write your policies or obtain management approval. A GRC platform or your consultant manages that program.
• It does not determine whether an incident is significant, and it does not submit reports to your CSIRT or authority.
• It does not cover backups, business continuity, encryption of your own systems, vulnerability management or secure development.
• It does not deliver security awareness training or phishing simulations.
• It does not yet detect account takeover from session anomalies or monitor leaked credentials. Those arrive with the Behavioral and Identity vectors in Q4 2026.
• It does not guarantee that every threat is detected. Sentaro’s terms say so explicitly, and so should any honest vendor.