NIS2 for US Companies with EU Subsidiaries: What IT Needs to Do

What NIS2 is and who it affects

NIS2 is the EU's updated cybersecurity directive. It applies to medium and large organisations in a wide range of sectors, including energy, transport, health, digital infrastructure, ICT service management, manufacturing of certain products, and some digital services. Member states bring it into national law, so details and timing vary by country. Penalties can reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities.

What NIS2 expects from IT

• risk analysis and security policies
• incident handling and reporting to national authorities on tight deadlines
• business continuity, backup management and disaster recovery
• supply-chain security
• secure network and system acquisition and maintenance
• basic cyber hygiene and training
• cryptography and encryption where appropriate
• access control and asset management
• multi-factor authentication.

A practical starting checklist

1. Map which European entities you have and where personal data lives.
2. Turn on MFA everywhere and remove standing admin rights.
3. Bring every device under management and encryption.
4. Centralise logging for identity, email and key systems.
5. Test restoring your backups and write down recovery targets.
6. Write an incident response plan that includes regulator notification steps.
7. Document all of it, so you can show auditors, customers and insurers what is in place.

Does NIS2 reach a US parent company?

NIS2 applies to entities providing services or carrying out activities in the EU, so it is your EU subsidiary or office that needs to comply. In practice, though, its IT usually runs on systems, identity and tools managed by the US parent, so the controls end up being implemented group-wide.

Incident reporting deadlines

NIS2 sets staged reporting for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Exact procedures depend on each country's implementing law.

Management accountability

NIS2 makes management bodies responsible for approving cybersecurity risk measures and overseeing them, and expects them to receive training. That means your European directors need clear reporting on security, not just the IT team.

National implementation

NIS2 is a directive, so each EU country passes its own law, with its own registration rules, authorities and timelines. Check the status in each country where you operate.

Spain · Ireland · Netherlands · Germany