NIS2 Enforcement: The First Fines are Here, and They're Just the Beginning

What happened

For years, the NIS2 Directive loomed as a significant, yet abstract, regulatory hurdle for European organizations. With penalty ceilings reaching €10 million or 2% of global annual turnover, its potential impact was clear, but the practical implications of enforcement remained largely theoretical. That changed dramatically this summer. Initial penalties have now been observed in several member states, signaling a definitive shift. Some countries have issued penalties ranging from approximately €52,000 to €450,000.

Beyond the financial penalties, the European Commission has formally escalated its stance. It has taken action against certain member states for their failure to fully transpose the directive into national law by the October 2024 deadline. This move underscores the Commission's commitment to ensuring widespread compliance, even against some of the EU's largest economies.

Supervisory activity is, in fact, outpacing the fines themselves. Regulatory bodies in some countries have issued numerous formal supervisory orders. Audit programs are active in a significant number of member states, initially targeting essential entities. This indicates a proactive enforcement landscape where an absence of a fine merely means the supervisor has not yet reached that particular organization, not necessarily that it is compliant.

Why this pattern keeps repeating

The persistent pattern of non-compliance and subsequent enforcement stems from several core challenges faced by organizations. A primary issue is the sheer complexity of the regulatory landscape. NIS2, GDPR, ISO 27001, DORA, and SOC 2 each present unique requirements, often with overlapping but not perfectly aligned mandates. Managing multiple frameworks simultaneously is overwhelming for many security leaders.

Another significant factor is the tight deadlines imposed by these regulations. NIS2 is already enforceable, and DORA will apply from January 2025. Organizations are scrambling to achieve compliance, often under immense pressure, with limited time to implement comprehensive changes. This rush can lead to superficial compliance rather than deep-seated security improvements.

Furthermore, there's a critical shortage of specialized GRC expertise. Building in-house compliance capabilities takes years, a luxury many organizations do not have. This talent gap often leaves organizations ill-equipped to navigate the nuances of directives like NIS2, which not only expands the scope of covered entities but also shifts accountability. Article 20, for instance, explicitly requires management bodies to approve cybersecurity risk-management measures and oversee their implementation.

The transition from abstract directive to active enforcement reveals a pervasive underestimation of both the scope and the granular demands of NIS2.

The attacker's playbook step-by-step

While the NIS2 directive focuses on defensive measures and accountability, its enforcement highlights vulnerabilities that attackers routinely exploit. The attacker's playbook against non-compliant entities typically begins with reconnaissance. They scan for publicly exposed assets, identifying organizations that fall under NIS2's scope, particularly those in critical sectors. The directive covers a substantial number of entities, making a broad target pool.

Next, attackers often leverage common weaknesses exacerbated by compliance gaps. This includes exploiting unpatched systems, misconfigured services, and weak access controls, all areas where NIS2 mandates robust risk management. The SAP blind spot, for example, is a known vulnerability where critical business systems often lack adequate security scrutiny, making them prime targets for sophisticated attackers seeking to disrupt operations or exfiltrate sensitive data. Certain critical vulnerabilities have been exploited in the wild, demonstrating the real-world impact of such oversights.

Finally, the attackers aim for operational disruption or data exfiltration, knowing that an organization's lack of preparedness, indicated by NIS2 non-compliance, suggests slower detection and response capabilities. Ransomware attacks, for instance, thrive on such environments, leading to systems offline and critical infrastructure affected. The potential for a €10 million fine for non-compliance pales in comparison to the operational and reputational damage from a successful attack.

What defenders missed

Defenders primarily missed the depth of integration required by NIS2. Many organizations focused on documentation and policy updates, failing to translate these into actionable, verifiable security postures. Policies existing on paper but lacking substance, and outdated procedures, are common documentation gaps that auditors readily identify. Evidence for auditors is often scattered, making it difficult to demonstrate comprehensive compliance.

Crucially, the directive's emphasis on accountability, particularly under Article 20, often caught management bodies off guard. This article mandates that management not only approve cybersecurity risk-management measures but also actively oversee their implementation. This shifts cybersecurity from a purely technical concern to a boardroom imperative, a transition many organizations have struggled with.

Furthermore, many organizations underestimated the scope of NIS2, failing to accurately determine if they qualified as an "essential" or "important" entity. This unclear scope led to delayed or insufficient implementation efforts. The directive's broad reach, encompassing sectors from energy and transport to healthcare and digital infrastructure, means a vast number of entities are now under its purview, many of whom were not accustomed to such stringent cybersecurity mandates.

A practical defensive checklist

• Conduct a thorough scope assessment: Precisely identify if your organization is an "essential" or "important" entity under NIS2 and which specific regulations apply.
• Implement robust risk management: Move beyond theoretical risk assessments to practical, verifiable measures for identifying, assessing, and mitigating cyber risks.
• Strengthen supply chain security: Address vulnerabilities stemming from third-party providers, as NIS2 extends accountability across the supply chain.
• Enhance incident reporting capabilities: Ensure swift and accurate reporting mechanisms are in place, aligning with NIS2's strict reporting timelines.
• Invest in GRC expertise: Either build internal capabilities or engage external specialists to navigate the complex regulatory landscape effectively.
• Regularly test security controls: Implement continuous validation of security measures to ensure their effectiveness against evolving threats.
• Educate and train management: Ensure leadership understands their accountability under Article 20 and actively participates in cybersecurity oversight.

How modern offensive testing would have caught this

Modern offensive testing, particularly autonomous offensive testing with executable PoCs, offers a proactive solution to identify the gaps NIS2 aims to close. Traditional compliance audits often rely on documentation review and static assessments, which may not reveal actual exploitable weaknesses. Our platform, with its frameworks, autonomously simulates real-world attack scenarios against an organization's infrastructure.

This approach would have uncovered the "SAP blind spot" by actively testing critical business systems for vulnerabilities. It would have generated executable Proof-of-Concepts (PoCs) for identified weaknesses, demonstrating precisely how an attacker could exploit them. This provides irrefutable evidence of a security gap, allowing organizations to remediate before an auditor or, more critically, an attacker finds it.

Such testing moves beyond theoretical compliance, validating the effectiveness of risk management measures in practice. It would highlight deficiencies in incident response plans by simulating breaches and evaluating the organization's detection and containment capabilities. By providing concrete, actionable insights with executable PoCs, autonomous offensive testing offers a clear path to not just compliance, but genuine resilience against the threats NIS2 seeks to mitigate.

What to watch next

The immediate future will see intensified enforcement actions. The European Commission's actions against certain member states are a formal escalation, not a final step. This signals that member states, and by extension the entities within them, will face increasing pressure to complete transposition and demonstrate compliance.

Expect a continued rise in supervisory orders and fines across more member states. As audit programs mature and expand beyond essential entities to important ones, many more organizations will find themselves under scrutiny. The fines already observed are likely just the initial wave, with larger penalties and more frequent enforcement actions anticipated as the regime gains momentum.

Furthermore, the focus will shift from initial compliance to continuous adherence. Organizations must prepare for ongoing audits and demonstrate a mature, adaptive cybersecurity posture. The lessons from the initial fines are clear: NIS2 is no longer a distant threat but an active regulatory reality demanding immediate and sustained attention from CISOs and security engineers across Europe.