Sector · NIS2 for energy and essential services
NIS2 for energy and essential services
Under NIS2, the energy sector, including electricity, gas, oil and hydrogen, is of high criticality, as are water, transport and health. Therefore, if you are a medium-sized or large company in these sectors, its risk management measures, 24-hour reporting and management liability apply to you.
Key regulations for the energy sector, led by NIS2
NIS2 in the energy sector: essential and important entities
Large companies in the energy sector and the other NIS2 sectors of high criticality are, as a rule, essential entities, whereas medium-sized ones are important entities. Both have the same core obligations; however, what changes is supervision (proactive for essential entities) and the size of fines: maximums of at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important ones, whichever is higher.
What NIS2 requires in the energy sector
- The Article 21 risk management measures: risk analysis, incident handling, business continuity and crisis management, supply chain security, encryption, access control and training.
- Reporting significant incidents: an early warning within 24 hours, a notification within 72 hours and then a final report within one month.
- Management liability: the management body must approve the measures, oversee them and also receive risk management training.
The situation in Spain
Spain’s NIS2 transposition law is still pending and the European Commission has taken Spain to the Court of Justice of the EU. Meanwhile, the first NIS framework (Royal Decree-Law 12/2018) applies to operators of essential services. In contrast, the physical protection of critical infrastructure has its own regime, which Directive (EU) 2022/2557 on the resilience of critical entities (CER) updates.
Continuity of operations
In the energy sector and the other essential services, NIS2 asks for more than security: the service must keep running. ISO 22301 provides the method (impact analysis, strategies, plans and testing) and ISO 27001 the control baseline. In addition, both serve as evidence for NIS2.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps the energy sector with NIS2
- Article 21 measures with their owner, status and evidence.
- The 24-hour, 72-hour and one-month reporting clock, with drafts that carry each authority’s fields.
- Assessment of critical suppliers in the supply chain.
- Impact analysis and continuity plans, also linked to risks.
FAQ
Frequently asked questions
Does NIS2 apply to me as a small energy company?
If you have fewer than 50 employees and under €10 million in turnover, generally not, unless you provide a critical service or the authority designates you. Even so, clients in scope will require measures of you by contract.
What is the difference between NIS2 and the CER Directive?
NIS2 focuses on cybersecurity, whereas the CER Directive focuses on the physical resilience of critical entities. Many energy companies are affected by both.
Can NIS2 already be enforced in Spain?
Not until the transposition law is published, but its requirements already arrive by contract and no long transition period is expected once it is adopted.
Other sectors: Banking and fintechInsurersPublic-sector suppliersConnected-product manufacturers
Shall we look at it with your own services?
We’ll show you the platform with a real case from your sector. No commitment, no sales script.
