CLAIM-2026-08-07-05

NIS2 Article 21(1) requires essential and important entities to take appropriate and proportionate measures taking into account 'the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation'.

Why it matters

The same ratchet reaches entities that hold no personal data at all, and it reaches them through a different authority. A team that has scoped its obligations only under the GDPR will miss it.

Sources

• nisdirectiv2022cybersecu