Since the introduction of the NIS2 Directive, there has been a lot of misunderstanding among businesses about who it applies to and what compliance actually means. These misconceptions can also pose a serious risk – as it is estimated that nearly 4,000 businesses in Hungary are subject to the regulation.
“This only affects critical infrastructure”
The reality is much broader than that. NIS2 does not only apply to the classic sectors covered by the previous NIS Directive – it also extends to the entire supply chain. In the energy sector, for example, the regulation previously only affected electricity and gas operators, but now wind turbine manufacturers and electric charging station operators may also fall under its scope. This is precisely why many businesses have incorrectly identified themselves as affected – or have not realised that they were actually affected.
“This is just the IT department’s job”
This is one of the most common and dangerous misconceptions. NIS2 compliance cannot be limited to a single department: it affects legal, HR, procurement and management areas as well, as the regulation specifically makes management responsible for risk management. If compliance only lands on the desk of the IT team, the process can easily slip or remain incomplete.
“It is enough to have the incident management plan on paper”
NIS2 is not content with a document gathering dust in a drawer. The regulation requires specific, strict reporting deadlines (in 24, 72, or 30-day increments) that can only be met with regularly tested, real-time monitoring and a working incident management process.
"Once we've passed, that's it"
Compliance is not a one-time project, but an ongoing task: the risk management system, threat environment, and supplier relationships must be reviewed regularly as the organization and technological environment constantly change.
Where is it worth clarifying our own situation?
Since the precise assessment of involvement itself requires expertise, it is worth discussing this with a specialist rather than relying on assumptions. The cluster's materials related to NIS2 are available at cybercluster.hu/nis2 are available on the page.