NIS2 Directive: What Norwegian Businesses Need to Know in 2026

The NIS2 Directive (Network and Information Security Directive 2) came into effect in the EU in October 2024, and Norway is expected to implement equivalent requirements through the EEA Agreement. The directive significantly expands the scope of organizations that must meet strict cybersecurity requirements.

Who is affected?

NIS2 applies to organizations in critical infrastructure — including energy, transport, healthcare, finance, water supply, and digital infrastructure. New sectors like waste management, food production, and postal services are now also covered.

Organizations with over 50 employees or over 10 million euros in turnover in these sectors need to prepare.

Requirements to meet

• Risk management — Systematic assessment and handling of cybersecurity risks
• Incident handling — Reporting significant incidents within 24 hours
• Supply chain security — Assessment of security across the supply chain
• Business continuity — Plans to maintain operations during and after incidents
• Board responsibility — Management held personally accountable for non-compliance

What should you do now?

• Determine if you're covered — check your sector and size
• Conduct a gap analysis — compare current security levels against NIS2 requirements
• Establish incident handling procedures — 24-hour reporting requirements need preparation
• Assess the supply chain — map third-party risks
• Involve the board — ensure leadership understands their responsibility

ForSec helps Norwegian businesses with NIS2 compliance through gap analyses, implementation support, and ongoing advisory. Contact us for a no-obligation conversation.