13 August, 2026
NIS2 obligations under the Cybersecurity Act
The Act establishes three main NIS2 obligations:
- registration with the National Cyber Security Centre;
- a duty of care regarding risk management and appropriate security measures; and
- an obligation to report significant cyber incidents, with the first notification required within 24 hours.
Directors are personally responsible for ensuring compliance with the duty of care and may incur liability. Organisations risk substantial fines if they fail to comply with the Act.
Security measures for NIS2 compliance
The security measures required for NIS2 compliance include requirements relating to:
- human resources security;
- access control;
- identity and access management;
- governance and accountability;
- security awareness;
- risk management;
- supply chain security.
The legislation does not dictate exactly how organisations must implement these controls. For NIS2 implementation, organisations are expected to perform risk assessments and take measures that are appropriate to their specific environment.
Pre-employment and in-employment screening of staff can contribute to meeting the duty of care regarding risk management and appropriate security measures. Background screening is a recognised personnel security measure that helps organisations comply with the risk-based requirements of the Cybersecurity Act.
How DISA can help with your NIS2 compliance
- Background screening supports readiness for the Cybersecurity Act.
- Personnel security begins before access is granted.
- Effective cybersecurity also includes effective people security.
- Risk-based employment screening helps organisations demonstrate due diligence.
- Screening strengthens organisational resilience against insider threats.
- Trusted people are an essential part of trusted systems.