NIS2 Compliance for Licensed Professionals in the EU — What You Need to Know

NIS2 is the EU's updated cybersecurity directive. It came into force in 2023 and EU member states were required to transpose it into national law by October 2024. If you're a licensed professional in Romania or elsewhere in the EU, you may have heard about it — and wondered whether it applies to you. This page gives you a straight answer.

What is NIS2?

NIS2 (Network and Information Security Directive 2) is an EU law that sets minimum cybersecurity requirements for organizations operating in critical and important sectors. It replaced the original NIS Directive and significantly expanded the scope of who must comply. The goal is to raise the baseline level of cybersecurity across the EU — not just in large corporations, but across the supply chains and professional services that support them.

Does NIS2 apply to solo professionals?

It depends on your sector and the size of your practice. NIS2 directly targets essential and important entities — organizations above certain size thresholds (generally 50+ employees or €10M+ turnover) operating in covered sectors. Most solo professionals fall below these thresholds and are not directly subject to NIS2 obligations. However, two situations change this: if you serve clients who are NIS2-obligated, you may be required to meet minimum cybersecurity standards as part of their supply chain; and Romania's national transposition may extend obligations to smaller entities or specific professions.

What does NIS2 require in practice?

For organizations in scope, NIS2 mandates ten categories of security measures: risk analysis and information security policies; incident handling; business continuity; supply chain security; secure system acquisition and development; cybersecurity hygiene and training; cryptography and encryption policies; access control; multi-factor authentication; and vulnerability handling and disclosure. For a solo professional, most of these map to concrete, achievable actions — not enterprise-scale programs.

How does NIS2 relate to GDPR?

They overlap significantly but are not the same. GDPR focuses on protecting personal data and the rights of individuals. NIS2 focuses on the resilience and security of systems and services. In practice, the technical security measures required by both point in the same direction — strong access controls, encrypted storage, incident response, vendor due diligence. If you are already taking GDPR seriously, you have likely completed a significant portion of what NIS2 asks for. The gaps are usually around formal documentation, incident response procedures, and supply chain assessment.

What should a solo professional actually do?

The honest answer: start by understanding where you stand. Most professionals do not have a clear picture of their current cybersecurity posture. They know they use antivirus software and have a password, but they have not mapped their actual data flows, assessed their vendor risks, or documented anything. That is the starting point — not drafting policies, not buying new tools. Solsignia Postura walks you through exactly this assessment, with profession-specific questions mapped to your GDPR and NIS2 obligations.