NIS2 and recruitment. Which cybersecurity skills does your organization need?

NIS2 has expanded the cybersecurity obligations of many organisations across the EU. For those in scope, meeting the requirements involves more than updating policies.

Someone has to assess risk, review suppliers, handle incidents, maintain business continuity and manage access. Someone also has to explain the trade-offs to management clearly enough to support decisions.

NIS2 is a cybersecurity directive. Putting it into practice is also a question of skills, staffing and clear ownership.

What is NIS2 and which organisations does it cover?

The NIS2 Directive establishes a common framework for cybersecurity across the EU. It covers 18 critical sectors, including energy, transport, banking, healthcare, digital infrastructure, public administration, manufacturing, waste management, postal services and certain digital platforms. The European Commission’s overview explains the scope in more detail.

The directive distinguishes between essential and important entities. As a general rule, medium-sized and large organisations in the covered sectors are in scope, but the directive also contains exceptions and specific rules. National laws put the requirements into effect and may differ in their procedures and timelines.

An organisation assessing whether NIS2 applies should consider:

• the services it provides and the sector in which it operates;
• its size and legal structure;
• the relevant categories in Annex I and Annex II of the directive;
• any specific inclusion criteria and exceptions;
• the rules and guidance published by its national competent authority.

The European Commission’s country-by-country transposition pages are a starting point for checking national implementation. Where the scope is unclear, the organisation should seek advice based on the law of the relevant Member State.

Key NIS2 timelines across the EU

There is no single EU-wide company registration or implementation date that applies to every organisation. The directive set a transposition deadline for Member States, while the practical steps for entities depend on national law. Three timelines matter when planning resources:

• National implementation – check whether your organisation falls within the national rules, and identify any registration, notification or compliance deadlines that apply to it.
• Incident reporting – under Article 23, a significant incident generally calls for an early warning within 24 hours, an incident notification within 72 hours and a final report within one month, subject to the directive’s conditions and national procedures.
• Operational readiness – recruitment, training, supplier arrangements and incident response processes need time to become effective. Plan backwards from the national deadlines and your own risk assessment.

This is why staffing decisions should start with an assessment of the work to be done, not simply with a list of job titles.

Why does NIS2 affect recruitment?

NIS2 does not require every organisation to hire someone with “NIS2 specialist” in their title. It does require essential and important entities to put appropriate risk-management measures in place and assign responsibility for them. Management bodies also have duties under Article 20.

Article 21 of the directive covers measures including:

• risk analysis and information security policies;
• incident handling;
• business continuity, backups and disaster recovery;
• supply chain security;
• secure development and maintenance of systems;
• human resources security;
• vulnerability handling and disclosure;
• assessment of the effectiveness of cybersecurity measures;
• cyber hygiene and training;
• cryptography, access control and multi-factor authentication.

Significant incidents also trigger reporting duties. Meeting them takes more than documentation before an audit. Organisations need people who can work under time pressure, coordinate with IT, legal and business teams, and make decisions with incomplete information.

Which specialists do organisations need for NIS2?

The right roles depend on the sector, systems and existing team. In practice, demand often falls into four areas of expertise. ENISA’s role-mapping guidance is useful for connecting NIS2 obligations with specific tasks and skills.

Governance, risk and compliance

Relevant roles include Cybersecurity Risk Manager, IT Risk Manager, GRC Analyst, Cybersecurity Compliance Officer and security auditor.

These specialists translate requirements into policies, processes and controls. They assess risk, define ownership, prepare for reviews and evaluate suppliers. The strongest candidates can also explain how technical risk affects operations and business decisions.

Incident detection and response

Organisations may need SOC or CSIRT specialists, incident responders, threat intelligence analysts and digital forensics experts.

Their work goes beyond detecting an attack. They must classify the incident, contain its effects, gather information for notifications and coordinate technical action with legal and internal communication teams.

ENISA’s 2025 NIS Investments report identifies incident detection and response among the most in-demand cybersecurity skills in its survey of EU organisations.

Security architecture and engineering

Relevant roles include Security Architect, Cloud Security Engineer, IAM Engineer and Network Security Engineer, alongside specialists in vulnerability management and secure software development.

They turn security requirements into working systems: access controls, network segmentation, cloud protections and monitoring. ENISA’s survey also highlights demand for cloud security, security architecture and identity and access management.

OT and industrial control system security

Energy, transport, manufacturing and infrastructure organisations may need OT/ICS security specialists.

This is a difficult area to recruit for. Candidates need to understand both cybersecurity and industrial environments where systems cannot always be patched quickly, installations cannot easily be stopped, and conventional IT controls may be unsuitable.

In-house recruitment, outsourcing or a hybrid model?

Not every organisation needs a large internal security department. For a medium-sized business, a hybrid model may work: an internal owner of the area supported by outside specialists for audits, penetration testing, incident response or architecture.

Larger organisations may need to divide responsibilities between GRC, SOC, security architecture, IAM, cloud security and supplier assurance.

ENISA’s guidance suggests considering recruitment, upskilling, reassignment and outsourcing when planning capacity. External providers can perform tasks, but the organisation still needs to oversee the work and manage the associated risks.

When several capabilities need to be built quickly, embedded recruitment can add dedicated recruitment capacity to the team, aligned with its priorities, processes and communication.

How to build a recruitment plan for NIS2

Start by turning the applicable requirements into tasks, skills and areas of responsibility. Before posting vacancies, answer five questions:

• Which obligations apply to our organisation under national law?
• Who currently owns each area?
• Where are skills, capacity or ownership missing?
• Which gaps call for hiring, and which can be addressed through training or external support?
• Which roles must be filled first to meet our operational and legal deadlines?

HR Contact supports technology, financial, industrial and infrastructure companies in recruiting specialists in IT, cybersecurity, risk and compliance. We can map the talent market, build a candidate pipeline or manage the full recruitment process.

FAQ: NIS2 and recruitment

Does NIS2 require organisations to hire a CISO?

The directive does not prescribe a single job title. An organisation does, however, need the skills, processes and clearly assigned responsibilities required to manage cybersecurity risk. Depending on its size, that responsibility may sit with a CISO, an Information Security Officer, a Risk Manager or several people working together.

When do NIS2 obligations apply to a company?

The answer depends on national implementation and on whether the organisation is within scope. Check the applicable national law and competent authority for registration and compliance dates. The 24-hour, 72-hour and one-month incident-reporting stages are set out in the directive, subject to their conditions.

Which specialists should a company recruit first?

Start with the gaps identified in the organisation. Frequently needed skills include GRC and risk management, incident response, security architecture, cloud security, IAM and OT/ICS security.

Can NIS2-related work be outsourced?

Some work, such as audits, security testing or incident response support, can be carried out by external providers. The organisation still needs to oversee those services and manage the risks they create.