The EU NIS2 Directive (transposition deadline October 2024) dramatically expands the scope of its predecessor to cover medium and large organisations across 18 critical sectors — including energy, transport, banking, health, digital infrastructure, manufacturing, and public administration — imposing board-level accountability, 24-hour incident reporting obligations, and specific security measures including access control, encryption, and supply-chain security. Zero Trust architecture directly satisfies NIS2's Article 21 security measures, providing the access management, monitoring, and incident detection capabilities that competent authorities will assess during inspections of essential and important entities.
Related: GDPR · DORA · CRA · Energy · Government