NIS2 and your website: who is in scope, and what a WAF changes

What NIS2 is

Directive (EU) 2022/2555, known as NIS2, sets a common level of cybersecurity across the European Union. It replaces the 2016 NIS directive and widens its scope considerably: where NIS covered a few hundred operators, NIS2 applies to thousands of medium and large companies across eighteen sectors.

Who is in scope

• Medium and large companies (as a rule, from 50 employees or €10 million turnover) in the sectors listed in Annexes I and II: energy, transport, health, digital infrastructure, manufacturing, postal services, food, among others.
• Some entities regardless of size, such as DNS service providers or domain name registries.
• Essential and important entities, with different supervision regimes and penalty ceilings.

A small company outside these sectors is in principle not directly covered. It can be indirectly: NIS2 requires covered entities to look after the security of their supply chain, and therefore to question their suppliers.

What the directive requires

• Risk-management measures (Article 21): risk analysis, incident handling, business continuity, supply-chain security, vulnerability handling, access control, encryption, multi-factor authentication, training.
• Notification of significant incidents (Article 23): an early warning within 24 hours, a notification within 72 hours, a final report within one month.
• Accountability of management, which must approve these measures and be trained.
• Penalties (Article 34) of up to €10 million or 2% of worldwide turnover for an essential entity, €7 million or 1.4% for an important one.

Where France stands

Member States had to transpose the directive by 17 October 2024. In France, the "Resilience" bill that transposes it was passed by the Senate in March 2025; as of 27 October 2026 it has not yet been finally adopted, its examination in the National Assembly having been postponed again in October 2026. ANSSI, the agency in charge of the scheme, publishes progress and an eligibility test on its MonEspaceNIS2 portal.

Where a web application firewall fits

For an exposed website, a web application firewall contributes concretely to three Article 21 requirements: security of network and information systems (application attacks are blocked before the server), vulnerability handling (a published flaw is filtered before it is fixed, and threat intelligence flags it), and incident handling (every block is logged and timestamped, which helps reconstruct an incident within the notification deadlines).

It does nothing for governance, training, the continuity of your other systems, or the notification itself, which remains your responsibility.