NIS2 widened the EU cyber-resilience perimeter, raised the management body's accountability and changed how incidents get reported. Critical for any entity in scope - and DORA does not replace it for financial entities.
The Network and Information Security Directive 2 (Directive EU 2022/2555) replaces NIS1 and widens the EU cyber-resilience perimeter to essential and important entities across most regulated industries. Member states were required to transpose it by October 2024.
For hiring, NIS2 changed two things: the management body now carries personal accountability for risk decisions, and incident reporting runs on a 24h / 72h / 1-month clock that overlaps with DORA and GDPR. The InfoSec hire that holds is the one who can run those clocks together.
Regulators in scope
Industries most affected
Operational scope - the work a GRC hire actually owns under this framework day to day.
NIS2 touches more than one seat. KICKFIND can run the full hiring loop for any of these.
Concrete proof points we look for in NIS2hires. CV name-drops without specifics don't pass our screen.
Patterns that look right on paper but fail under regulator scrutiny. Caught at intake before any client sees them.
Most CISO recruiters miss the cross-clock problem. An incident in scope for NIS2 will usually also be in scope for DORA, GDPR or both. Three regulators, three clocks, one team. Hire the wrong profile and the third clock is the one that misses.
KICKFIND screens NIS2 hires for working CSIRT relationships and for a documented playbook that handles the clock overlap. Specialist over generalist matters here because cross-clock failures end up on the supervisor's permanent file.
Submit a structured GRC hiring brief in under 5 minutes. We come back with a calibration call and a real plan, not a sales pitch.