The NIS2 Directive emphasizes the responsibilities of competent authorities for supervision and enforcement. Key measures include regular and targeted audits, on-site and off-site checks, requests for information, and access to documents or evidence.

NIS2 interacts with the CER Directive and the DORA, focusing on the physical and cyber resilience of critical entities. National competent authorities under both directives must cooperate and exchange information on risks and incidents. The NIS2 Cooperation Group will regularly meet with the Critical Entities Resilience Group, and the DORA addresses cybersecurity risk management and reporting obligations in the financial sector

NIS2 aims to improve cyber risk management through clear responsibilities, appropriate planning, and increased EU cooperation. It requires Member States to appoint national authorities for cyber crisis management, introduces large-scale cybersecurity incident and crisis response plans, and establishes the EU-CYCLONe network for managing large-scale cybersecurity incidents and crises​

NIS2 mandates that all companies address a core set of cybersecurity risk management policies, including incident handling, supply chain security, vulnerability handling, and the use of cryptography. It introduces a multi-stage approach to incident reporting, requiring companies to submit an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month