The NIS2 Directive explained: what SaaS and eCommerce businesses actually need to do

The point: NIS2 is about the services you run, and the UK has its own version

The NIS2 Directive is Directive (EU) 2022/2555, the European Union's law on cyber security for organisations that run important services.¹ Member states had to turn it into national law by 17 October 2024 and apply that law from 18 October 2024, the same day the original NIS Directive was repealed.¹²

For a SaaS company or an online shop, the short version is this. If you provide a type of service listed in the directive's annexes, you are at least medium sized, and you provide that service in the EU, NIS2 applies to you. It asks for 10 kinds of security measure, a three step incident report that starts within 24 hours, and a board that signs off and is trained.¹ Many SaaS products count as cloud computing services. Most ordinary online shops do not count at all.

The UK is not bound by NIS2. It has the Network and Information Systems Regulations 2018, and a bill to update them is going through Parliament.³⁴ A UK business that serves EU customers can still fall under NIS2, and I come to exactly how below. The businesses in the examples are made up. The law and the dates are footnoted.

How NIS2 differs from the Cyber Resilience Act

In my post on the Cyber Resilience Act I said that pure SaaS products do not fall under the CRA, and that a different law covers them instead. That law is NIS2.

The Cyber Resilience Act is Regulation (EU) 2024/2847, and it covers products with digital elements: hardware, downloadable software, apps.⁵ It is about making the product secure before it reaches the market. Among other things it asks manufacturers to draw up a software bill of materials, a machine readable list of the components inside the product.⁵

NIS2 covers the organisations that run services. It is about how you manage cyber risk while the service is live: your measures, your reporting, your board. The CRA says so itself in recital 12: NIS2 applies to cloud computing services and cloud service models such as Software as a Service (SaaS), Platform as a Service and Infrastructure as a Service.⁵

Then there is the General Data Protection Regulation (GDPR), which covers personal data, whichever of the other two applies.⁶ You can easily need all three. Welcome to EU compliance.

An example: a Manchester company sells a desktop app for planning warehouse shifts and also runs the web dashboard the app syncs to. The downloadable app is a product with digital elements, so the CRA looks at it. The hosted dashboard is a service, so NIS2 may look at it, if the company passes the size test below. Both hold staff names, so the GDPR looks at both. Three laws, one product line, each asking a different question.

Who is in scope: the service type comes first

NIS2 does not start with the size of your business. It starts with what you do. Article 2(1) applies the directive to entities "of a type referred to in Annex I or II".¹ Annex I lists 11 sectors of high criticality and Annex II lists seven other critical sectors, 18 in all.¹

Annex I includes energy, transport, banking, health, water, public administration, space and two that matter for software businesses: digital infrastructure (cloud computing service providers, data centres, content delivery networks, DNS providers, trust service providers and others) and ICT service management, business to business (managed service providers and managed security service providers).¹

Annex II includes postal and courier services, waste, chemicals, food, manufacturing, research and digital providers: online marketplaces, online search engines and social networking platforms.¹

Three definitions decide most cases for my readers.

A cloud computing service, in Article 6(30), is a digital service that gives on demand administration and broad remote access to a scalable and elastic pool of shareable computing resources.¹ Recital 33 lists SaaS among the service models it covers.¹ So a SaaS product your customers sign up to and use over the web will very often be a cloud computing service.

A managed service provider installs, manages, operates or maintains ICT products, networks, infrastructure or applications for customers, on site or remotely (Article 6(39)).¹ If you run and maintain other businesses' systems for them, this is you.

An online marketplace takes its meaning from consumer law: a service "which allows consumers to conclude distance contracts with other traders or consumers".⁷ The key words are "other traders". A shop that sells its own goods is not a marketplace. A platform where independent sellers sell to consumers is.

Worked example: three businesses, three answers

The first is a Leeds company that sells booking software to dental practices, signed up and used in the browser, with practices in Ireland and the Netherlands among its customers. Its product fits the cloud computing definition, which is Annex I. Type test passed.

The second is a Bristol shop that sells its own gift hampers online and ships to Germany. It is not a marketplace, because every contract is with the shop itself. Food appears in Annex II, but only for food businesses "engaged in wholesale distribution and industrial production and processing".¹ A retail hamper shop is neither. Type test failed, so NIS2 does not reach it on its own lists.

The third is a Brighton platform where 400 independent makers sell ceramics to consumers across Europe. Consumers conclude contracts with other traders through it, so it is an online marketplace, which is Annex II. Type test passed.

Who is in scope: then the size test

The second filter is size. Article 2(1) covers entities that qualify as medium sized enterprises, or exceed those ceilings, under Commission Recommendation 2003/361/EC.¹ In that recommendation, a small enterprise employs fewer than 50 persons and has an annual turnover and/or balance sheet total of no more than €10 million.⁸ Medium sized means fewer than 250 persons and a turnover up to €50 million and/or a balance sheet total up to €43 million.⁸

Two details catch people out, in both directions.

A common shorthand says a company is medium sized at 50 employees "or" €10 million turnover. That is too simple. Because of the "and/or", a business with fewer than 50 staff stays small as long as either its turnover or its balance sheet stays at or under €10 million.⁸ A 30 person SaaS company with €12 million revenue and a modest balance sheet is still small, and outside NIS2's size cap.

In the other direction, the figures are not yours alone. The recommendation adds the data of linked enterprises and, proportionally, of partner enterprises.⁸ A small subsidiary of a large group is not small. Headcount is measured in annual work units, so full time equivalents, and a business only changes category once it crosses a ceiling in two consecutive accounting periods.⁸

Some entities are in scope whatever their size: providers of public electronic communications networks, trust service providers, top level domain registries and DNS service providers, among others, and any entity a member state names as the sole provider of an essential service or as critical (Article 2(2)).¹

The whole scope test, type then size then category, fits in one chain of questions.

Read it from the top. Each diamond is a question about your business, and the label on the arrow into the next box is the answer that leads there. The grey notes are the exits: a business that leaves at either of the first two questions is outside NIS2 on the directive's own terms. The takeaway is the order. Type first, size second, category third. Most confusion comes from starting with size.

Worked example: the Leeds booking software, year by year

The thresholds are in euros, so a UK business has to convert. This example assumes £1 buys €1.15, purely to keep the arithmetic simple. Use the rate your accountant uses.

Year one: 38 staff in full time equivalents, turnover £9 million, balance sheet £5 million. In euros that is €10.35 million turnover and €5.75 million balance sheet. Fewer than 50 staff, and the balance sheet is under €10 million, so the company is small, even though its turnover is over €10 million. Outside NIS2.

Year two: 54 staff. That is over the headcount ceiling for a small enterprise, but it is the first year, so the status does not change yet.

Year three: 58 staff. The ceiling is now exceeded for two consecutive accounting periods, so the company becomes medium sized. It provides a cloud computing service in the EU. NIS2 applies.

Essential or important: what the category changes

Once you are in, you are either an essential entity or an important entity. Article 3 sets it out. Annex I entities that exceed the medium sized ceilings, so large enterprises, are essential. Everyone else in scope is important, which means medium sized Annex I entities and all Annex II entities that pass the size test, unless a member state names them as essential.¹

The obligations are the same for both: the Article 21 measures and the Article 23 reporting. What differs is supervision and the size of the fines.

Essential entities are supervised up front. The authority can run on site inspections, random checks, regular audits and security scans whether or not anything has gone wrong (Article 32).¹ Important entities are supervised after the fact: the authority acts when it has evidence or an indication that the entity does not comply (Article 33).¹

One point is often overstated: that management can be suspended or banned for any non compliance. The power to ask for a temporary ban on a chief executive or legal representative exists only for essential entities, and only after earlier enforcement measures have failed and a deadline has passed (Article 32(5)).¹ For both categories, though, the people who manage the entity must be able to be held liable for breaching their duties (Articles 32(6) and 33(5)).¹

An example: the Brighton marketplace has 60 staff. It is medium sized and in Annex II, so it is an important entity. If it grew past 250 staff it would still be important, because Annex II entities are never essential by size alone. The Leeds booking software, once it passes 250 staff or the large ceilings, would become essential, because cloud computing sits in Annex I.

The fines: a floor under the maximum

Article 34 sets the fines for breaching the measures in Article 21 or the reporting duties in Article 23. Essential entities face a maximum of at least €10 million or at least 2% of total worldwide annual turnover, whichever is higher. Important entities face a maximum of at least €7 million or at least 1.4%, whichever is higher.¹ "At least" matters: these are the lowest caps a member state may set, and a national law may set higher ones.

The cap for a given business is:

$$F_{\max} = \max\left(A,\; r \times T\right)$$

$F_{\max}$ is the lowest maximum fine the directive allows a member state to set. $A$ is the fixed amount, €10 million for an essential entity and €7 million for an important one. $r$ is the turnover rate, $0.02$ for essential and $0.014$ for important. $T$ is the total worldwide annual turnover, in the preceding financial year, of the undertaking the entity belongs to, so the whole group. $\max$ takes whichever of the two is larger. If percentages feel rusty, Foundations: percentages covers them from scratch.

Worked example: two caps

The Brighton marketplace is important, with a group turnover of £35 million. At the example's rate of €1.15 to the pound that is €40.25 million. The turnover part is $0.014 \times 40{,}250{,}000 = 563{,}500$, so €563,500. That is smaller than €7 million, so the cap is at least €7 million.

Now a large cloud provider, essential, with group turnover of €900 million. The turnover part is $0.02 \times 900{,}000{,}000 = 18{,}000{,}000$, so €18 million. That is larger than €10 million, so the cap is at least €18 million.

The pattern: for most medium sized businesses the fixed amount is the one that bites. In both categories the percentage only takes over above €500 million turnover, since $10{,}000{,}000 / 0.02$ and $7{,}000{,}000 / 0.014$ are both $500{,}000{,}000$.

One more rule: if the same conduct is also a personal data breach and the GDPR authority fines you for it, the NIS2 authority may not fine you again for that conduct, although it can still use its other enforcement measures (Article 35).¹

What NIS2 asks you to do: the 10 measures

Article 21(1) asks for "appropriate and proportionate technical, operational and organisational measures" to manage the risks to the systems you use for your services. Proportionate is a real word here: the directive asks the authority to take account of your exposure to risk, your size, and the likelihood and severity of incidents.¹

Article 21(2) then lists what the measures must include at least:¹

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security, including the security of your relationships with your direct suppliers and service providers.
5. Security in buying, developing and maintaining systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess whether your measures work.
7. Basic cyber hygiene and cyber security training.
8. Policies on cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi factor authentication or continuous authentication, and secured voice, video, text and emergency communications, where appropriate.

It is a proper list. It is also, for the most part, what a well run software business should be doing anyway.

For cloud computing services, online marketplaces, managed service providers and the other digital types, the Commission has gone further. Implementing Regulation (EU) 2024/2690 sets out the technical and methodological requirements for these measures, and when an incident counts as significant.⁹ If you are one of those types, that regulation is your detailed checklist, not just Article 21.

Article 20 adds the governance layer. Management must approve the measures, oversee them, and can be held liable for breaches of Article 21. Members of management must follow training.¹

Worked example: the Leeds company's first gap analysis

The booking software company, now medium sized, takes the 10 items and marks each as done, partial or missing.

It has encrypted backups, but nobody has restored one in a year: business continuity is partial. Developers use multi factor authentication on the cloud console, but the support team's admin panel only has passwords: item 10 is partial. It has never assessed its payment provider or its email delivery service: supply chain is missing. There is no written incident procedure at all: incident handling is missing.

The order of work follows the risk and the reporting clock in the next section. Incident handling first, because without it the 24 hour deadline cannot be met. Then multi factor authentication on the admin panel, because that is a door straight into patient bookings. Then the supplier review and a restore test.

Reporting: 24 hours, 72 hours, one month

Article 23 is where NIS2 gets a stopwatch. A significant incident is one that has caused or can cause severe operational disruption or financial loss to you, or considerable material or non material damage to others.¹ For the digital provider types, the implementing regulation makes that concrete: for example, an incident with a direct financial loss above €500,000 or 5% of annual turnover, whichever is lower, or a suspected malicious compromise of the data behind a cloud service or an online marketplace.⁹ For cloud computing, a service completely unavailable for more than 30 minutes is significant.⁹

When a significant incident happens, you report to your national Computer Security Incident Response Team (CSIRT) or competent authority in steps:¹

1. An early warning without undue delay and within 24 hours of becoming aware, saying whether you suspect an unlawful or malicious act and whether there could be a cross border impact.
2. An incident notification within 72 hours of becoming aware, with an initial assessment of severity and impact, and indicators of compromise where available.
3. An intermediate report if the authority asks for one.
4. A final report no later than one month after the incident notification, with a detailed description, the likely root cause, the mitigation and any cross border impact.

Where appropriate, you must also tell the recipients of your service, without undue delay, about significant incidents likely to affect them.¹

Worked example: the Brighton marketplace's long weekend

At 9pm on a Friday, the on call engineer at the Brighton marketplace sees that seller payout details have been changed on 30 accounts by someone using a stolen admin session. That is a suspected malicious compromise of marketplace data, so it is significant.⁹

The early warning is due by 9pm on Saturday. The incident notification is due by 9pm on Monday. If the notification goes in at 4pm on Monday, the final report is due one month later. Payout details are personal data of the sellers who trade as individuals, so the data protection clock starts at the same moment. Under the UK GDPR, and the EU GDPR where it applies, the breach goes to the data protection authority within 72 hours where feasible, unless it is unlikely to result in a risk to people.⁶¹⁰

That is two reports, to two authorities, on overlapping clocks, starting at 9pm on a Friday. This is why the 24 hour deadline is brutal without a written procedure, and why incident handling came first in the Leeds gap analysis.

A UK business serving EU customers

The UK left the EU before NIS2 was adopted, so NIS2 is not UK law. But NIS2 reaches entities that "provide their services or carry out their activities within the Union" (Article 2(1)), and Article 26 deals with businesses that are not established there.¹

For most entities, jurisdiction follows establishment: you are supervised by the member state where you are established.¹ For a named group of digital types, cloud computing providers, data centres, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, social networks and DNS providers among them, jurisdiction follows your main establishment in the Union.¹

If one of those digital types is not established in the Union at all but offers services there, Article 26(3) says it must designate a representative in the Union, established in one of the member states where it offers its services. It then falls under the jurisdiction of that member state. Without a representative, any member state where it provides services may take legal action against it.¹

So a UK business with an Irish or German subsidiary is supervised there. A UK cloud provider, managed service provider or marketplace with no EU establishment needs a representative. The text does not settle neatly a UK entity of another type with no EU establishment: Article 2(1) covers it in principle, but the jurisdiction rules assume an establishment. That is a question for a lawyer in the member state concerned.

An example: the Leeds booking software has no office in the EU, but dental practices in Ireland and the Netherlands use it. It is a cloud computing provider, medium sized, offering its service in the Union. Under Article 26(3) it designates a representative, say in Ireland, and Ireland's rules then apply. It also stays inside the UK regime in the next section, because it serves UK practices too.

The UK regime: NIS Regulations 2018 and the bill that will change them

At home, the Network and Information Systems Regulations 2018 have applied since 10 May 2018.³ They cover operators of essential services, such as energy, transport and water, and relevant digital service providers.³

A relevant digital service provider is a business that provides an online marketplace, an online search engine or a cloud computing service in the UK, has its head office in the UK or a nominated UK representative, and is not a micro or small enterprise under the same Commission recommendation NIS2 uses.³ Its regulator is the Information Commission (still the ICO on its website), which took over from the Information Commissioner on 30 September 2026.¹¹

The duties look familiar. Take appropriate and proportionate measures to manage risks to the systems behind the service.¹² Register with the Information Commission.¹¹ Notify an incident with a substantial impact on the service without undue delay and no later than 72 hours after first becoming aware of it.¹² The penalties are tiered, with a ceiling of £17 million for a material contravention that created, or could have created, a significant risk to or impact on the service.¹³

The update is the Cyber Security and Resilience (Network and Information Systems) Bill, introduced to Parliament on 12 November 2025.⁴ The government's factsheets, last updated on 3 November 2026, describe what it would do:^14151617

1. Bring medium and large managed service providers into scope, with the Information Commission as their regulator.
2. Class data centres above set thresholds as essential services.
3. Let regulators designate critical suppliers.
4. Require an initial notification within 24 hours and a full report within 72 hours, with the National Cyber Security Centre (NCSC) told at the same time, and make digital service providers, managed service providers and data centres tell customers likely to be affected.
5. Extend the cloud and marketplace risk duty to the third party systems the service relies on.
6. Raise the maximum penalties and simplify the bands.

As I check this on 8 November 2026, it is still a bill. The factsheets say it "will come into force in phases once it has become an Act", and legislation.gov.uk lists no such Act for 2026.¹⁴¹⁸ The details above may still change before Royal Assent.

An example: the Leeds company, with 58 staff, provides a cloud computing service in the UK from a UK head office. It is a relevant digital service provider today, registers with the Information Commission, and reports substantial incidents within 72 hours. If the bill passes as described, that becomes 24 hours for the first notice, the same clock NIS2 already runs.

Transposition: check the country, not just the directive

NIS2 is a directive, not a regulation. Each member state writes its own law, and may set stricter rules than the directive (Article 5).¹ Registration, the authority you report to and the exact fines all come from national law.

The transposition has been uneven. On 7 May 2025 the Commission sent reasoned opinions to 19 member states for failing to notify full transposition, among them Germany, Austria, Ireland, France, Spain and the Netherlands.¹⁹ That list is a snapshot, so check the Commission's transposition page for the country you serve before you rely on it.

An example of why: Germany has since acted. Its NIS2 implementation law was published in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I Nr. 301).²⁰ Germany's Federal Office for Information Security (BSI) now says the statutory registration period has already expired.²¹ If you serve German customers from a German establishment and have not registered, that is the first job.

The directive itself is moving too. On 20 January 2026 the Commission proposed targeted amendments to NIS2, which it says will ease compliance for 28,700 companies, including 6,200 micro and small enterprises.² That is a proposal, not law. Plan for the directive as it stands.

Supply chain: why NIS2 reaches businesses outside it

Article 21(2)(d) makes supply chain security a measure in its own right, and Article 21(3) says entities must take into account each direct supplier's vulnerabilities and the quality of its products and security practices, including its secure development procedures.¹

That is why NIS2 reaches further than its own scope. A Bristol software agency with 20 staff is far below the size cap. But if its client is an important entity, that client has to assess it, and will write the assessment into the contract: multi factor authentication, patching times, a named contact for incidents, the right to ask for evidence.

The same applies to your own stack: hosting, payments, email delivery, open source libraries and any outsourced development. On a large cloud platform, write down which controls are theirs and which are yours. I wrote more about vetting suppliers before they undermine your compliance in the GDPR context, and the method carries over.

An example: the Leeds booking software sends appointment reminders through an external email service. Its supplier review records where that provider hosts data, whether it offers multi factor authentication, how it reports incidents and how quickly. It finds the provider promises breach notification "promptly", with no hours stated. Given its own 24 hour clock, the Leeds company asks for a number in the contract.

What it looks like in a Rails or Solidus build

NIS2 compliance is not a tool you buy. It is practice you can show, and in a Ruby on Rails SaaS or a Solidus shop it is fairly ordinary engineering.

Risk assessment starts with the assets (the production database, authentication, the admin area, the API, customer data), what could go wrong with each, and the control for it. Access control means multi factor authentication on the admin panel, production servers, the deployment pipeline and the cloud console, and in a Solidus store an admin backend with properly segmented roles.

Encryption means TLS on every connection and encrypted backups. Rails has Active Record Encryption for encrypting sensitive attributes at the application level.²² Rails also has a built in rate_limit for controllers, which helps against password guessing on login and password reset.²³

Monitoring is what makes the 24 hour clock possible at all: centralised logs, alerts on unusual admin activity, and someone who receives them out of hours. Business continuity means testing the restore, not just taking the backup, and writing down how long it takes and how much data you could lose.

Training covers developers (secure coding, the OWASP Top 10, the incident procedure) and management, who under Article 20 must understand enough to approve and oversee the measures.¹

Worked example: a staging drill

The Brighton marketplace runs a drill on staging. At 10am a developer revokes every admin session, then restores the payout table from the night's encrypted backup. The restore takes 47 minutes. The backup is from 2am, so in a real incident up to eight hours of payout changes would have to be rebuilt from the payment provider's records. Both numbers go into the continuity plan, with the date of the drill. Next quarter the team runs it again and tries to beat them.

How I build for this

This is where my work comes together. I build SaaS platforms on Ruby on Rails and shops on Solidus, and I build them to be secure and resilient from the start: encrypted data handling, multi factor authentication, role based access, logging that someone actually reads, and documented incident procedures.

Every system I deliver gets a penetration testing pass with the Kali Linux toolkit before it faces the internet, using tools such as Nmap, Burp Suite, Metasploit and OWASP ZAP, and the findings are documented with severity and a fix. That record feeds straight into the evidence an NIS2 authority asks for.

I also help work out whether NIS2 applies in the first place, from the annex definitions and the size test to where you would register, with a lawyer in the member state for the national questions. And on the growth side, I build marketing that does not open new holes: first party analytics, secure forms and privacy respecting personalisation rather than a pile of third party scripts.

What to do now

Work through these in order.

1. Check the type. Is the service you provide in the EU one of the types in Annex I or II? For SaaS, read the cloud computing definition. For a shop, ask whether other traders sell through you.
2. Check the size. Headcount in full time equivalents, turnover and balance sheet, with linked and partner companies added, over two accounting periods.
3. Find your country. Where are you established, and if nowhere in the EU, where will your representative be? Read that country's law and registration rules.
4. Check the UK side. If you provide a marketplace, a search engine or cloud computing in the UK and you are not small, you are probably a relevant digital service provider already.
5. Run the gap analysis against the 10 measures, and against Implementing Regulation 2024/2690 if you are a digital provider type.
6. Build the incident procedure first. If you cannot send an early warning within 24 hours today, that is the priority.
7. Brief and train management. Under Article 20 they approve and oversee the measures, and they can be held liable.
8. Document everything. Risk assessments, measures, training records, drills and supplier reviews. An authority asks for evidence, not intentions.

NIS2 is not going away, and the UK is moving in the same direction. The businesses that treat it as a reason to build properly, rather than as paperwork, end up with fewer incidents, quicker recoveries and customers who trust them with more.

Footnotes

1. European Parliament and Council, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Articles 2, 3, 5, 6, 20, 21, 23, 26, 32 to 35, 41, 44, recitals 28 and 33 and Annexes I and II, Official Journal L 333, 27 December 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555

2. European Commission, NIS2 Directive: securing network and information systems, Shaping Europe's digital future, last updated 2 July 2026, https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

3. The Network and Information Systems Regulations 2018 (SI 2018/506), regulation 1, legislation.gov.uk, latest available version, https://www.legislation.gov.uk/uksi/2018/506/regulation/1

4. Department for Science, Innovation and Technology, Cyber Security and Resilience Bill, GOV.UK collection, https://www.gov.uk/government/collections/cyber-security-and-resilience-bill

5. European Parliament and Council, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), recital 12 and Annex I Part II, Official Journal, 2024, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847

6. European Parliament and Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 33, EUR-Lex, https://eur-lex.europa.eu/eli/reg/2016/679/oj

7. European Parliament and Council, Directive 2005/29/EC on unfair commercial practices, consolidated version of 28 May 2022, Article 2(n), EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02005L0029-20220528

8. European Commission, Recommendation 2003/361/EC concerning the definition of micro, small and medium sized enterprises, Annex Articles 2, 4, 5 and 6, Official Journal L 124, 2003, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32003H0361

9. European Commission, Implementing Regulation (EU) 2024/2690 of 17 October 2024 on the technical and methodological requirements of cybersecurity measures and significant incidents for digital providers under Directive (EU) 2022/2555, Articles 3, 7 and 11, Official Journal, 18 October 2024, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2690

10. UK General Data Protection Regulation, Article 33, notification of a personal data breach to the Information Commission, legislation.gov.uk, latest available version, https://www.legislation.gov.uk/eur/2016/679/article/33

11. The Network and Information Systems Regulations 2018 (SI 2018/506), regulation 14, as amended from 30 September 2026 by SI 2026/386 and SI 2026/1015, legislation.gov.uk, https://www.legislation.gov.uk/uksi/2018/506/regulation/14

12. The Network and Information Systems Regulations 2018 (SI 2018/506), regulation 12, legislation.gov.uk, latest available version, https://www.legislation.gov.uk/uksi/2018/506/regulation/12

13. The Network and Information Systems Regulations 2018 (SI 2018/506), regulation 18, legislation.gov.uk, latest available version, https://www.legislation.gov.uk/uksi/2018/506/regulation/18

14. Department for Science, Innovation and Technology, Cyber Security and Resilience (Network and Information Systems) Bill factsheets: summary of the Bill, GOV.UK, updated 3 November 2026, https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/summary-of-the-bill

15. Department for Science, Innovation and Technology, Cyber Security and Resilience (Network and Information Systems) Bill factsheets: incident reporting, GOV.UK, updated 3 November 2026, https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting

16. Department for Science, Innovation and Technology, Cyber Security and Resilience (Network and Information Systems) Bill factsheets: relevant managed service providers, GOV.UK, updated 3 November 2026, https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/relevant-managed-service-providers

17. Department for Science, Innovation and Technology, Cyber Security and Resilience (Network and Information Systems) Bill factsheets: relevant digital service providers, GOV.UK, updated 3 November 2026, https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/relevant-digital-service-providers

18. The National Archives, UK Public General Acts 2026, title search for "cyber", legislation.gov.uk, searched 8 November 2026, https://www.legislation.gov.uk/ukpga/2026?title=cyber

19. European Commission, NIS2 transposition in EU countries, Shaping Europe's digital future, last updated 1 July 2025, https://digital-strategy.ec.europa.eu/en/policies/nis-transposition

20. Federal Republic of Germany, Gesetz zur Umsetzung der NIS 2 Richtlinie, Bundesgesetzblatt 2025 I Nr. 301, 5 December 2025, https://www.recht.bund.de/bgbl/1/2025/301/VO.html

21. Bundesamt für Sicherheit in der Informationstechnik, NIS 2 regulierte Unternehmen, bsi.bund.de, accessed 8 November 2026, https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html

22. Ruby on Rails Guides, Active Record Encryption, guides.rubyonrails.org, https://guides.rubyonrails.org/active_record_encryption.html

23. Ruby on Rails API, ActionController::RateLimiting::ClassMethods, rate_limit, api.rubyonrails.org, https://api.rubyonrails.org/classes/ActionController/RateLimiting/ClassMethods.html