NIS2 and email infrastructure
The NIS2 Directive expands EU cybersecurity requirements to many more businesses. What it means for how you handle email, and what to ask of your email vendors.
By Xander Groesbeek, founder · Published January 2026 · Updated October 2026 · 8 min read
In brief
The issue. NIS2 has applied since 18 October 2024. It brings medium and large companies in many more sectors under EU cybersecurity rules, makes management accountable, and sets a 24-hour clock for reporting significant incidents.
What it means for you. Email is a core system and a common way in for attackers, so it falls under your risk measures: access control, encryption, incident handling. The vendors that process your email are part of your supply chain, and if you supply a NIS2 company, expect its security questionnaire.
What to do.
- Require multi-factor authentication for email and admin access.
- Review which apps can read your mailboxes, and cut access to what each one needs.
- Ask every email vendor where your email is processed, who can read it, how long it is kept, and how fast they report incidents.
- to send an early warning of a significant incident
- 24 hours
- to follow with a full incident notification
- 72 hours
- employees or €10m turnover puts a company in a covered sector in scope
- 50+
- of global turnover: the maximum fine for essential entities
- €10m or 2%
What is NIS2?
NIS2 is the EU's updated cybersecurity law. It replaced the 2016 NIS Directive and has applied since 18 October 2024; each member state turns it into national law. Compared with NIS1 it covers more companies, makes management accountable, and sets fixed reporting deadlines.
| Change from NIS1 | What it means |
|---|---|
| Broader scope | Many more sectors and company sizes covered |
| Size-cap rule | All medium and large entities in covered sectors must comply |
| Management accountability | Leadership can be held personally liable |
| Stricter reporting | 24-hour early warning, then detailed follow-ups |
| Supply chain | Entities must assess their suppliers' cybersecurity |
| Higher penalties | Up to €10 million or 2% of global annual turnover |
Does NIS2 apply to your business?
If you are a medium or large company in a covered sector, you are most likely in scope. Small companies are generally exempt, but may still feel NIS2 through their customers.
Size thresholds
| Classification | Employees | Annual turnover | NIS2 status |
|---|---|---|---|
| Large enterprise | 250 or more | Over €50 million | In scope |
| Medium enterprise | 50 to 249 | €10 to 50 million | In scope |
| Small enterprise | Fewer than 50 | Under €10 million | Generally exempt* |
*Some small businesses are still in scope, for example the sole provider of an essential service in a region, or trust service providers.
Sectors covered
| Essential entities (highest obligations) | Important entities |
|---|---|
| Energy (electricity, oil, gas, hydrogen) | Postal and courier services |
| Transport (air, rail, water, road) | Waste management |
| Banking and financial markets | Chemical manufacturing and distribution |
| Healthcare | Food production and distribution |
| Drinking water and wastewater | Manufacturing (medical, computers, electronics, machinery, vehicles) |
| Digital infrastructure | Digital providers (marketplaces, search engines, social platforms) |
| ICT service management (B2B) | Research organisations |
| Public administration | |
| Space |
Not in scope? Your customers may be
NIS2 requires covered entities to manage cybersecurity risk in their supply chain. If you sell software or services to medium or large EU companies in covered sectors, expect security questionnaires, requests for compliance documentation and evidence of your security practices, even as a small vendor.
What NIS2 requires: four pillars
Covered entities must take "appropriate and proportionate" technical and organisational measures. They fall into four areas, each with a direct effect on email.
| Pillar | What it asks | For email |
|---|---|---|
| Risk management | Measures including multi-factor authentication, policies on cryptography and, where appropriate, encryption, network security, incident handling, business continuity and supply chain security | MFA on mailboxes and admin access, TLS in transit, vetted email vendors |
| Corporate accountability | Management approves the measures, is trained, and can be held personally liable | Leadership has to understand the email risks it signs off on |
| Incident reporting | Multi-stage reporting of significant incidents (below) | You need to detect an email incident in time to report it |
| Business continuity | Tested backups, disaster recovery, crisis management | A plan for when email processing stops |
Management accountability in practice
- Management must approve the risk management measures.
- Board members and executives can face personal sanctions.
- Leadership must follow cybersecurity training.
- Governance failures can lead to temporary bans from management roles.
Incident reporting
A significant incident must be reported in three stages. "Significant" means it causes or could cause severe operational disruption or financial loss, or affects other people or organisations.
| Deadline | Report | Content |
|---|---|---|
| 24 hours | Early warning | That a significant incident has occurred |
| 72 hours | Incident notification | The incident and the mitigation measures taken |
| 1 month | Final report | Root cause, recovery and long-term improvements |
What NIS2 means for email
Email is a common attack vector and a critical business system, so NIS2's measures apply to it directly: who can sign in, how it is protected, which tools can read it, and which vendors handle it.
| Area | What to have in place |
|---|---|
| Authentication | NIS2 names "multi-factor authentication or continuous authentication solutions". Use MFA for email accounts and email administration, and API keys or OAuth for integrations. |
| Encryption | NIS2 names "secured voice, video and text communications" and the use of encryption where appropriate. Enforce TLS in transit; consider encryption at rest and end-to-end encryption for sensitive mail. |
| Access control | Least privilege: limit who can open shared mailboxes, log who accesses what, and control what automation tools can read. |
Full mailbox access is harder to justify
Many email automation tools (Zapier, Power Automate) ask for OAuth access to an entire mailbox. Under NIS2's least-privilege principle that is hard to justify. Processing only the email streams that need automating fits it better.
Ask your email vendors
Your email vendors are part of your supply chain. These are the questions to put to each of them.
| Question | Why it matters |
|---|---|
| Where is email data processed? | Jurisdiction affects incident reporting |
| What access do they have? Can they read content? | Least privilege applies to vendors too |
| How do they handle incidents, and will they tell you in time? | Your 24-hour clock may depend on their notice |
| Which certifications or audits can they show? | Evidence for your own supplier assessment |
Penalties and enforcement
Fines are far higher than under NIS1, and supervisors gain wider powers.
| Entity type | Maximum fine (whichever is higher) |
|---|---|
| Essential entities | €10 million or 2% of global annual turnover |
| Important entities | €7 million or 1.4% of global annual turnover |
Beyond fines, supervisors can order:
- Regular audits and security inspections
- Binding instructions to implement specific measures
- Temporary bans on individuals holding management positions
- Public disclosure of non-compliance
Timeline
NIS2 applies now; national laws are arriving at different speeds. If you are in a covered sector, prepare now rather than waiting for your own country's law.
| When | What |
|---|---|
| 18 October 2024 | NIS2 applies, NIS1 repealed |
| Germany | Implementation act passed November 2025, effective December 2025 |
| Other member states | Varying timelines; some behind schedule |
Practical steps for email infrastructure
Start with access, then build detection and vendor checks, then reduce how much of your email third parties can see.
| When | Action |
|---|---|
| Now | Enable MFA everywhere: email accounts, admin panels, API access |
| Audit access: who can reach which email data? | |
| Review OAuth permissions: which third-party apps can read your email? | |
| Document your email flow: where does email data go, and who processes it? | |
| Next | Log email access and processing |
| Set incident procedures: how will you detect and report an email incident? | |
| Assess vendors: request security documentation from email service providers | |
| Review encryption: enforce TLS, consider more where needed | |
| Ongoing | Minimise third-party access: selective processing over full mailbox access |
| Consider jurisdiction: EU-hosted email infrastructure simplifies compliance | |
| Plan for incidents: the 24-hour clock starts when you become aware of one | |
| Train leadership on email security risks |
How EmailConnect fits
Against the vendor questions above, this is where EmailConnect stands. Each item links to the page behind it.
- No access to your mailbox. You send or forward mail to addresses we run; only that mail is processed, and we never hold a password or token for your mailbox. Security and privacy →
- Processed in the EU. The application, database and mail server run at Hetzner in Germany; optional attachment storage and backups at Scaleway in France and the Netherlands. No US company is in the processing chain, apart from optional sign-in with Google or GitHub. Sub-processors →
- Email content exists only as long as you choose: one hour on Free and Maker, 24 hours by default on Business and Platform, deletable there through the API once your webhook has it; with Data Residency Mode (Platform) it is never stored. Data retention →
- Encrypted and signed. TLS 1.2 and 1.3 for the dashboard, the API and webhook deliveries; storage keys and webhook secrets encrypted at rest with AES-256-GCM; every delivery can be signed (HMAC-SHA256). Webhook signing →
- Multi-factor sign-in. Switch off emailed sign-in links and your account only opens with a password plus an authenticator code, or with a passkey; Google and GitHub sign-in are refused too. Sign-in security →
- Incidents and audit trail. We notify you of a personal data breach without undue delay, as the data-processing agreement sets out. Sign-ins, configuration changes and attachment downloads are logged for 90 days by default. Incidents and access →
- Failed deliveries are retried up to 7 times over about 22 hours, within your retention window, with one ID per email so your endpoint can drop duplicates. Delivery and retries →
If your procurement requires a specific certification, audit or penetration test, tell us what you need.
All answers for your security review: trust center →
Sources and further reading
- NIS2 Directive — European Commission
- NIS2 Technical Implementation Guidance — ENISA
- NIS2 Directive FAQs — European Commission
- NIS2 Requirements Overview
- NIS2 Requirements: A Complete Guide — DataGuard
Related
Trust center
Where your email is, who can access it, how long it is kept: the answers for a security review.
Built for European privacy
EU hosting, GDPR compliance, and data retention policies from the ground up.
Hidden risks of email automation
What "connect your Gmail" really means for your data security and compliance.
Selective email access vs full mailbox
Why forwarding-based processing beats OAuth for security and compliance.
Questions about NIS2 and your email infrastructure? We're not lawyers, but we're happy to discuss the technical aspects. Get in touch.