NIS2 Denmark: what you need to know about compliance and certification

What does this mean for my company?

1. Registration

The supervisory authority must maintain a list of essential and important entities under its jurisdiction. Essential and important entities must register with the relevant supervisory authority within no later than 2 weeks after the entity falls within the scope of the Danish NIS2 Act. Entities must provide the relevant authority(ies) with the following information:

• Name of the entity
• Address, e-mail addresses, telephone numbers and other contact details
• IP address range
• Sector and subsector (see Annexes I and II of the NIS2 Act)
• List of EU Member States where the entity provides services covered by the NIS2 Act

Changes to the above data should be reported immediately and within 2 weeks of the change.

DNS service providers, operators of top-level domain names, entities providing domain name registration services and providers of cloud computing services, data centre services, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, of online search engines and of platforms for social networking services should register with the relevant competent authority within no later than 3 months after the entity falls within the scope of the Danish NIS2 Act. The following information should be provided:

• Name of the entity
• Address of headquarters and other branches in the EU or address of representative
• Sector and subsector (see Annex I and II of the NIS2 Act)
• Address, e-mail addresses, telephone numbers and other contact details
• IP address range
• List of EU Member States where the entity provides services covered by the NIS2 Act.

The above information should be submitted by 1 October 2025.

Register your entity here.

2. Control measures

If your organisation is categorised as an essential or important entity, this means that you are responsible for implementing appropriate technical and organisational measures to ensure the security of your network and information systems. These cybersecurity management measures cover at least:

• Risk analysis and security policies for communication networks and information systems
• Incident management
• Business continuity and crisis management and, if necessary, the use of secure backup systems
• Supply chain security
• Security in the acquisition, development and maintenance of network and information systems, including vulnerability response and disclosure
• Policies and procedures to assess the effectiveness of cyber security risk management measures
• Security aspects regarding cyber hygiene and cyber security training
• Policies and procedures on cryptography and, where appropriate, encryption
• Personnel security, access control policies and asset management
• Use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications and secure emergency communication systems within the entity, where applicable.

The European Commission has elaborated the above minimum cybersecurity measures in the implementing regulation 2024/2690 for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engines and social networking service platforms, and trust service providers.

More information on management measures can be found here.

3. Reporting obligation for significant incidents

Essential and important entities are required from 1 July 2025 to notify the sectoral authority and the CSIRT when a significant incident occurs. In addition, they must also notify the recipients of their services if the significant incident affects the provision of services relating to Annex I and II (sub-)sectors.

An incident is considered significant if:

• The incident has led or may lead to serious disruption of services or financial losses for the affected entity or
• The incident has affected or may affect other natural or legal persons by causing significant physical or immaterial damage.

The significant incident is reported by the essential and important entities through an online form according to the following procedure:

1. immediately and within 24 hours of becoming aware of the significant incident, the entity submits an early warning, including notification of probable cause and any transboundary impact;
2. immediately and within 72 hours of becoming aware of the significant incident, the entity shall communicate an incident notification that includes an information update and an initial assessment of the incident;
3. at the request of the relevant CSIRT, the entity submits an interim report;
4. No later than 1 month after the incident notification, the entity submits a final report indicating:
   1. 1. A detailed description of the incident, as well as its severity and consequences;
      2. The type of threat or root cause likely to have led to the incident;
      3. Risk mitigation measures applied and ongoing;
      4. The cross-border impact of the incident, if applicable.

5. If the incident is still ongoing one month after the incident report, the entity shall submit a preliminary report and a final report shall be submitted within one month of the incident resolution.

The European Commission has defined the criteria for a significant incident in the implementing regulation 2024/2690 for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engines and social networking service platforms, and trust service providers. These special rules take precedence over national rules in case of inconsistencies.

Finally, all entities, regardless of whether they fall within the scope of the NIS2 Act, can voluntarily report (significant) incidents, cyber threats and near-incidents via the e-service.

More information regarding incident reporting can be found here.

4. Obligations and responsibilities of management

The governing bodies of essential and important entities are responsible for compliance with the NIS2 Act and must fulfil several obligations including:

• Approving cybersecurity management measures and monitoring their compliance
• Undergoing training to have sufficient knowledge and skills to identify risks and assess control measures and their impact on their services
• Ongoing training of the cyber security entity’s employees on cyber security

Governing bodies are liable for non-compliance with the NIS2 Act.

5. Cooperation with authorities

Essential and important entities must cooperate with the national authorities. This concerns the exchange of information on the security of network and information systems, reporting incidents, cooperation with the inspection service, etc.