NIS2 and Email Security: What EU Senders Need to Know

The NIS2 directive makes email authentication and transport security a regulatory matter for thousands of EU organizations. What it requires and where email fits.

For years, email authentication was a deliverability concern with security benefits. The EU's NIS2 directive moves it into regulatory territory: organizations in scope must implement state-of-the-art security measures across their networks and information systems, and email, as the primary phishing vector, sits squarely inside that obligation. This article maps what the directive actually demands to the email controls that satisfy it. It is an engineering overview, not legal advice; scope questions belong with counsel.

Who is in scope

NIS2 (Directive (EU) 2022/2555) replaced the original NIS directive and widened it drastically. Essential entities include energy, transport, banking, health, water, and digital infrastructure, the last of which covers DNS providers, TLD registries, cloud providers, and data centers. Important entities add postal services, waste, chemicals, food, manufacturing of critical products, and digital providers such as online marketplaces and search engines.

The default size threshold captures organizations with at least 50 employees or EUR 10 million annual turnover, but certain categories, including qualified trust service providers and DNS services, are in scope regardless of size. Suppliers to in-scope entities also feel the directive secondhand through its supply chain provisions, which is how NIS2 questionnaires end up on the desks of companies that are not themselves regulated.

What Article 21 demands, translated to email

Article 21 lists minimum measures: risk analysis and security policies, incident handling, business continuity, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography policies, access control, and multi-factor authentication. The directive is technology-neutral, but ENISA's implementing guidance and national authorities consistently read email authentication and transport encryption into the state-of-the-art standard.

Concretely, an email security posture that stands up to an NIS2 audit looks like the stack this publication has been documenting all along: SPF, DKIM on all streams, DMARC at an enforcement policy with monitored aggregate reports, TLS on transport with MTA-STS or DANE plus TLS-RPT, inbound filtering with anti-spoofing checks, MFA on mailbox and ESP admin access, and documented procedures for the day something breaks.

The incident reporting clock

NIS2's reporting regime is where email incidents meet hard deadlines. A significant incident, one causing or capable of causing severe operational disruption or considerable damage, triggers an early warning to the national CSIRT within 24 hours of awareness, a fuller incident notification within 72 hours, and a final report within a month. A successful phishing compromise of corporate mailboxes, a domain spoofing campaign against your customers, or a takeover of your ESP account can all qualify.

The operational consequence: your deliverability and security incident runbooks need a regulatory branch. Whoever handles the technical response must know who decides significance, who files the early warning, and how the timeline is documented. Discovering the reporting duty during the incident is how 24 hours evaporate.

Enforcement and why management now asks about DMARC

Essential entities face fines up to EUR 10 million or 2% of global turnover, whichever is higher; important entities up to EUR 7 million or 1.4%. More pointed is Article 20: management bodies must approve the risk measures, oversee their implementation, and can be held personally liable for infringements, with training obligations attached. Security teams that spent years failing to get authentication projects prioritized now have a directive that makes the gap a board-level exposure.

That is the honest framing for the email community: NIS2 does not name DMARC or MTA-STS anywhere in its text. What it does is convert state of the art from a best-practice phrase into an auditable legal standard, and in email, the state of the art is well documented, cheap to deploy, and conspicuous when absent.

If NIS2 applies to you, the email workstream is the approachable part of compliance: the controls are known, the tooling is mature, and most of it doubles as deliverability improvement. Map your current posture against the checklist, close the gaps, and document as you go. The documentation is half the compliance.