Legal sources with official primary sources

Printed ·

Skip to main content
Skip to the answer

Source status and reading dates are reported separately. A reading date is not source verification.

Back to the act

EU regulatory register · NIS2

Article 7National cybersecurity strategy

CELEX 32022L2555 · Read on 2026-08-18 · Chapter II

Share this page

Short answer

1. Each Member State shall adopt a national cybersecurity strategy that provides for the strategic objectives, the resources required to achieve those objectives, and appropriate policy and regulatory measures, with a view to achieving and maintaining a high level of cybersecurity.

Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/nis2-2022-2555/artikel-7 · Short answer as data · Official text

NIS2, cybersecurity in short

Essential and important entities must take security measures, report significant incidents within 24 hours, and management is personally accountable.

Source: NovaCopilot

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

1. Each Member State shall adopt a national cybersecurity strategy that provides for the strategic objectives, the resources required to achieve those objectives, and appropriate policy and regulatory measures, with a view to achieving and maintaining a high level of cybersecurity. The national cybersecurity strategy shall include:

(a)

objectives and priorities of the Member State’s cybersecurity strategy covering in particular the sectors referred to in Annexes I and II;

(b)

a governance framework to achieve the objectives and priorities referred to in point (a) of this paragraph, including the policies referred to in paragraph 2;

(c)

a governance framework clarifying the roles and responsibilities of relevant stakeholders at national level, underpinning the cooperation and coordination at the national level between the competent authorities, the single points of contact, and the CSIRTs under this Directive, as well as coordination and cooperation between those bodies and competent authorities under sector-specific Union legal acts;

(d)

a mechanism to identify relevant assets and an assessment of the risks in that Member State;

(e)

an identification of the measures ensuring preparedness for, responsiveness to and recovery from incidents, including cooperation between the public and private sectors;

(f)

a list of the various authorities and stakeholders involved in the implementation of the national cybersecurity strategy;

(g)

The article continues in the official text.

Open the article on EUR-Lex

Follow-up questions

Other articles in this chapter

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Verifiable trust signals

  • Source-linked answers and explicit evidence gaps
  • Obligations, controls, risks and consequences
  • Stable objects and verifiable checksums
  • Rule-based objects, optional source-linked reasoning
  • Model card, source status and audit

Model cardAudit