Is Zero Trust required by NIS2?

Who this is for: security and network leads who have been told that “NIS2 means Zero Trust”. Legal status as of October 4, 2026; check it again before relying on it. It says nothing about whether a company is in scope or compliant.

What is NIS2, and when did it apply?#

NIS2 is Directive (EU) 2022/2555 of December 14, 2022, “on measures for a high common level of cybersecurity across the Union”. The European Commission describes it as a unified legal framework for cybersecurity in 18 critical sectors, covering, as a rule, medium-sized and large entities. It repealed the first NIS Directive (2016/1148) with effect from October 18, 2024 (Article 44).

A directive binds Member States, which write it into national law. Article 41(1) required them to adopt and publish their measures by October 17, 2024, and apply them from October 18, 2024. Many missed the date: the Commission sent letters of formal notice to 23 Member States on November 28, 2024, and reasoned opinions to 19 of them, Bulgaria included, on May 7, 2025. On July 8, 2026, it referred Ireland, Spain, France, and the Netherlands to the Court of Justice.

So a company is bound by the national law, read with the Directive, and, for certain digital providers, by an implementing regulation (below).

What does recital 89 say, and is it binding?#

Recital 89 says essential and important entities should adopt “basic cyber hygiene practices, such as zero-trust principles”, and continues with software updates, device configuration, network segmentation, identity and access management, and user awareness. It says “should” and “such as”: examples, not a list of required technologies. And it is a recital: the Court of Justice has held that a preamble has no binding legal force (Nilsson, C-162/97, paragraph 54). The obligations sit in the Articles.

The Directive does not define Zero Trust. NIST SP 800-207 describes it as an evolving set of paradigms that move defenses from static, network-based perimeters to users, assets, and resources, with authentication and authorization performed before a session to a resource is established.

What does Article 21(2) require?#

Article 21(1) requires “appropriate and proportionate technical, operational and organisational measures” to manage risks to network and information systems, weighed against the entity’s exposure to risk, its size, and the likelihood and severity of incidents, including their societal and economic impact. Article 21(2) says the measures follow an all-hazards approach and “shall include at least” ten areas:

Zero Trust is not on the list, and in the Directive’s text network segmentation appears only in the recitals. Three neighboring provisions matter. Under Article 20(1), management bodies approve the measures, oversee their implementation, and can be held liable for infringements of Article 21 by their entities. Under Article 21(4), an entity that finds it does not comply must take corrective measures without undue delay. And Article 25(1) asks Member States to encourage standards without imposing or favoring a particular type of technology.

Where do the implementing rules go further?#

For DNS service providers, TLD registries, cloud computing, data center, and content delivery network providers, managed and managed security service providers, online marketplaces, search engines, social networking platforms, and trust service providers, Commission Implementing Regulation (EU) 2024/2690 of October 17, 2024, sets the technical requirements behind each Article 21(2) point. It has been in force, and directly applicable, since November 7, 2024. Its Annex section 11, on access control, requires access rights based on need-to-know, least privilege, and separation of duties, and multi-factor or continuous authentication where appropriate. It also names zero-trust architectures as an example of secure-engineering principles (point 6.2.2(b)) and requires network segmentation based on the risk assessment (point 6.8). Even there, Zero Trust is an example, not the obligation.

How do the measures map to technical controls? The NIS2 Article 21(2) control map#

The NIS2 Article 21(2) control map is our engineering reading of where a Zero Trust design contributes. It is not an official mapping, it does not say what a regulator will accept, and it promises no compliance. “Contributes” means the control produces evidence or enforcement for that point, never that the point is satisfied.

Read down the last column: a program that is only a Zero Trust rollout leaves most of Article 21(2) unaddressed.

What else does NIS2 require that Zero Trust does not cover?#

Reporting is the clearest example. Article 23(4) requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, an intermediate report on request, and a final report no later than one month after the notification. No network architecture produces those documents; they need an owner, a template, and a rehearsal.

What is the status in Bulgaria?#

Bulgaria transposed NIS2 by amending its Cybersecurity Act. The amending law was adopted by the 51st National Assembly on February 5, 2026, and published in State Gazette issue 17 of February 13, 2026. Its additional provisions state that the Act introduces requirements of Directive (EU) 2022/2555, and a new Article 4a defines essential and important entities. The law sets no entry-into-force date of its own; under Article 5(5) of the Bulgarian Constitution, laws enter into force three days after promulgation unless they set another date. The Commission closed its infringement procedure against Bulgaria in late September 2026; the Bulgarian ministry was notified on September 30 and press reported it on October 1.

The law leaves designation to later acts. The Council of Ministers designates the sectoral competent authorities by decision within six months of entry into force, and those authorities designate the essential and important entities under a methodology the Council adopts. The responsible minister, now the Minister of Innovation and Digital Transformation after the 2026 reorganization, keeps the register. The Bulgarian Act also states technology neutrality, never mentions zero trust, and requires management bodies to be trained every two years. These are unofficial translations of the Bulgarian text, not legal advice: check the official text and ask counsel.

What are practical first steps?#

1. Establish scope. Ask counsel whether the organization is an essential or important entity under the national law, and follow the designation by the competent authority.
2. Inventory applications and access paths. This feeds points (a), (i), and (j).
3. Close the plain gaps. Multi-factor authentication on administrative and remote access, and a list of who can reach what, are cheap and map to (i) and (j).
4. Pilot, then expand. Move one application group onto identity-based access, keep the old path until the group is stable, and write down the rollback.
5. Assign the non-technical points. Reporting, suppliers, continuity, and training need named owners; management approval is an Article 20 matter.