What security requirements and reporting deadlines follow from NIS2?

Entities in scope must have risk-based security management measures, including risk analysis, incident handling, business continuity, supply chain security, access control and cryptography, and management is accountable for putting them in place. A significant incident is notified to the authority within 24 hours, reported with an updated assessment within 72 hours and finally reported within one month. Norway implements the requirements through the Digital Security Act and its regulation, building on the NIS framework in the EEA.