DenmarkNIS 2-loven, Cybersecurity Risk-Management Measures and Registration
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential entity (Section 4) or an important entity (Section 5) drawn from Annex 1 or Annex 2; Annex 1's digital-infrastructure entry (item 8) names an internet-exchange-point provider, a DNS provider other than a root-server operator, a top-level-domain registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider, and a provider of a public electronic-communications network or service, and Annex 2's digital-provider entry (item 6) separately names an online marketplace, an online search engine, and a social-networking-services-platform provider, so a service in any of those lines is reached once it clears the entity's size threshold. The wider sector classes (energy, transport, water, health, waste, chemicals, food, manufacturing and the rest) are reached too, by declaring that you are an essential or important entity; the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or to provide your services, and to prevent an incident or minimise its impact on the recipients of your services and on other services.NIST CSF 2.0ID.RA-06
- Cover at minimum: risk-analysis and information-system-security policies; incident handling; operational continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in acquiring, developing and maintaining your network and information systems, including vulnerability handling and disclosure; policies and procedures for assessing the effectiveness of your cybersecurity risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies and procedures on the use of cryptography and, where relevant, encryption; personnel security, access-control policies and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communication, and secured internal emergency-communication systems.NIST CSF 2.0GV.PO-01
- Where you fall short of any of these requirements, take without undue delay all necessary, appropriate and proportionate corrective measures.NIST CSF 2.0ID.RA-06
- Have your management board (ledelsesorgan) approve these measures and oversee their implementation, and ensure its members attend relevant cybersecurity risk-management training and encourage similar training for your other staff.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- If you are a DNS provider, top-level-domain registry, domain-name-registration-service provider, or a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services, register with the relevant competent authority within 3 months of first falling within the Act's scope, stating your name, address, sector and sub-sector, contact details, and the EU member states where you provide services. Other essential and important entities register within 2 weeks of first falling within scope. Anyone already in scope when the Act commenced had to register by .NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 32(1) punishes a violation of, among other provisions, Section 6(1) or (2), Sections 9 or 10, or Section 11(1) to (6) with a criminal fine (bøde), not an administrative fine the competent authority itself may impose; the offence is prosecuted through Denmark's ordinary criminal process (police and public prosecutor, with the courts where contested) rather than a supervisory penalty decision. Section 32(2) attaches corporate (legal-person) criminal liability under Chapter 5 of the Criminal Code (straffeloven). The Act states no fixed monetary maximum and no turnover-percentage cap of its own; the amount of a Section 32 fine is set case by case under Denmark's general criminal-sentencing principles rather than by a statutory ceiling, unlike the EUR 10 million/2 percent and EUR 7 million/1.4 percent administrative-fine tiers most other Member States' NIS2 transpositions enact.
Who enforces it
Enforcement body
The authority the Minister for Societal Security and Preparedness (Ministeren for samfundssikkerhed og beredskab) designates by executive order as competent authority for the entity's sector, subsector or entity type, after negotiating with the minister responsible for that sector (Section 20(1)); retsinformation.dk listed no order or circular issued under this Act as of , so which named authority that will be for the digital-infrastructure and digital-provider lines this row flags is not yet settled in the primary record.
Settledness
- As of
- Open questions
- Retsinformation.dk's own register of orders and circulars issued under this Act listed none as of , so which authority has the Minister for Societal Security and Preparedness designated under Section 20 as competent for the digital-infrastructure and digital-provider lines this row flags?
- Has the responsible minister issued the further rules on risk-management measures that Section 6(3) reserves the power to set, and if so, do they narrow or particularise any of the ten minimum elements Section 6(1) already lists?
What this law does
Section 6 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or to provide its services, and to prevent an incident or minimise its impact on the recipients of its services and on other services, covering at minimum risk-analysis and information-system-security policy, incident handling, operational continuity, supply-chain security, secure acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policy, cyber hygiene and training, cryptography policy, personnel and access-management security, and, where relevant, multi-factor or continuous authentication and secured communications (Section 6(1)); an entity that falls short must take corrective measures without undue delay (Section 6(2)).
Section 7 requires the entity's management board (ledelsesorgan) to approve these measures, oversee their implementation, and ensure its own members receive cybersecurity risk-management training.
Section 9 requires a DNS provider, a top-level-domain registry, a domain-name-registration-service provider, and a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services to register with the relevant competent authority within 3 months of first falling within the Act's scope; Section 10 requires other essential and important entities to register within 2 weeks.
This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Articles 20 and 21. By Section 1(2), it does not apply to an entity covered by Denmark's separate energy-sector preparedness Act, its telecommunications-sector security and preparedness Act, or the financial entities the Financial Business Act's Section 333(1) designates, each of which runs its own parallel regime.
By Section 33(4) to (7), it also repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .