Article 9 — National cyber crisis management frameworks

NIS2, Directive (EU) 2022/2555

What does NIS2 Article 9 say?

Short answer, straight from the official text

1. Each Member State shall designate or establish one or more competent authorities responsible for the management of large-scale cybersecurity incidents and crises (cyber crisis management authorities).

Source: NIS2, Directive (EU) 2022/2555, read 2026-08-14.

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Jump to a point: Point 1 · Point 2 · Point 3 · Point 4 · Point 5 · Point 6 · Point 7 · Point 8

1. Each Member State shall designate or establish one or more competent authorities responsible for the management of large-scale cybersecurity incidents and crises (cyber crisis management authorities). Member States shall ensure that those authorities have adequate resources to carry out, in an effective and efficient manner, the tasks assigned to them. Member States shall ensure coherence with the existing frameworks for general national crisis management.

2. Where a Member State designates or establishes more than one cyber crisis management authority pursuant to paragraph 1, it shall clearly indicate which of those authorities is to serve as the coordinator for the management of large-scale cybersecurity incidents and crises.

3. Each Member State shall identify capabilities, assets and procedures that can be deployed in the case of a crisis for the purposes of this Directive.

4. Each Member State shall adopt a national large-scale cybersecurity incident and crisis response plan where the objectives of and arrangements for the management of large-scale cybersecurity incidents and crises are set out. That plan shall lay down, in particular:

(a) the objectives of national preparedness measures and activities;

(b) the tasks and responsibilities of the cyber crisis management authorities;

(c) the cyber crisis management procedures, including their integration into the general national crisis management framework and information exchange channels;

(d) national preparedness measures, including exercises and training activities;

The article continues in the official text.

Open the article on EUR-Lex

• Previous article
• Next article

Other articles in this chapter

• Article 7
• Article 8
• Article 10
• Article 11
• Article 12
• Article 13

Who does this apply to

The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.

• Cloud service provider

Does this apply to us?

• Do ai governance rules apply to a cloud provider?
• Do personal data rules apply to a cloud provider?
• Do cross-border data rules apply to a cloud provider?
• Do cybersecurity rules apply to a cloud provider?
• Do health data rules apply to a cloud provider?
• Do online platforms rules apply to a cloud provider?

All roles in the register · All questions by role

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Back to the act · EU acts, read down to the national law

ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.

Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.