EU NIS2 Directive (Directive (EU) 2022/2555) obligations for essential and important entities: scope, governance, the Article 21 risk-management measures, the technical requirements of Implementing Regulation (EU) 2024/2690, incident reporting, supervision and penalties.
Who NIS2 covers: the size-cap rule and size-independent entities, essential versus important classification, the Annex I and II sectors, sector-specific laws that displace NIS2, and which Member State has jurisdiction.
Article 20 duties of the management body: approving and overseeing the Article 21 measures, liability for infringements, and mandatory cybersecurity training for management body members.
Article 21 of NIS2: the proportionate, all-hazards duty to manage risks to network and information systems and the ten minimum measures in Article 21(2)(a) to (j), with the implementing regulation's requirements for each.
Selected requirement areas from the Annex to Commission Implementing Regulation (EU) 2024/2690, which binds DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers, with ENISA's examples of evidence.
Article 23 incident reporting: when an incident is significant, the 24-hour early warning, 72-hour notification and one-month final report, informing service recipients, plus registration and information-sharing duties toward authorities.
How national competent authorities supervise essential entities ex ante and important entities ex post, the enforcement measures available, the Article 34 maximum fines, and the interplay with GDPR fines.
How NIS2 applies sector by sector: which entity types in each Annex I or II sector are covered, whether they are essential or important, which supervisor and rules apply, and the sector-specific details buyers ask about, from MSPs and cloud to hospitals and utilities.
Running a NIS2 compliance program: the checklist and roadmap, risk assessment, required policies, evidence for supervisors, groups operating in several Member States, ENISA's technical guidance, and the open-source and self-hosted tools that produce the evidence.
Getting NIS2 incident handling and reporting right in practice: the response plan, the end-to-end reporting process, reporting one incident under NIS2 and GDPR, and the exercises that prove the process works.
The customer side of NIS2 supply chain security: assessing suppliers, contract clauses, choosing managed security providers, open-source components and cloud providers, with the supplier criteria and registry the implementing regulation requires.
How NIS2 relates to the rules around it: what changed from the first NIS Directive, the Critical Entities Resilience Directive, European cybersecurity certification under the Cybersecurity Act, and the targeted NIS2 amendments proposed in January 2026.
Who does what in a NIS2 program and what to buy: consultants and their cost, what to outsource and what management must keep, a vCISO or security officer, and managed SOC services for monitoring and the reporting deadlines.
Answers to the questions organizations ask when NIS2 applies to them or their customers: scope, national transposition, key dates, gap analysis, cost, certification and audits, supplier requirements and ISO 27001.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.