Does NIS2 apply to us
A step-by-step scope check: sector and entity type in Annexes I and II, the size-cap rule, size-independent categories, sector-specific exemptions such as DORA, jurisdiction, and registration with national authorities.
NIS2 guides
Answers to the questions organizations ask when NIS2 applies to them or their customers: scope, national transposition, key dates, gap analysis, cost, certification and audits, supplier requirements and ISO 27001.
NIS2 national transposition
Where Member States stand on transposing NIS2 as of October 2026, based on Commission infringement decisions, and why the national law, not the Directive, sets an entity's actual obligations.
NIS2 key dates and deadlines
The NIS2 timeline in one place: adoption, entry into force, transposition and application, registration and entity list deadlines, the implementing regulation, infringement steps, review dates and pending amendments.
NIS2 gap analysis
How to run a NIS2 gap analysis against the Article 21 measures, the governance and reporting duties and, for digital providers, the 13 sections of Implementing Regulation 2024/2690, using ENISA's evidence examples.
NIS2 compliance cost
What drives the cost of NIS2 compliance, the Commission's official estimates of extra security spending, audit costs entities must bear, the cost of non-compliance, and pending simplification proposals.
NIS2 certification and audits
Whether a NIS2 certificate exists, how compliance is actually demonstrated to authorities, the role of security audits and European certification schemes, and where standards such as ISO 27001 fit.
NIS2 requirements for suppliers
What NIS2 means for suppliers and service providers of in-scope entities, including companies outside scope: the security clauses, incident notification duties, audit rights and assessments customers pass down the supply chain.
NIS2 vs ISO 27001
How NIS2 and Implementing Regulation 2024/2690 relate to an ISO/IEC 27001:2022 management system: where they overlap, what NIS2 adds as law, and what ENISA's official mapping does and does not say.
NIS2 requirements: what the Directive requires of entities
The full set of obligations an in-scope entity carries under NIS2 in one place: registration, management body approval and training, the ten Article 21 measures, staged incident reporting, supervision and fines, and where the implementing regulation adds detail.
