NIS2 implementation roadmap: phases and timeline

NIS2 implementation roadmap: what the sequence looks like for your organization

A NIS2 program runs in phases: scope and classification first, then management governance, gap analysis, the Article 21 measures, incident reporting, supplier controls, and an annual review cycle. Each phase depends on the one before it. You cannot size a gap analysis until you know whether your entities are essential or important, and management cannot approve measures it has not seen mapped to gaps. Some dates have already passed. Member States had to apply their national laws from 18 October 2024 and establish their lists of essential and important entities by 17 April 2025, so confirm which national rules and deadlines apply to you. The duration and effort depend on your scope, the Member State rules that govern you, and your current maturity. No supplied fact gives a general duration, so ask any partner for a written scope and timeline before work starts.

Responsibilities need to be fixed early. Your organization owns its controls, its risk decisions and its management approvals, which Article 20 requires the management body to approve and oversee. An implementation partner prepares systems, configurations and evidence, and can carry out the technical work inside your own infrastructure. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. An independent review is a separate choice, made where a customer or contract asks for one. Confirm with your authority and your contracts which form of proof they will accept, because that choice determines what the roadmap must produce and when.

Plan the roadmap around recurring cycles, not only the first deliverable. The implementing regulation sets fixed intervals for some requirements, including at least annual management review of the security policy and at least annual review of risk assessments, so the annual cycle starts when the first measures go live. Where you find a gap against an Article 21(2) measure, Article 21(4) requires corrective measures without undue delay. Keep the proposed amendments in view as well. The Commission's January 2026 proposal (COM(2026) 13) is still before the European Parliament and the Council, so build the roadmap to the law in force and review it when the proposal moves. Check your national transposition status on the Commission's NIS2 policy page before you fix dates.

NIS2 implementation roadmap dates: which have passed and which are pending

NIS2 dates fall into two groups. Milestones from October 2024 to June 2025 have passed, so your registration, classification and guidance records should already exist. Other items remain open, including a Commission proposal, infringement referrals and the 2027 review. Check each date against your national transposition law, since that law is what binds your organization.

Transposition deadline and referrals

Member States had to adopt and publish national transposition measures by 17 October 2024 and apply them from 18 October 2024. On 8 July 2026, the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules. Because NIS2 is a directive, your obligations come from your country's national law, so confirm which version applies to your entities and what your supervisor expects.

Repeal of the first NIS Directive

Directive (EU) 2016/1148, the first NIS Directive, was repealed with effect from 18 October 2024. The same day, Commission Implementing Regulation (EU) 2024/2690 was published, setting technical and methodological requirements for the Article 21(2) measures. Providers of DNS, TLD, cloud, data center, CDN, managed, online platform and trust services should map their controls to its annex sections now. Other entities should confirm which requirements their national law adopts.

Registration and penalty notices

By 17 January 2025, the digital providers listed in Article 27 had to submit their registration information, and Member States had to notify the Commission of their penalty rules under Article 36. Entities must notify later changes to their submitted details within two weeks under Article 3(4), and some Member States run self-registration mechanisms. Check your national authority's portal for your current record, and keep a dated copy of each submission.

National lists of entities

Member States had to establish their lists of essential and important entities by 17 April 2025 under Article 3(3). Whether your organization appears on a list depends on its sector, size and national rules, so an absence from a list does not settle your status. Ask your national competent authority in writing how it classified you, and file the answer with its date in your scoping records.

ENISA technical guidance published

On 26 June 2025, ENISA published non-binding technical implementation guidance for Implementing Regulation 2024/2690, with examples of evidence and mappings to ISO/IEC 27001:2022, NIST CSF 2.0 and other frameworks. Use it to decide what evidence to collect for each requirement. Following it does not by itself prove compliance, so confirm each requirement against your own systems before a supervisor asks.

Pending proposal and 2027 review

On 20 January 2026, the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. The proposal is not yet law: it needs approval by the European Parliament and the Council, and it changes no obligation until adopted and transposed. The Commission must review NIS2 by 17 October 2027 and every 36 months after that. Track both items in your annual review, and plan changes only once the text is final.

The phases of a NIS2 roadmap and what each phase produces

The sequence moves an organization from knowing whether NIS2 applies to running a repeatable cycle of measures, evidence and review that a competent authority can inspect. Each phase closes with a record that shows the work was done and who approved it.

Confirm scope and entity classification
Start by establishing whether the organization is in scope under Articles 2 and 3, which sector annex applies, and whether it is essential or important. Check whether a sector-specific law displaces NIS2 and which Member State has jurisdiction. Record the decision and the reasoning behind it. Output: a signed scope record that names the entity, sector, classification and jurisdiction. Confirm the registration route and the current national deadlines with the competent authority, since these vary by Member State.
Register and set a change-notification process
Submit the entity details required by the national registration mechanism, then assign an owner for keeping them current. Article 3(4) requires changes to be notified without delay and in any event within two weeks of the change, so the process needs a trigger for events such as new subsidiaries, sector changes or contact updates. Output: a registration confirmation on file and a written change procedure with a named owner.
Obtain management body approval and oversight
Under Article 20(1), the management body must approve the cybersecurity risk-management measures and oversee their implementation. Management also needs training, which the governance section of this guide covers. Put the scope, the planned measures and the reporting line in front of the board, and record the decision. Output: approval minutes that name the measures approved, the accountable executive and the reporting cadence. Without this record, later phases lack the authority they depend on.
Run the gap analysis against Article 21
Compare current controls with the ten measures in Article 21(2)(a) to (j). Where the entity is in one of the categories covered by Implementing Regulation (EU) 2024/2690, use the Annex sections that apply to it, and use the ENISA technical guidance as a source of example evidence. Score each requirement, name the owner and note the evidence that exists today. Output: a gap register with one row per requirement, a rating, an owner and a remediation item. Ask any external assessor to explain how they will test each row before you commission the work.
Write policies and implement the measures
Turn the gap register into a policy set and a set of implemented controls. Policies cover the information system security policy, incident handling, supply chain and cryptography, among others. Each measure needs a documented proportionality decision where full implementation is not practical. Where the organization finds it does not comply with a measure, Article 21(4) requires necessary, appropriate and proportionate corrective measures without undue delay. Output: an approved policy set, a configuration or control inventory and a record of each corrective action.
Build incident reporting readiness
Article 23 sets the reporting clock for significant incidents, so the organization needs a response plan, named decision makers, contact routes to the national authority and a way to inform affected service recipients. Test the process with an exercise before relying on it. Output: an incident playbook, a reporting matrix that maps each stage to a role, and a record of at least one exercise with its findings. Confirm the current reporting templates with the competent authority.
Establish supplier controls
Inventory suppliers that affect the systems in scope, including managed service providers, cloud providers and open-source component sources. Assess each against the criteria in the supply chain guidance, and add contract clauses for security, incident notification and audit access. Output: a supplier register with a risk tier, the assessment on file and the clauses in contracts. Review the register whenever a supplier changes or a new one is onboarded.
Sustain the annual review cycle
Steady state means the cycle repeats. Implementing Regulation 2024/2690 sets fixed points, including at least annual management review of the security policy, at least annual review of risk assessments and quarterly assessment of recurring incidents. Schedule these reviews, feed their results back into the gap register and record the decisions. Output: dated review records, updated policies and a current gap register that a supervisor can inspect at any time.

What makes a NIS2 roadmap longer or shorter for your organization

Most of the variation in a NIS2 program comes from a small set of decisions made early: where you operate, how you are classified, which services you run, and how much of your estate is in scope. Each driver below can be controlled in part, and the cards show where to act first.

Member States where you operate

Each Member State transposes NIS2 through its own national law, so every country where you are established or offer services can add registration steps, reporting channels and supervisory expectations. A group with subsidiaries in several countries multiplies these tracks. Ask early which national authority has jurisdiction over each entity, and confirm current transposition status for each country with its competent authority, because the Commission has opened infringement proceedings against several Member States for incomplete transposition.

Essential or important classification

The risk-management and reporting obligations are the same for both classes, but essential entities face ex ante supervision and important entities face ex post supervision. An entity that expects to be treated as essential should plan for a heavier evidence pack before a supervisor asks for it. Confirm the classification with your national authority or legal counsel early, since it determines how much documentation must be ready at the start.

Services covered by Implementing Regulation 2024/2690

If you provide a DNS, TLD, cloud, data center, CDN, managed or managed security service, an online platform or a trust service, you must assess yourself against the 13 Annex sections of the implementing regulation. That is a more detailed, service-specific control set than the general Article 21 measures, and it adds effort to the gap analysis and evidence work. Map your services to the regulation at scoping time, because a late discovery usually reopens the risk assessment and policy set.

Systems and third parties in scope

The number of systems, networks, sites and suppliers that support in-scope services sets the size of the risk assessment, the asset inventory and the supplier review. Narrowing scope on purpose, with documented justification for what is excluded and why it does not affect in-scope services, is often the single biggest lever. Ask for an asset and supplier inventory with owners before any quote, and agree the boundary in writing before work starts.

Existing ISO 27001 or framework maturity

An operating information security management system, with documented policies, risk treatment and internal audits, gives you much of the Article 21 structure already. The main work is then mapping existing controls to the ten Article 21(2) topics and filling the gaps that are specific to NIS2, such as management training, reporting timelines and supplier criteria. Check whether your existing framework has the annual review cycles that the implementing regulation sets, since those are often the first gaps found.

Quality and age of current evidence

A control that exists but leaves no record, such as an unlogged access review or a backup that was never restored, will need rework before a supervisor can accept it. Logs retained for the right period, change records tied to approvals and test results with dates usually decide how quickly evidence can be produced. Sample your existing evidence against one measure from each Article 21 topic to estimate how much remediation remains, and ask any partner to state which evidence they will create and which you must keep.

In-house, partner-supported or managed: which roadmap model fits

This table compares three ways to run a NIS2 program: fully in-house, with a fixed-scope implementation partner, or with ongoing managed operations under a retainer. Read each column for what the organization keeps, who prepares evidence and which situations favor it. The main takeaway is that the entity's management body keeps approval and risk acceptance in every model, and an independent assessor issues any report.

Decision factor	Fully in-house	Partner-supported (fixed scope)	Managed operations (retainer)
What the organization keeps	Management approval under Article 20, risk acceptance, reporting decisions, and all control ownership	Management approval, risk acceptance, reporting decisions, and control ownership remain with the entity	Management approval, risk acceptance and final reporting decisions remain with the entity; the provider runs monitoring and triage
Who prepares evidence	Internal teams collect, format and retain policies, logs, test results and records	The partner prepares systems, controls and evidence against the written scope; the entity reviews and adopts them	The provider produces operational records (alerts, tickets, log exports); the entity still owns the evidence file
Best fit	Established security team with NIS2 experience and capacity for the Article 21 measures across all entities	Teams with gaps in skills or capacity for a defined project, such as gap analysis, policy set or open-source tooling	Entities that lack 24-hour monitoring capacity and need support meeting the Article 23 reporting deadlines
Main risk	Slow progress on evidence, and the review cycles in Implementing Regulation 2024/2690 are missed	Dependency on the project ending: the entity must be able to run the controls after handover	Unclear split of duties during an incident, and weak internal knowledge of the monitored systems
Effect of several entities or Member States	Load grows with each entity, subsidiary and national registration	Scope can cover a group if the written agreement names each entity and system	Retainer scope must list each entity, tenant and reporting contact for every Member State
What to ask for in a written scope	Not applicable as a partner deliverable; ask internal owners for a documented RACI and review calendar	Named systems, entities and deliverables, acceptance criteria, handover method, and who approves each artifact	Named monitored assets, alert handling hours, escalation paths, incident reporting responsibilities, and exit terms
Independent assessment	Internal reviews are not an independent assessment; plan for the review your national authority or assessor expects	The partner does not issue reports; an independent auditor or assessor does, if one is required	The provider does not issue compliance reports; independent review remains a separate engagement
Ongoing cost driver	Staff time for annual reviews, training and evidence upkeep	Project effort to the agreed scope, followed by internal upkeep	Retainer scope and service hours, which should be confirmed in the quote

Who owns each phase: management, your team, a partner and the assessor

Article 20(1) requires Member States to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken to comply with Article 21 and oversee their implementation. That approval is a decision the board or executive team must make and record. It cannot be delegated to a vendor or to a single manager, and the entity remains liable for infringements. Management also decides which residual risks the organization accepts and where it sets the budget and priorities.

Approval of measures: The board approves the Article 21 measures and the information system security policy, and records the approval with a date and minutes.
Oversight: Management receives periodic reports on the status of measures, open findings and incidents, and asks for corrective action when progress stalls.
Risk acceptance: Named executives sign off on residual risk and on any deviation from the risk treatment plan.
Training: Members of the management body complete the cybersecurity training that NIS2 requires for them.
Resourcing: Management funds staff, tools and external support in proportion to the risk assessment.

Confirm with your legal counsel how your national transposition law defines management body liability and training obligations, because these details vary between Member States.

Why scope and classification come before any control work

A NIS2 gap analysis starts with scope because every later decision depends on it. Articles 2 and 3 determine whether an organization is in scope at all and whether it is an essential or an important entity. Both categories carry the same Article 21 risk-management measures and the same Article 23 reporting duties, so the control work looks similar on paper. The difference lies in supervision and penalties. Essential entities face ex ante supervision under Article 32, meaning authorities can check compliance before an incident occurs. Important entities face ex post supervision under Article 33, which typically starts once there are signs of non-compliance. Fine ceilings also differ between the two categories. An error in classification therefore changes both the depth of evidence a supervisor will expect and the financial exposure if something goes wrong.

A wrong scope decision costs money in two directions. An organization that is out of scope but builds a full program spends effort on controls that no authority will test, while an organization that is in scope but concludes otherwise leaves Article 21 and Article 23 obligations unmet and may not have notified the authority within the required window. Before starting any control work, the team should document the sector and subsector against Annexes I and II, the size tests that apply, the Member State where the entity is established or provides services, and any sector-specific law that may displace NIS2. Each conclusion should be written down with the source relied upon, so the reasoning can be shown later to a supervisor or to the independent auditor who reviews the program.

Two sources shape many of these decisions and should be read before classification is closed. The Commission's Guidelines on the application of Article 4(1) and (2) of the NIS2 Directive address when sector-specific rules take precedence over NIS2. The national transposition law and the national list of essential and important entities, which Member States had to establish by 17 April 2025 under Article 3(3), determine the final status in each country. Confirm with the national competent authority or qualified national counsel whether the organization appears on a list, whether registration applies, and whether national rules go beyond the directive. Treat the scope memo as a living document, since the Commission's January 2026 proposal (COM(2026) 13) would add a small mid-cap category if adopted.

What must be in place before a supervisor inspection or assessment

A supervisor will ask for documents that show decisions were made, by whom, and when they were last reviewed. The six items below are the records that connect scope, governance, risk, corrective action, incident reporting and suppliers, and each one can be checked by the organization before anyone from outside arrives.

Signed scope and classification record

This record states which entities in the group fall under NIS2, whether each is essential or important, and which Member State has jurisdiction. Check that the sector and size reasoning is written down, that the registration details match what was submitted, and that the date of the last change notification is on file. Any change must be notified without delay and within two weeks. The accountable executive signs the record, and legal or compliance confirms the classification against the national transposition law.

Management approval and oversight minutes

Under Article 20(1), the management body must approve the Article 21 risk-management measures and oversee their implementation. Check that the minutes name the measures approved, the date, and the members present, and that oversight appears in later meetings as a standing item with reported progress. Confirm that training records for board members are kept alongside. The chair or company secretary signs the minutes, and the management body owns the decision.

Current annual risk assessment

For in-scope providers covered by Implementing Regulation 2024/2690, the risk assessment must be reviewed at least annually. Check the version date against the last review, confirm that asset classification and treatment decisions match the current architecture, and verify that residual risk acceptance is recorded with a named owner. A supervisor will compare the assessment against the measures in place, so gaps between the two should be visible. The risk owner prepares it, and the management body or its delegate accepts residual risk.

Gap register with dated corrective actions

Article 21(4) requires an entity that finds it does not comply with the measures to take all necessary, appropriate and proportionate corrective measures without undue delay. The register should list each gap, the measure it relates to, the owner, the planned date, the status and the evidence that closes it. Check that closed items link to proof, not only to a status change. The control owner updates the register, and the CISO or equivalent signs off each closure.

Incident response plan tied to reporting clocks

The plan must show how a significant incident moves through detection, triage and reporting to the authorities. Under Article 23, the steps are an early warning within 24 hours, a notification within 72 hours, and a final report within one month. Check that each step names a role, a template and a contact route, and that the team has run at least one exercise that tested the clock. Legal and the CISO approve the plan, and the management body is informed of the process.

Supplier register with contract clauses

The register lists each supplier that could affect the security of network and information systems, the services it provides, the data or access it holds, and its risk tier. Check that each high-tier supplier has a contract with security, incident notification and audit clauses, and that the review date is recorded. Missing clauses are a common finding, so review them against the register rather than relying on memory. Procurement maintains the register, and the CISO approves the high-tier entries.

NIS2 roadmap questions buyers ask before hiring outside help

How long does a NIS2 compliance program take?

The length depends mainly on how much of the program already exists and how many entities and sites it covers. A organization with documented policies, a current asset inventory and an existing security management system usually moves faster than one starting from scoping, registration and first risk assessment at the same time. The main drivers are the number of in-scope legal entities and Member States, the number of systems and suppliers in scope, how much evidence is already collected, and how quickly management approves decisions. Ask any provider to split the plan into phases with a stated output for each, such as scope and registration, gap analysis, measures and policies, incident reporting readiness and the first annual review. Those outputs are the points where progress can be checked.

What does a NIS2 program cost, and who gets paid for what?

Cost comes from several separate buckets: internal staff time, an advisor or consultant for gap analysis and policy drafting, technical work to change or add systems, tooling, testing, and periodic assessment by an independent auditor where the organization chooses one. Some of these are one-time, such as the gap analysis and initial implementation, while others recur, such as annual risk reviews, management training, monitoring, testing and supplier reassessment. Costs rise with the number of entities, systems, suppliers and sites in scope. No public price list applies to NIS2 work, so ask every provider for a written, fixed scope that lists deliverables, responsibilities, exclusions and what is paid for by time versus by deliverable. DeployOpen plans and implements fixed-scope engagements and gives a quote after the scope is agreed in writing.

Can our own team run NIS2 compliance without outside help?

Many organizations run the program internally with support on specific technical tasks, and that is a valid model if the team has time and the right skills. Certain responsibilities must stay in-house regardless of who prepares the work: the management body must approve the Article 21 measures and oversee them, accept residual risk, and own decisions on budget and corrective action. The organization also owns its incident response decisions, its registration and its regulator contacts. Outside help is most useful for gap analysis, policy drafting, technical hardening, evidence collection and testing, where specialist capacity is scarce. Ask any provider to confirm in writing which tasks it performs and which remain with your staff.

Does NIS2 issue a certificate that proves compliance?

No. NIS2 does not create a certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. Some organizations also choose an ISO/IEC 27001 certification or another independent assessment to support their evidence, but that is a separate decision and does not replace supervision under national law. Be cautious with any offer that promises a NIS2 certificate. Ask what independent review would look like, who would perform it and what evidence it would produce.

Has a NIS2 deadline already passed for our organization?

Some EU-wide dates have already passed, and whether they affect you depends on your entity type and the national law that applies to you. Member States had to apply their transposition measures from 18 October 2024, and they had to establish their lists of essential and important entities by 17 April 2025. Entities must also notify changes to their submitted details within two weeks of the change. Check the key dates section of this guide, then confirm with the national competent authority or a qualified legal advisor which national rules and deadlines apply to your organization in each country where you operate. Relying on EU-level dates alone can miss national registration or reporting duties.

What does NIS2 require from management and the board?

The management body must approve the cybersecurity risk-management measures taken under Article 21 and oversee their implementation. In practice that means reviewing the risk assessment and treatment plan, approving the information system security policy, deciding on budget and staffing, and accepting residual risk. Members of the management body must also complete cybersecurity training, and the organization should record attendance and content. Management is accountable for infringements, so decisions and approvals should be minuted. Before engaging a provider, ask who on the board will sponsor the program and how often the management body will receive reports on progress and open risks.

Do the proposed NIS2 amendments change our roadmap now?

No. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, and Commission pages updated through July 2026 describe it as a proposal. Until it is adopted, the NIS2 Directive as transposed in your Member State and the Implementing Regulation (EU) 2024/2690 for relevant digital providers continue to apply. Keep your roadmap on current law, and review scope when the amendments are adopted. Ask any provider how it would reflect a change in scope in its written plan.

How DeployOpen scopes, implements and prepares NIS2 evidence

DeployOpen plans and implements NIS2 programs as fixed-scope work agreed in writing before it starts. The organization keeps ownership of its controls and management decisions, while DeployOpen prepares the systems, documentation and evidence that a roadmap calls for, from scoping through steady-state review.

How we scope

The written scope lists which entities, sites and systems the NIS2 roadmap covers and which phases are included.
Scope agreements state the deliverables for scope and classification, governance, gap analysis and policies before work begins.
Ongoing support, upgrades and continuous testing can follow the initial scope as a retainer, agreed separately in writing.

How we build

We implement and configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We prepare the risk assessment, policy set and measure documentation that each roadmap phase requires, tied to named owners.
We test the configured controls and record results so the evidence reflects how the systems behave in your environment.

How we hand over

Handover packages list each deliverable, its owner, its review date and the evidence that supports it.
Your management body receives the materials it needs to approve the measures and record its oversight decisions.
Independent assessment stays with you: auditors and competent authorities, not DeployOpen, issue reports or certificates.

How we support

Annual review cycles, such as policy management review and risk assessment refresh, can be scheduled into a retainer.
Upgrades, backups and configuration changes are documented so supervisors can trace what changed and when.
Confirm with us which review and testing activities a retainer covers before you sign, since each engagement is scoped separately.