Security & Assurance · EU Network and Information Security Directive (NIS2)
Issued by
European Union
Typical timeline
8-16 weeks
Assessed by
National authority supervision
Validity
Ongoing obligation
Overview
Who needs NIS2?
- 01Medium and large organizations in the 18 sectors NIS2 covers, operating in the EU
- 02Cloud, data center, managed service and managed security service providers
- 03Suppliers to EU organizations that pass NIS2 requirements down their supply chain
Requirements
What the auditor looks for.
- 01Scope & registrationConfirm whether you are an essential or important entity, in which member states, and register with the national authority.
- 02Risk-management measuresA baseline of measures: risk analysis, incident handling, business continuity, supply chain security, secure development, cryptography, access control and multi-factor authentication.
- 03Incident reportingAn early warning within 24 hours of a significant incident, a full notification within 72 hours, and a final report within one month.
- 04Management accountabilityManagement approves and oversees the cybersecurity measures, takes cybersecurity training, and can be held personally liable.
- 05Supply chain securitySecurity requirements and assessments for suppliers and service providers, written into contracts.
- 06Supervision & penaltiesFines up to €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities.
Our approach
From scoping to auditor sign-off.
FAQ
Questions, answered.
It applies to medium and large organizations in the sectors it lists, and to some providers, such as DNS and trust service providers, regardless of size. Member states can add more. We confirm your status, and which countries' rules apply, in the first two weeks.
It can. Some providers based outside the EU that offer services there, such as cloud and managed service providers, must name a representative in the EU, and EU customers increasingly pass NIS2 requirements on to their suppliers.
No. National authorities supervise compliance, and essential entities can be audited proactively. ISO 27001 certification is the usual way to show your controls are in place; we prepare you for it and coordinate the auditors.
For most EU financial entities, DORA takes precedence on ICT risk and incident reporting as the more specific law. We map one control set to both, so nothing is done twice.
Typical timeline: 8-16 weeks, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. NIS2 shares substantial control overlap with ISO 27001 and DORA, so we build one control set and map evidence across all of them.
Next framework
NIST CSF
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.