Structured NIS2 Directive Compliance
A structured program covering the cybersecurity governance, risk management, and incident response capabilities required under the EU NIS2 Directive, for critical infrastructure and essential/important service providers.
Who is this for?
For essential and important entities required to comply with the EU NIS2 Directive.
What will you achieve?
A clear picture of your NIS2 obligations, a gap-closing roadmap, and implemented cybersecurity governance and technical controls.
Overview
The NIS2 Directive strengthens cybersecurity requirements across critical sectors in the EU. Our compliance program helps organizations that fall in scope meet these obligations in a structured way.
Applicability depends on factors including sector, entity type, size, and specific statutory exceptions — we start every engagement with a scope assessment rather than assuming applicability.
NIS2 Covered Sectors
NIS2 applies to essential and important service providers across critical sectors of the economy
Essential Services (High Risk)
- Energy sector (electricity, oil, gas distribution)
- Transport (air, rail, water, road transport)
- Banking and financial market infrastructures
- Health sector (healthcare providers)
- Drinking water supply and distribution
- Digital infrastructure (Internet Exchange Points, DNS)
- ICT service management (B2B) and cloud services
- Public administration (central government entities)
Important Services (Medium-High Risk)
- Digital services (online marketplaces, search engines)
- Waste water management and treatment
- Chemicals production and distribution
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery)
- Research organizations and facilities
- Space sector (satellite operations)
- Postal and courier services
NIS2 Cybersecurity Requirements
Comprehensive cybersecurity measures required under the NIS2 Directive
Cybersecurity Risk Management
Phase 1Comprehensive cybersecurity risk assessment and management framework
- Policies on risk analysis and information system security
- Incident handling and business continuity management
- Supply chain security and security in network relationships
- Security in acquisition, development and maintenance of systems
- Policies and procedures to assess effectiveness of measures
Technical & Organizational Measures
Phase 2Implementation of appropriate technical and organizational cybersecurity measures
- Multi-factor authentication and secure communication protocols
- Encryption and cryptographic mechanisms for data protection
- Network security measures and network segmentation
- Backup mechanisms and disaster recovery procedures
- Security testing and vulnerability management programs
Incident Reporting & Response
Phase 3Incident detection, response, and regulatory notification capabilities
- Computer security incident detection and response capabilities
- Early warning notifications to relevant authorities
- 24-hour, 72-hour, and one-month incident reporting timelines
- Evidence preservation and forensic investigation protocols
- Recovery procedures and lessons learned documentation
Governance & Human Resources
Phase 4Corporate governance framework and human resource security measures
- Cybersecurity governance policies and management responsibilities
- Regular cybersecurity training and awareness programs
- Access control policies and privileged access management
- Third-party risk assessment and vendor security requirements
- Regular security audits and penetration testing programs
Implementation Phases
A structured methodology for working through NIS2 compliance
Phase 1: Foundation & Assessment
- NIS2 scope and applicability determination
- Cybersecurity posture assessment
- Gap analysis against NIS2 requirements
- Risk assessment methodology selection
- Governance framework design
- Implementation roadmap development
Phase 2: Technical Implementation
- Critical security controls deployment
- Network architecture review
- Identity and access management enhancement
- Encryption controls implementation
- Backup and disaster recovery setup
- Security monitoring capabilities deployment
Phase 3: Incident Response
- CSIRT establishment
- Incident detection procedures
- Regulatory reporting workflows
- Crisis communication protocols
- Evidence preservation capabilities
- Recovery procedures activation
Phase 4: Governance Finalization
- Governance framework finalization
- Policy suite development
- Staff training programs
- Vendor assessment framework
- Compliance testing and validation
- Continuous monitoring planning
NIS2 Timeline
Key milestones so far, and what ongoing compliance looks like now
NIS2 Directive Entry into Force
CompletedJanuary 16, 2023
EU NIS2 Directive officially entered into force
National Transposition Deadline
CompletedOctober 17, 2024
EU Member States were required to transpose NIS2 into national law by this date; national implementation and enforcement timelines vary by country
Continuous Compliance
OngoingOngoing
In-scope organizations maintain risk management measures, incident reporting, and governance obligations on an ongoing basis
NIS2 Penalties & Sanctions
Understanding the enforcement landscape and potential consequences of non-compliance
Administrative Fines
Up to €10M / 2% of global turnover (essential entities); up to €7M / 1.4% (important entities), whichever is higher
Applies to: Essential and important entities — exact caps and national implementation vary
Non-compliance with cybersecurity measures and incident reporting
Management Sanctions
Personal liability for management
Applies to: Senior management and board members
Failure to fulfill cybersecurity responsibilities
Operational Sanctions
Suspension of services or operations
Applies to: Critical service providers
Severe non-compliance affecting service availability
NIS2 Compliance Program Includes
Structured NIS2 compliance implementation with ongoing support