NIS2, with the reporting clock already running
The ten risk-management measures in Article 21, the incident reporting deadlines in Article 23, and the management accountability that makes both somebody's named job. Adopted as a program, with the Implementing Regulation's technical detail sitting in the same catalog.
- The ten Article 21 measures, with owners and evidence
- The 24-hour, 72-hour and one-month clock, rehearsed
- Management approval recorded as a dated decision
- Implementing Regulation 2024/2690 in the same catalog
NIS2 Directive
Organization-wide · 2022 · 66 controls
NIS2 coverage
- Instrument
- Directive (EU) 2022/2555
- Transposed by
- 17 October 2024, into national law
- Structure
- 10 measures in Article 21
- Reporting
- 24 hours, 72 hours, one month
01
Adopt it, don't rebuild it
Adopt the Directive and the Implementing Regulation (EU) 2024/2690 together where it applies to you: the Regulation is where the technical detail lives for cloud, data centres, managed service providers and the rest of the digital sector.
02
Evidence with a date on it
Continuity tests, supplier assessments, vulnerability handling and training each carry their own expiry. Management approval is a dated record too, which is the point when liability sits with the people who signed it.
03
What the assessor leaves with
A national authority asking questions after an incident gets a scoped view rather than a document hunt: the measures, who owns them, what evidence stands behind them, and when each was last reviewed.
What you adopt
NIS2, in its own numbering
- 21(2)(a)Risk analysis and security policy
- 21(2)(b)Incident handling
- 21(2)(c)Business continuity and crisis management
- 21(2)(d)Supply chain security
- 21(2)(e)Secure acquisition and development
- 21(2)(f)Testing measures for effectiveness
- 21(2)(g)Cyber hygiene and training
- 21(2)(h)Cryptography and encryption
- 21(2)(i)HR security, access control, asset management
- 21(2)(j)MFA and secured communications
Ten measures, plus Article 23's reporting clock and the management approval that makes both somebody's named job.
What you show
What an assessor will ask to see
Risk analysis and information security policy
Article 21(2)(a). The assessment, the policy it produced, and management's approval of both.
Incident handling against the clock
Articles 21(2)(b) and 23. A procedure that can produce an early warning in 24 hours, and a team that has rehearsed doing it.
Business continuity and crisis management
Article 21(2)(c). Backup management, disaster recovery, and restores you have actually run.
Supply chain security
Article 21(2)(d). Direct suppliers assessed on the security of what they provide, not on a logo.
Vulnerability handling and disclosure
Article 21(2)(e). How vulnerabilities reach you, how fast they are triaged, and what happened to the last ten.
Cyber hygiene, training and MFA
Article 21(2)(g) and (j). Basic practices applied consistently, training with acknowledgement, and multi-factor authentication where it is required.
How it runs
Step 1
Adopt NIS2
Your organization gets its own copy of every control in NIS2, already mapped to the common controls you may satisfy for something else.
Step 2
Scope it
Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.
Step 3
Collect the evidence
Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.
Step 4
Prove it
Invite your assessor to these frameworks and these dates, and nothing else. They leave with the measures, their owners, and the evidence a national authority will ask for.
The standard
What NIS2 asks for
NIS2 replaced the 2016 NIS Directive and widened the net considerably, pulling in sectors that had never been regulated this way. Member States were required to transpose it by 17 October 2024, so what binds you is your national law, but the obligations underneath it are the Directive's, and they are the same everywhere.
Entities are classified as essential or important according to sector and size. The distinction changes the supervision you are under (proactive for essential entities, reactive for important ones) rather than the measures you owe. Article 21 lists ten, running from incident handling and business continuity through supply chain security to cyber hygiene, cryptography and multi-factor authentication.
Two obligations catch people out. Article 23 runs on a clock: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72, and a final report within a month. And management bodies must approve the risk-management measures, oversee their implementation, and can be held personally liable for failing to.
Questions
- Are we an essential or an important entity?
- It depends on your sector under Annexes I and II and on your size, and it is decided by your national transposition rather than by the Directive alone. The practical difference is supervision: essential entities can be inspected proactively, important entities are supervised after something goes wrong. The measures owed are the same.
- Is there a NIS2 certificate?
- No. NIS2 is supervised by national competent authorities, and compliance is demonstrated to them rather than certified by an auditor. Member States may encourage particular certification schemes, but none of them discharges the obligation on their own.
- We are already ISO 27001 certified. How far does that get us?
- A long way on the measures, and not all the way. Article 21's ten overlap heavily with Annex A, so most of that evidence counts. What ISO 27001 does not give you is the 24-hour reporting capability, the management approval and liability, or the national registration your transposition requires.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.