Nis2 Directive Specialist

NIS2 Directive Specialist

Tools and guidance for EU Directive 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive).

---

Table of Contents

• NIS2 Overview
• Scope and Applicability
• 10 Minimum Security Measures
• Incident Reporting Requirements
• Management Accountability
• Supply Chain Security
• Penalties
• NIS2 vs NIS1 Comparison
• Infrastructure Security Checks
• Tools
• Reference Guides
• Compliance Assessment Workflow
• NIS2 Implementation Roadmap

---

NIS2 Overview

The NIS2 Directive (EU 2022/2555) is the EU's updated framework for cybersecurity, replacing the original NIS Directive (EU 2016/1148). It entered into force on January 16, 2023, with Member States required to transpose it into national law by October 17, 2024.

Key objectives:

• Establish a high common level of cybersecurity across the EU
• Harmonize cybersecurity requirements and enforcement
• Expand scope to cover more sectors and entities
• Strengthen incident reporting obligations
• Introduce management accountability for cybersecurity
• Enhance supply chain security requirements

Legal basis: Article 114 TFEU (internal market harmonization)

Relationship to other frameworks:

---

Scope and Applicability

Essential Entities (Annex I — High Criticality Sectors)

Important Entities (Annex II — Other Critical Sectors)

Size Thresholds

Automatic inclusion regardless of size:

• Trust service providers
• TLD name registries
• DNS service providers
• Public electronic communications networks/services
• Public administration entities
• Sole provider of a service in a Member State
• Entity whose disruption could have significant impact on public safety, security, or health
• Entity whose disruption could induce systemic risk (especially cross-border)

Exclusions:

• Micro and small enterprises (generally excluded unless specifically designated)
• National security, public security, defense, law enforcement
• Judiciary, parliaments, central banks

---

10 Minimum Security Measures (Article 21)

All essential and important entities must implement appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks. These measures must be based on an all-hazards approach and cover at minimum:

1. Risk Analysis and Information System Security Policies

Establish and maintain comprehensive risk analysis processes and information security policies covering all information systems.

Requirements:

• Formal risk assessment methodology
• Asset inventory and classification
• Security policy framework (approved by management body)
• Regular policy review cycles (at least annually)
• Risk appetite and tolerance definitions
• Documented risk treatment plans

2. Incident Handling

Implement procedures for detecting, managing, and responding to cybersecurity incidents.

Requirements:

• Incident detection capabilities
• Incident classification and triage procedures
• Incident response plans and playbooks
• Incident escalation procedures
• Post-incident review process
• Integration with CSIRT reporting (see Incident Reporting section)

3. Business Continuity and Crisis Management

Ensure service continuity during and after cybersecurity incidents.

Requirements:

• Business impact analysis (BIA)
• Business continuity plans (BCP)
• Disaster recovery plans (DRP)
• Backup management policies
• Crisis management procedures
• Regular testing of continuity plans (at least annually)
• Recovery time objectives (RTO) and recovery point objectives (RPO)

4. Supply Chain Security

Address security risks in relationships with direct suppliers and service providers.

Requirements:

• Supplier risk assessment process
• Security requirements in contracts with suppliers
• Monitoring of supplier security posture
• Supplier incident notification requirements
• Assessment of aggregate supply chain risks
• Product/service quality and cybersecurity practices of suppliers

5. Security in Network and Information Systems Acquisition, Development, and Maintenance

Integrate security throughout the system lifecycle.

Requirements:

• Secure development lifecycle (SDLC) practices
• Vulnerability management procedures
• Security testing (SAST, DAST, penetration testing)
• Patch management processes
• Change management with security review
• Secure configuration management

6. Policies and Procedures for Assessing Effectiveness

Evaluate whether cybersecurity risk management measures are effective.

Requirements:

• Security metrics and KPIs
• Regular security assessments and audits
• Penetration testing program
• Vulnerability scanning
• Compliance monitoring
• Continuous improvement processes

7. Basic Cyber Hygiene Practices and Cybersecurity Training

Ensure all personnel have adequate cybersecurity awareness and skills.

Requirements:

• Cybersecurity awareness training for all staff
• Role-based security training for technical staff
• Management body cybersecurity training (mandatory under Article 20)
• Phishing simulation exercises
• Security awareness campaigns
• Training records and effectiveness measurement

8. Policies and Procedures Regarding Use of Cryptography and Encryption

Protect data confidentiality and integrity through cryptographic controls.

Requirements:

• Cryptography policy
• Encryption standards for data at rest and in transit
• Key management procedures
• Certificate management
• Cryptographic algorithm selection guidance
• Regular review of cryptographic implementations

9. Human Resources Security, Access Control Policies, and Asset Management

Manage people, access, and assets securely.

Requirements:

• Pre-employment screening and security checks
• Security responsibilities in employment contracts
• Departure procedures (access revocation)
• Role-based access control (RBAC)
• Privileged access management (PAM)
• Asset inventory and ownership
• Acceptable use policies

10. Multi-Factor Authentication, Secured Communications, and Emergency Communications

Deploy strong authentication and secure communication channels.

Requirements:

• MFA for all remote access and privileged accounts
• MFA for access to critical systems
• Continuous authentication where appropriate
• Encrypted communications (TLS 1.2+ minimum)
• Secure emergency communication channels
• Out-of-band communication capabilities
• Secure voice and video communications

---

Incident Reporting Requirements

NIS2 introduces a multi-stage incident reporting regime for significant incidents. An incident is considered significant if it causes or is capable of causing:

• Severe operational disruption or financial loss
• Considerable material or non-material damage to other persons

Reporting Timeline

Additional Requirements

• Entities must inform recipients of their services without undue delay if the significant incident is likely to adversely affect the provision of those services
• Member States may require entities to use specific platforms or templates
• CSIRTs must provide feedback and guidance within 24 hours of receiving early warning
• Active cyber threats must be reported to recipients of services along with remediation measures

---

Management Accountability (Article 20)

NIS2 introduces personal accountability for management bodies — a significant departure from NIS1.

Key requirements:

1. Approval and oversight: Management bodies must approve cybersecurity risk management measures and oversee their implementation 2. Liability: Management bodies can be held liable for infringements of Article 21 3. Training: Members of management bodies must undergo cybersecurity training and encourage similar training for employees 4. Sufficient knowledge: Management bodies must have sufficient knowledge and skills to assess cybersecurity risks and management practices

Consequences of non-compliance:

• Member States may impose a temporary prohibition on natural persons holding management responsibilities at CEO or legal representative level in essential entities
• Administrative fines and other enforcement measures
• Personal liability for management body members who fail to comply

---

Supply Chain Security Deep-Dive

Supply chain security is one of the most impactful new requirements under NIS2.

Requirements

Entities must take into account:

1. Vulnerabilities specific to each direct supplier and service provider 2. Overall quality of products and cybersecurity practices of suppliers, including secure development procedures 3. Results of coordinated security risk assessments of critical supply chains (per Article 22) 4. Supplier contractual arrangements including:

• Security requirements and certifications
• Right to audit
• Incident notification obligations
• Sub-contractor security requirements

Implementation Framework

Tier 1 — Critical suppliers:

• Full security assessment before onboarding
• Annual security audits or certification verification (ISO 27001, SOC 2)
• Real-time incident notification requirements
• Right to audit clauses
• Exit strategy and data portability requirements

Tier 2 — Important suppliers:

• Security questionnaire and self-assessment
• Periodic security review (biannual)
• Contractual security requirements
• Incident notification within 48 hours

Tier 3 — Standard suppliers:

• Basic security questionnaire
• Annual review of security posture
• Standard contractual security clauses

Coordinated Risk Assessments (Article 22)

The NIS Cooperation Group may carry out coordinated risk assessments of critical supply chains, considering:

• Technical and non-technical risk factors
• Dependencies and potential points of failure
• Risks from non-EU influence on supply chains

---

Penalties

Administrative Fines

Other Enforcement Measures

For essential entities (Article 32):

• Binding instructions
• Orders to implement security audit recommendations
• Orders to bring measures into compliance
• Temporary suspension of certifications or authorizations
• Temporary prohibition of management responsibilities for responsible natural persons

For important entities (Article 33):

• Binding instructions
• Orders to implement security audit recommendations
• Orders to bring measures into compliance
• Administrative fines

Supervisory Regime Differences

---

NIS2 vs NIS1 Comparison

---

Infrastructure Security Checks

DNS Security

• DNSSEC implementation is effectively mandatory for DNS service providers and TLD registries under NIS2
• Validate DNSSEC chain of trust for all zones
• Implement DNS monitoring and anomaly detection
• Consider DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) for internal resolution
• Monitor for DNS tunneling and exfiltration

Network Monitoring and Segmentation

• Deploy network monitoring for anomaly detection (Article 21(2)(b))
• Implement network segmentation between critical and non-critical systems
• Monitor east-west traffic within data centers
• Deploy network-based intrusion detection/prevention systems
• Maintain network flow logs for forensic analysis

Endpoint Detection and Response

• Deploy EDR solutions on all endpoints accessing critical systems
• Configure automated threat detection and response
• Maintain endpoint inventory with health status
• Implement application whitelisting for critical systems
• Regular endpoint compliance scanning

MFA Enforcement (Article 21(2)(j))

• Deploy MFA for all remote access
• Enforce MFA for privileged accounts
• Implement MFA for access to critical systems and data
• Consider passwordless authentication where feasible
• Support hardware security keys (FIDO2/WebAuthn) for high-risk accounts

Encryption Requirements

• TLS 1.2 minimum for all external communications; TLS 1.3 preferred
• Encrypt data at rest using AES-256 or equivalent
• Implement end-to-end encryption for sensitive communications
• Deploy certificate management and monitoring
• Regular cryptographic algorithm review

Vulnerability Disclosure Coordination

• Establish a coordinated vulnerability disclosure (CVD) policy
• Designate a vulnerability disclosure contact
• Participate in ENISA's vulnerability database
• Implement responsible disclosure processes
• Track and remediate disclosed vulnerabilities within defined timelines

Physical Security for Critical Infrastructure

• Physical access controls for data centers and critical facilities
• Environmental monitoring (temperature, humidity, water detection)
• Surveillance and intrusion detection systems
• Visitor management and escort procedures
• Physical security testing as part of overall resilience testing

---

Tools

NIS2 Scope Analyzer

Determines whether an organization falls within NIS2 scope and classifies it as Essential or Important.

# Analyze scope interactively
python scripts/nis2_scope_analyzer.py --sector energy --sub-sector electricity --employees 500 --turnover 100

# Full analysis with JSON output
python scripts/nis2_scope_analyzer.py --sector health --sub-sector healthcare_providers --employees 75 --turnover 15 --json

# Generate compliance checklist
python scripts/nis2_scope_analyzer.py --sector digital_infrastructure --sub-sector cloud_computing --employees 200 --turnover 50 --checklist

# Load from config file
python scripts/nis2_scope_analyzer.py --config organization.json --json --output scope_report.json

Features:

• Sector and sub-sector classification against Annex I and Annex II
• Size threshold evaluation (employees, turnover, balance sheet)
• Automatic inclusion detection (DNS providers, TLD registries, etc.)
• Entity type determination (Essential vs Important)
• Applicable obligations summary
• Compliance checklist generation

---

NIS2 Compliance Checker

Assesses compliance against all 10 minimum security measures with per-measure scoring.

# Run full compliance check
python scripts/nis2_compliance_checker.py --config assessment.json

# Generate assessment template
python scripts/nis2_compliance_checker.py --template > assessment.json

# Check specific measures only
python scripts/nis2_compliance_checker.py --config assessment.json --measures 1 2 4 --json

# Generate gap analysis report
python scripts/nis2_compliance_checker.py --config assessment.json --output gap_report.json --json

Features:

• Assessment against all 10 Article 21 minimum measures
• Per-measure compliance scoring (0–100)
• Overall compliance score
• Incident reporting readiness validation
• Supply chain security assessment
• Management accountability verification
• Gap analysis with prioritized remediation recommendations

---

Reference Guides

NIS2 Requirements Guide

Complete coverage of all 10 minimum security measures with implementation guidance, incident reporting procedures, management accountability requirements, supply chain security framework, and ISO 27001 control mapping.

NIS2 Implementation Playbook

12-month implementation roadmap with resource requirements, policy templates, technical controls checklist, training requirements, and cost estimation framework.

---

Compliance Assessment Workflow

Phase 1: Scope Determination

1. Identify sector and sub-sector classification
   → Use NIS2 Scope Analyzer tool
2. Determine entity size (employees, turnover, balance sheet)
3. Check for automatic inclusion criteria
4. Classify as Essential or Important entity
5. Identify applicable Member State transposition requirements

Phase 2: Gap Assessment

1. Document current security posture
2. Map existing controls to NIS2 10 minimum measures
   → Use NIS2 Compliance Checker tool
3. Assess incident reporting readiness
4. Evaluate supply chain security maturity
5. Review management accountability compliance
6. Generate gap analysis report

Phase 3: Remediation Planning

1. Prioritize gaps by risk and regulatory impact
2. Develop remediation roadmap (see Implementation Playbook)
3. Allocate budget and resources
4. Define project milestones and ownership
5. Establish governance structure

Phase 4: Implementation

1. Implement technical controls
2. Develop and approve policies
3. Deploy monitoring and detection capabilities
4. Establish incident reporting procedures
5. Conduct supply chain security assessments
6. Train management body and staff

Phase 5: Continuous Compliance

1. Regular compliance assessments (quarterly minimum)
2. Annual management body training refresh
3. Incident response exercises (biannual)
4. Supply chain security reviews (annual)
5. Policy review and update cycles
6. Audit preparation and execution

---

NIS2 Implementation Roadmap

12-Month Plan

Quick Wins (Month 1–3)

1. Enable MFA for all remote access and privileged accounts 2. Document existing security policies 3. Establish incident reporting contact with national CSIRT 4. Begin management body cybersecurity training 5. Create asset inventory of critical systems 6. Review and update backup procedures

Resource Estimates

---

---

Troubleshooting

---

Success Criteria

• All in-scope entities correctly classified as Essential or Important with documented rationale for the classification decision
• Compliance scores of 70% or higher across all 10 minimum security measures within the first assessment cycle, trending toward 90%+ within 12 months
• Incident reporting procedures tested and validated against the 24h/72h/1-month staged timeline, with documented CSIRT contact and reporting templates
• Management body members have completed mandatory cybersecurity training with documented attendance and knowledge assessment records
• Supply chain security program covers 100% of Tier 1 (critical) suppliers with quality agreements, right-to-audit clauses, and incident notification requirements in contracts
• Gap analysis produces a prioritized remediation roadmap with assigned owners, budgets, and milestone dates for every identified gap
• Quarterly compliance reassessments demonstrate measurable improvement with trending metrics reported to management

---

Scope & Limitations

In Scope:

• NIS2 Directive (EU 2022/2555) compliance assessment and gap analysis
• Entity classification (Essential vs Important) per Annex I and Annex II
• All 10 Article 21 minimum security measures assessment
• Incident reporting readiness evaluation against the multi-stage reporting regime
• Supply chain security framework assessment (Tier 1/2/3 suppliers)
• Management accountability verification per Article 20
• Cross-framework mapping to ISO 27001 controls

Out of Scope:

• National transposition specifics (varies by Member State; the tools assess against the directive baseline, not country-specific implementing legislation)
• Technical penetration testing or vulnerability scanning (use infrastructure-compliance-auditor for technical checks)
• CER Directive (EU 2022/2557) physical resilience requirements (complementary but separate regulation)
• DORA (EU 2022/2554) requirements for financial sector entities (use dora-compliance-expert for lex specialis)
• Legal advice on penalty exposure or liability (consult qualified legal counsel)
• Real-time infrastructure monitoring or SIEM deployment

---

Integration Points

---

Tool Reference

nis2_scope_analyzer.py

Determines NIS2 applicability and entity classification.

nis2_compliance_checker.py

Assesses compliance against all 10 Article 21 minimum security measures.

---

Last Updated: March 2026 Directive Reference: EU 2022/2555 Applicable From: October 17, 2024 (Member State transposition deadline)

NIS2 Implementation Playbook

A 12-month implementation roadmap for achieving NIS2 Directive compliance, including resource requirements, policy templates, technical controls, training, and cost estimation.

---

Table of Contents

• 12-Month Implementation Roadmap
• Resource Requirements
• Policy Templates Needed
• Technical Controls Checklist
• Training Requirements
• Cost Estimation Framework

---

12-Month Implementation Roadmap

Phase 1: Assessment and Foundation (Months 1–3)

Month 1: Scope and Gap Analysis

Month 2: Planning and Governance

Month 3: Quick Wins and Foundation

Phase 2: Core Implementation (Months 4–8)

Month 4: Risk Framework and Policies

Month 5: Incident Management

Month 6: Business Continuity and Cryptography

Month 7: Access Control and HR Security

Month 8: Secure Development and Vulnerability Management

Phase 3: Supply Chain and Training (Months 9–10)

Month 9: Supply Chain Security

Month 10: Training and Awareness

Phase 4: Validation and Operationalization (Months 11–12)

Month 11: Testing and Validation

Month 12: Operationalize and Continuous Improvement

---

Resource Requirements

Staffing

Organization Size Scaling

---

Policy Templates Needed

The following policies must be developed or updated to satisfy NIS2 Article 21:

Tier 1: Mandatory Policies (Months 3-4)

Tier 2: Supporting Policies (Months 4-6)

Tier 3: Operational Policies (Months 6-8)

---

Technical Controls Checklist

Identity and Access

• [ ] MFA deployed for all remote access
• [ ] MFA deployed for all privileged accounts
• [ ] MFA deployed for critical system access
• [ ] SSO implemented for enterprise applications
• [ ] PAM solution deployed for privileged access management
• [ ] RBAC implemented with documented role-permission matrix
• [ ] Automated user provisioning/deprovisioning connected to HR
• [ ] Access review process operational (quarterly for critical systems)
• [ ] FIDO2/WebAuthn supported for high-risk accounts

Network Security

• [ ] Network segmentation between critical and non-critical zones
• [ ] Firewall rules reviewed and minimized
• [ ] IDS/IPS deployed at network perimeter and critical segments
• [ ] VPN with MFA for remote access
• [ ] DNS security controls (DNSSEC where applicable)
• [ ] DDoS mitigation in place for public-facing services
• [ ] Network monitoring for anomaly detection
• [ ] East-west traffic monitoring within data centers

Endpoint Security

• [ ] EDR deployed on all endpoints
• [ ] Full disk encryption on all endpoints
• [ ] Application control/whitelisting for critical systems
• [ ] Automated patch management for endpoints
• [ ] Mobile device management (MDM) for company devices
• [ ] USB device control policies enforced

Data Protection

• [ ] Data at rest encrypted (AES-256 or equivalent)
• [ ] Data in transit encrypted (TLS 1.2+ minimum)
• [ ] Database encryption deployed for sensitive data
• [ ] Backup encryption enabled
• [ ] Key management solution deployed
• [ ] Certificate management and monitoring in place
• [ ] Data classification scheme applied

Monitoring and Detection

• [ ] SIEM deployed with log sources from all critical systems
• [ ] Log retention policy enforced (minimum per regulatory requirement)
• [ ] Alerting rules configured for security events
• [ ] 24/7 monitoring capability (SOC or MSSP)
• [ ] User behavior analytics (UBA/UEBA) for anomaly detection
• [ ] File integrity monitoring for critical systems

Vulnerability Management

• [ ] External vulnerability scanning (weekly minimum)
• [ ] Internal vulnerability scanning (monthly minimum)
• [ ] Web application scanning for public-facing applications
• [ ] Vulnerability prioritization process with SLAs
• [ ] Remediation tracking and reporting
• [ ] Annual external penetration testing

Backup and Recovery

• [ ] Automated backups aligned with RPO requirements
• [ ] 3-2-1 backup strategy implemented
• [ ] Immutable/air-gapped backups for ransomware protection
• [ ] Backup restoration tested quarterly
• [ ] DRP documented and tested annually
• [ ] Recovery procedures validated for all critical systems

Emergency Communications

• [ ] Out-of-band communication channel established
• [ ] Emergency contact lists maintained and accessible offline
• [ ] Crisis communication platform deployed
• [ ] Emergency communication tested biannually
• [ ] Secure messaging platform for sensitive communications

---

Training Requirements

Management Body Training

All-Staff Awareness Training

Technical Staff Training

---

Cost Estimation Framework

One-Time Implementation Costs

Annual Recurring Costs

ROI Considerations

The cost of non-compliance significantly exceeds implementation costs:

Cost Optimization Strategies

1. Leverage existing ISO 27001 certification — Organizations with ISO 27001 can reduce implementation costs by 30-40% 2. Use managed security services — MSSP can be more cost-effective than building internal SOC for medium enterprises 3. Prioritize by risk — Address high-risk gaps first, defer lower-risk items 4. Group with related compliance — Combine NIS2 with GDPR, DORA, or ISO 27001 implementation for shared controls 5. Automate where possible — Invest in automated vulnerability scanning, compliance monitoring, and reporting to reduce ongoing personnel costs

---

Last Updated: March 2026 Directive Reference: EU 2022/2555

NIS2 Requirements Guide

Comprehensive reference for implementing all requirements of the NIS2 Directive (EU 2022/2555), including the 10 minimum security measures, incident reporting procedures, management accountability, and supply chain security.

---

Table of Contents

• 10 Minimum Security Measures — Implementation Guidance
• Incident Reporting Procedures
• Management Accountability Requirements
• Supply Chain Security Framework
• ISO 27001 Control Mapping

---

10 Minimum Security Measures — Implementation Guidance

Measure 1: Risk Analysis and Information System Security Policies

Article Reference: Article 21(2)(a)

What is required:

• Formal, documented risk assessment methodology covering all information systems
• Comprehensive asset inventory with classification and ownership
• Information security policy framework approved by the management body
• Regular review and update cycle for policies and risk assessments

Implementation steps:

1. Establish risk assessment methodology

• Select a recognized framework (ISO 27005, NIST SP 800-30, OCTAVE, FAIR)
• Define risk identification, analysis, evaluation, and treatment processes
• Document risk appetite and tolerance thresholds approved by management
• Define criteria for "significant" risks requiring treatment

2. Build asset inventory

• Identify all information systems, hardware, software, data stores, and network components
• Assign ownership for each asset
• Classify assets by criticality and data sensitivity
• Maintain automated discovery and inventory updates

3. Develop policy framework

• Create an overarching information security policy (top-level commitment)
• Develop topic-specific policies: access control, cryptography, physical security, operations security, communications security, system acquisition/development, supplier relationships, incident management, business continuity, compliance
• Ensure management body formally approves each policy
• Establish a policy exception process

4. Implement review cycles

• Annual policy review (minimum) or upon significant changes
• Quarterly risk assessment updates for critical systems
• Annual comprehensive risk reassessment
• Document all review outcomes and actions

Evidence to maintain:

• Risk assessment methodology document
• Risk register with treatment plans
• Asset inventory with last-updated dates
• Signed policy approval records
• Policy review meeting minutes

---

Measure 2: Incident Handling

Article Reference: Article 21(2)(b)

What is required:

• Detection capabilities across all information systems
• Incident classification and triage procedures
• Response plans and playbooks for key scenarios
• Post-incident analysis and lessons learned

Implementation steps:

1. Deploy detection capabilities

• SIEM for log correlation and alerting
• Network intrusion detection/prevention systems (NIDS/NIPS)
• Endpoint detection and response (EDR) on all endpoints
• Application-level monitoring and anomaly detection
• Email security gateway with phishing detection

2. Define classification and triage

• Establish severity levels (Critical, High, Medium, Low, Informational)
• Define classification criteria: impact on services, data affected, geographic scope, financial impact
• Create decision trees for triage
• Define escalation paths for each severity level

3. Develop response playbooks

• Ransomware response playbook
• Data breach response playbook
• DDoS attack response playbook
• Insider threat response playbook
• Supply chain compromise playbook
• Advanced persistent threat (APT) playbook

4. Establish 24/7 response capability

• SOC or on-call rotation covering all hours
• Defined communication channels for incident escalation
• Contact lists for internal teams, management, CSIRT, legal, PR
• War room procedures for major incidents

5. Implement post-incident review

• Mandatory post-incident review for all Medium+ incidents
• Root cause analysis methodology (5-Why, Fishbone)
• Lessons learned documentation
• Tracking of improvement actions to completion

Evidence to maintain:

• Incident response policy and procedures
• Playbook documents for each scenario
• On-call schedule and escalation matrix
• Incident log with classification, response timeline, and outcomes
• Post-incident review reports

---

Measure 3: Business Continuity and Crisis Management

Article Reference: Article 21(2)(c)

What is required:

• Business impact analysis (BIA)
• Business continuity plans (BCP) and disaster recovery plans (DRP)
• Backup management with tested restoration
• Regular testing of all plans

Implementation steps:

1. Conduct Business Impact Analysis

• Identify all critical business functions and supporting systems
• Determine maximum tolerable downtime for each function
• Set Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
• Assess financial, operational, reputational, and regulatory impact of disruption

2. Develop Business Continuity Plans

• Create BCPs for each critical business function
• Define roles and responsibilities during continuity events
• Establish alternate work locations and communication procedures
• Document manual workarounds for critical processes

3. Develop Disaster Recovery Plans

• Create DRPs for each critical system
• Define failover procedures (automated and manual)
• Document system restoration sequences (dependency-aware)
• Establish data validation and integrity checks post-recovery

4. Implement backup management

• Automated backups aligned with RPO requirements
• 3-2-1 backup strategy: 3 copies, 2 media types, 1 offsite
• Immutable backups for ransomware protection
• Regular backup integrity verification

5. Test plans regularly

• Annual full-scale BCP/DRP exercise
• Biannual tabletop exercises for crisis scenarios
• Quarterly backup restoration tests
• Document test results and improvement actions

Evidence to maintain:

• Business Impact Analysis document
• BCP and DRP documents
• Backup configuration and schedule documentation
• Backup restoration test records
• BCP/DRP exercise reports and improvement tracking

---

Measure 4: Supply Chain Security

Article Reference: Article 21(2)(d)

What is required:

• Supplier risk assessment process
• Security requirements in contracts
• Ongoing monitoring of supplier security
• Assessment of aggregate supply chain risks

Implementation steps:

1. Establish supplier classification

• Tier 1 (Critical): Direct access to sensitive systems/data, essential to operations
• Tier 2 (Important): Limited access, important but not essential
• Tier 3 (Standard): No direct access, limited business impact

2. Conduct supplier risk assessments

• Pre-onboarding security assessment (questionnaire, certification check, audit)
• Risk scoring based on access level, data exposure, service criticality
• Annual reassessment for Tier 1, biannual for Tier 2
• Automated continuous monitoring where available

3. Define contractual requirements

• Security baseline requirements proportionate to tier
• Incident notification obligations (24h for Tier 1, 48h for Tier 2)
• Right to audit clause
• Sub-processor and sub-contractor notification and approval
• Data protection and confidentiality
• Exit and transition provisions

4. Monitor aggregate risks

• Identify concentration risks (single points of failure)
• Assess geographic and geopolitical risks
• Evaluate technology stack dependencies
• Review vendor financial stability

Evidence to maintain:

• Supplier register with tier classification
• Supplier risk assessment records
• Contract templates with security clauses
• Supplier audit reports
• Supply chain risk assessment reports

---

Measure 5: Security in Acquisition, Development, and Maintenance

Article Reference: Article 21(2)(e)

What is required:

• Secure development lifecycle (SDLC)
• Vulnerability management
• Patch management
• Change management with security review

Implementation steps:

1. Implement secure SDLC

• Security requirements gathering at design phase
• Threat modeling for new systems and significant changes
• Secure coding standards and developer training
• Static application security testing (SAST) in CI/CD
• Dynamic application security testing (DAST) before release
• Security-focused code reviews

2. Establish vulnerability management

• Regular vulnerability scanning (weekly external, monthly internal)
• Vulnerability prioritization using CVSS + business context
• Defined remediation SLAs: Critical 24-72h, High 1-2 weeks, Medium 1 month, Low quarterly
• Tracking and reporting on vulnerability metrics

3. Implement patch management

• Patch identification and assessment process
• Emergency patch procedures for zero-day vulnerabilities
• Scheduled patch windows with change management approval
• Rollback procedures for failed patches

4. Enforce change management

• All changes reviewed for security impact
• Separation of development, testing, and production environments
• Approval workflows for production changes
• Configuration management and drift detection

Evidence to maintain:

• SDLC documentation and security gates
• Vulnerability scan reports and remediation records
• Patch management records
• Change management logs with security reviews

---

Measure 6: Assessing Effectiveness

Article Reference: Article 21(2)(f)

What is required:

• Cybersecurity metrics and KPIs
• Regular security assessments and audits
• Penetration testing
• Continuous improvement process

Implementation steps:

1. Define cybersecurity metrics

• Mean time to detect (MTTD)
• Mean time to respond (MTTR)
• Patch compliance rate
• Vulnerability count trends (open/closed)
• Phishing simulation click rates
• Security training completion rates
• Incidents by severity and type

2. Conduct regular assessments

• Annual internal security audit covering all 10 measures
• External security audit at least biennially (annually for essential entities)
• Compliance gap assessments against NIS2 requirements
• Control effectiveness testing

3. Implement penetration testing

• Annual external penetration test (network and web application)
• Internal penetration testing for critical systems
• Social engineering assessments
• Red team exercises for mature organizations

4. Drive continuous improvement

• Management review of security metrics (quarterly minimum)
• Formal corrective action process for audit findings
• Security improvement roadmap aligned with risk register
• Benchmarking against industry standards and peers

Evidence to maintain:

• Security dashboard and metrics reports
• Internal and external audit reports
• Penetration test reports and remediation tracking
• Management review minutes and improvement actions

---

Measure 7: Cyber Hygiene and Training

Article Reference: Article 21(2)(g)

What is required:

• Cybersecurity awareness training for all personnel
• Management body cybersecurity training (mandatory)
• Role-based training for technical staff
• Phishing simulations and effectiveness measurement

Implementation steps:

1. General awareness training

• Mandatory at onboarding, annual refresher
• Topics: phishing, social engineering, password hygiene, data handling, physical security, reporting procedures
• Format: interactive e-learning modules with quiz assessment
• Minimum passing score: 80%

2. Management body training

• Dedicated cybersecurity training for board and executive members
• Topics: cyber risk landscape, NIS2 obligations, management liability, incident oversight, cybersecurity investment decisions
• Frequency: at onboarding, then annually
• This is mandatory under Article 20(2)

3. Technical role-based training

• Secure coding training for developers
• Incident response training for SOC/IR teams
• Cloud security training for infrastructure teams
• Security architecture training for architects

4. Simulated exercises

• Quarterly phishing simulations
• Targeted campaigns for high-risk departments (finance, executive, HR)
• Remedial training for repeat clickers
• Track trends over time

Evidence to maintain:

• Training program documentation
• Completion records for all personnel
• Quiz scores and pass rates
• Phishing simulation reports
• Management body training certificates

---

Measure 8: Cryptography and Encryption

Article Reference: Article 21(2)(h)

What is required:

• Cryptography policy
• Encryption for data at rest and in transit
• Key management procedures
• Regular review of cryptographic implementations

Implementation steps:

1. Develop cryptography policy

• Approved algorithms: AES-256 for symmetric, RSA-2048+ or ECDSA P-256+ for asymmetric
• Minimum TLS version: 1.2 (1.3 preferred)
• Prohibited algorithms: DES, 3DES, RC4, MD5, SHA-1 (for security purposes)
• Use cases requiring encryption (data classification driven)

2. Encrypt data at rest

• Database encryption (transparent data encryption or column-level)
• File system encryption for sensitive data
• Backup encryption
• Full disk encryption for endpoints

3. Encrypt data in transit

• TLS 1.2+ for all external communications
• TLS for internal service-to-service communications
• VPN with strong encryption for remote access
• Certificate pinning where appropriate

4. Implement key management

• Key generation using cryptographically secure random number generators
• Key storage in HSMs or secure key management services
• Key rotation schedule (annual minimum, or per use case)
• Key revocation and destruction procedures

5. Review implementations

• Annual review of cryptographic algorithm choices against current guidance (ENISA, NIST)
• TLS configuration testing (SSL Labs grade A minimum)
• Certificate expiry monitoring
• Migration plans for deprecated algorithms

Evidence to maintain:

• Cryptography policy document
• Key management procedures
• TLS configuration audit results
• Certificate inventory with expiry dates
• Cryptographic review records

---

Measure 9: Human Resources Security, Access Control, and Asset Management

Article Reference: Article 21(2)(i)

What is required:

• Pre-employment security checks
• Role-based access control (RBAC) with least privilege
• Privileged access management (PAM)
• Asset inventory with ownership
• Secure departure procedures

Implementation steps:

1. Human resources security

• Background checks proportionate to role sensitivity
• Security clauses in employment contracts
• Confidentiality/NDA agreements
• Clear definition of security responsibilities per role
• Exit interviews with security component

2. Access control

• Implement RBAC with documented role-permission matrices
• Enforce least privilege principle
• Automated provisioning and deprovisioning tied to HR systems
• Access request and approval workflows
• Regular access reviews (quarterly for critical systems, biannual for others)

3. Privileged access management

• PAM solution for credential vaulting and session management
• Just-in-time (JIT) access for administrative tasks
• Session recording for privileged access to critical systems
• Separate administrative accounts from daily-use accounts
• Break-glass procedures for emergency access

4. Asset management

• Automated discovery and inventory of all assets
• Asset classification by criticality and data sensitivity
• Asset ownership assignment and accountability
• End-of-life and disposal procedures for hardware and data
• Acceptable use policies for organizational assets

5. Departure procedures

• Immediate notification from HR to IT upon termination
• Access revocation within 24 hours (immediately for involuntary termination)
• Return of physical assets (laptops, keys, badges, tokens)
• Remote wipe capability for mobile devices
• Transfer of data ownership

Evidence to maintain:

• Background check records (per retention policy)
• Role-permission matrix
• Access review reports
• PAM deployment and session logs
• Asset inventory with ownership records
• Departure checklists with completion dates

---

Measure 10: MFA, Secured Communications, and Emergency Communications

Article Reference: Article 21(2)(j)

What is required:

• Multi-factor authentication for remote, privileged, and critical system access
• End-to-end encrypted communications
• Secured emergency communication channels
• Out-of-band communication capabilities

Implementation steps:

1. Deploy MFA

• All remote access (VPN, cloud services, email)
• All privileged and administrative accounts
• Access to critical systems and sensitive data
• Single sign-on (SSO) with MFA for all enterprise applications
• Support FIDO2/WebAuthn hardware keys for high-risk accounts
• Phishing-resistant MFA where feasible

2. Secured communications

• Encrypted email for sensitive communications (S/MIME or PGP)
• Encrypted instant messaging for business communications
• Encrypted file sharing with access controls
• Secure video conferencing platforms

3. Emergency communications

• Out-of-band communication channel (satellite phones, separate network)
• Emergency contact lists accessible offline
• Pre-established communication protocols for crisis scenarios
• Regular testing of emergency communication channels

Evidence to maintain:

• MFA deployment records and coverage metrics
• MFA exception register (with risk acceptance)
• Emergency communication procedures
• Emergency communication test records

---

Incident Reporting Procedures

Overview

Under Article 23, entities must report significant incidents to the CSIRT or competent authority using a multi-stage process. An incident is significant if it:

• Has caused or is capable of causing severe operational disruption of services or financial loss
• Has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage

Early Warning (Within 24 Hours)

Trigger: Upon becoming aware of a significant incident

Content requirements:

• Whether the incident is suspected of being caused by unlawful or malicious acts
• Whether the incident could have a cross-border impact
• Brief factual description

Template fields:

• Reporting entity identification (name, NIS2 registration)
• Date and time of detection
• Date and time of incident occurrence (if known)
• Brief description of the incident
• Suspected malicious/unlawful activity: Yes / No / Unknown
• Potential cross-border impact: Yes / No / Unknown
• Contact person for follow-up

Incident Notification (Within 72 Hours)

Trigger: 72 hours from becoming aware of the significant incident

Content requirements:

• Update to the early warning information
• Initial assessment of the incident severity and impact
• Indicators of compromise (IoC) where applicable

Template fields:

• Reference to early warning (case ID)
• Updated description of the incident
• Systems and services affected
• Number of users/entities affected
• Geographic scope
• Severity assessment (Critical / High / Medium)
• Root cause assessment (if known at this stage)
• Indicators of compromise (IPs, domains, hashes, signatures)
• Mitigation measures implemented

Intermediate Report (Upon Request)

Trigger: Upon request from CSIRT or competent authority

Content requirements:

• Status update on incident handling and response
• Additional details as requested

Final Report (Within 1 Month)

Trigger: No later than one month after the incident notification

Content requirements:

• Detailed description of the incident, including severity and impact
• Type of threat or root cause that likely triggered the incident
• Applied and ongoing mitigation measures
• Cross-border impact (if applicable)

Template fields:

• Complete incident timeline
• Root cause analysis results
• Full impact assessment (operational, financial, data, reputational)
• Detailed description of mitigation measures
• Lessons learned
• Improvement actions planned
• Cross-border impact details (affected Member States, entities)

---

Management Accountability Requirements

Article 20 Obligations

Management body refers to the governing body of the entity (board of directors, executive management, or equivalent).

Approval and Oversight (Article 20(1))

The management body must:

• Approve the cybersecurity risk management measures adopted under Article 21
• Oversee the implementation of those measures
• Be liable for infringements of Article 21

Implementation guidance:

• Cybersecurity measures must be a formal board/management agenda item
• Management body must receive regular reports on cybersecurity posture
• Approval should be documented in meeting minutes
• A named member should have oversight responsibility for cybersecurity

Training (Article 20(2))

Members of the management body must:

• Undergo training to gain sufficient knowledge and skills to identify cybersecurity risks
• Assess cybersecurity risk management practices and their impact on services
• Encourage similar training for employees on a regular basis

Recommended training topics:

• Current cyber threat landscape relevant to the entity's sector
• NIS2 obligations and management liability
• Cybersecurity risk assessment fundamentals
• Incident response oversight responsibilities
• Cybersecurity investment and resource allocation
• Supply chain cybersecurity risks

Enforcement Implications

For essential entities, Member States may impose:

• Temporary prohibition on natural persons responsible from exercising managerial functions at CEO or legal representative level
• This is a significant personal consequence unique to NIS2

---

Supply Chain Security Framework

Tier-Based Approach

Tier 1 — Critical Suppliers (Direct access to sensitive systems, essential to core operations)

Tier 2 — Important Suppliers (Limited access, important but not essential)

Tier 3 — Standard Suppliers (No direct access, limited impact)

Contractual Security Requirements

Essential clauses for Tier 1 and Tier 2 supplier contracts:

1. Security baseline: Supplier must maintain security measures at least equivalent to industry standards 2. Incident notification: Supplier must notify of any security incident affecting the entity's data or services within defined timeline 3. Right to audit: Entity may audit or commission audit of supplier's security controls 4. Sub-processor notification: Supplier must notify and obtain approval before engaging sub-processors 5. Data protection: Compliance with applicable data protection requirements 6. Business continuity: Supplier must maintain BCP/DRP for services provided 7. Termination and transition: Data return, deletion, and transition assistance obligations 8. Compliance: Supplier must comply with applicable NIS2 requirements

---

ISO 27001 Control Mapping

NIS2 Measure to ISO 27001:2022 Control Mapping

Gap Analysis Approach

For organizations already ISO 27001 certified:

1. Map existing ISO 27001 controls to NIS2 measures using the table above 2. Identify NIS2-specific requirements not fully covered by ISO 27001:

• Specific incident reporting timelines (24h/72h/1 month)
• Management body training and personal liability
• Supply chain security at the level of detail required
• Emergency communication channels

3. Conduct gap assessment for these areas 4. Develop remediation plan for identified gaps

Organizations with ISO 27001 certification typically have 60-70% of NIS2 requirements already addressed. Key gaps are usually in incident reporting timelines, management accountability, supply chain depth, and emergency communication.

---

Last Updated: March 2026 Directive Reference: EU 2022/2555, Articles 20-23