NIS2 Readiness Assessment. Are you in scope, and are you compliant?

NIS2 (Directive (EU) 2022/2555) is the European Union's updated cyber security law for critical and important service providers. It replaces the original NIS1 Directive (2016/1148) and significantly expands scope, obligations, enforcement, and penalties. Member states were required to transpose NIS2 into national law by 17 October 2024, and most have now done so.

NIS2 shifts cyber security from a nice-to-have to a board-level legal obligation. Under Article 20, members of the management body can be held personally liable for compliance failures. Under Article 34, fines reach up to €10 million or 2% of worldwide turnover for Essential entities and €7 million or 1.4% for Important entities.

NIS2 covers two tiers of entities, listed in Annex I (Essential) and Annex II (Important). Both tiers must meet the same Article 21 risk management requirements; the difference is the supervision regime and the maximum penalty.

Annex I: Essential sectors

1. Energy: electricity, district heating and cooling, oil, gas, hydrogen
2. Transport: air, rail, water, road
3. Banking: credit institutions
4. Financial market infrastructures: trading venues, central counterparties
5. Health: healthcare providers, EU reference labs, pharmaceutical manufacturing
6. Drinking water
7. Waste water
8. Digital infrastructure: DNS service providers, TLD name registries, cloud computing providers, data centre service providers, CDNs, trust service providers, public electronic communications networks
9. ICT service management (B2B): managed service providers, MSSPs
10. Public administration
11. Space: ground-based infrastructure

Annex II: Important sectors

1. Postal and courier services
2. Waste management
3. Chemicals: manufacture, production, distribution
4. Food: wholesale distribution and industrial production/processing
5. Manufacturing: medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles, transport equipment
6. Digital providers: online marketplaces, search engines, social networks
7. Research organisations

Size thresholds

Micro (fewer than 10 employees and under €2M turnover) and small (fewer than 50 employees and under €10M turnover) entities are generally excluded. Medium (50–249 employees or €10–50M turnover) and large (250+ employees or €50M+ turnover) entities are in scope.

Size exemption overrides. Some entities are in scope regardless of size: providers of DNS, TLD registries, cloud computing, data centres, CDNs, trust services, public electronic communications networks, public administration at central level, and any entity designated as the sole provider of a critical service in a member state.

Article 21(2) of NIS2 requires both Essential and Important entities to implement appropriate and proportionate technical, operational, and organisational measures across these ten areas. Our assessment maps every one.

1. Risk analysis and information system security policies: board approval, risk register, information classification.
2. Incident handling: detection, triage, containment, recovery.
3. Business continuity: backup, disaster recovery, crisis management.
4. Supply chain security: direct suppliers and service providers.
5. Security in acquisition, development, maintenance: including vulnerability handling and coordinated disclosure.
6. Effectiveness assessment: measuring and improving controls.
7. Basic cyber hygiene and training: including training for the management body.
8. Cryptography and encryption: policies on use.
9. HR security, access control, asset management.
10. MFA, continuous authentication, secured communications.

NIS2 Article 23 imposes a three-stage reporting cadence for significant incidents. A significant incident is one that causes or is capable of causing severe operational disruption or financial loss, or that has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

• 24h early warning to the national CSIRT or competent authority.
• 72h full incident notification with initial assessment of severity and cross-border impact.
• 1-month final report covering root cause, applied mitigations, and cross-border impact.

Our Article 23 readiness section checks that your runbooks, templates, and 24/7 contact details for the national CSIRT are in place before you need them.

• Essential entities: fines up to €10 million or 2% of worldwide annual turnover, whichever is higher.
• Important entities: fines up to €7 million or 1.4% of worldwide annual turnover, whichever is higher.
• Management body liability under Article 20: the board must approve risk management measures, oversee implementation, and can be held personally liable for infringements, including temporary bans from management functions in severe cases.
• Mandatory training for the management body on cyber security risks and controls.