How do we find out what our national NIS2 law adds to the Directive?

Start

We need to know where our national law goes beyond the Directive

NIS2 is a Directive, so each Member State makes its own law, and the laws differ: the authority, the registration route and deadline, the incident channel, extra fields, penalties and sometimes extra duties. CISO Times does not list country rules, because they change and there are many. This question is the method for finding yours and keeping the answer current.

• Then: Do you know which Member States' laws apply to you?

Decision

Do you know which Member States' laws apply to you?

The answer comes from where each entity is established, and from the main establishment for some digital providers. If you have not worked that out, do it first; otherwise you may check the wrong country.

• Yes: Find the national measures from official sources
• No, or not known: Work out the Member State for each entity first, then come back

Outcome

Work out the Member State for each entity first, then come back

Use the jurisdiction question to decide which Member State, or States, apply to each entity. Return with the list. Do not research every country in the Union.

Step

Find the national measures from official sources

The Directive tells each Member State to adopt and publish the measures needed and to tell the Commission. Look in the national official gazette, in the list of national measures on the Directive's page on EUR-Lex, and on the competent authority's own site. Each Member State must make public who its competent authority is, and the Commission lists the single points of contact.

• Then: Have you found the law, and does it say it transposes this Directive?

Decision

Have you found the law, and does it say it transposes this Directive?

A Member State may have transposed NIS2 by amending an earlier law on network and information security rather than passing a new one, so the title may not mention NIS2. Read the law's own recital or reference to the Directive. Not known: ask the authority or counsel.

• Yes: Read the law against the points in the member state check
• No, or not known: Record that no law is found yet; use the Directive as a guide

Step

Record that no law is found yet; use the Directive as a guide

Write the date you looked and where. If you could not tell whether a law exists, ask the authority or counsel. Meanwhile use the Directive's text and any guidance the authority has published as a guide, and set a date to look again. A law still being adopted can change what you must do and by when. Do not assume the Directive binds you directly: ask counsel what applies meanwhile.

• Then: Has the authority published its own guidance, forms or a portal?

Step

Read the law against the points in the member state check

Check who the competent authority is, where incidents go, the registration route, form and deadline, who may submit and what proof they need, the language and format, the fields the law adds, how changes are notified, and whether the authority confirms the classification it holds for you. Answer each from the official text. The sheet does not list penalties or management duties, so read the law for those separately and record them beside it.

• Then: Has the authority published its own guidance, forms or a portal?

Decision

Has the authority published its own guidance, forms or a portal?

Authorities often define terms more closely than the law, set the format for registration and give a template for reports. Where they exist, they are what you will be asked to use.

• Yes: Read them and note the official address and the date
• No: Record each difference with its source, date and what you will do

Step

Read them and note the official address and the date

Record the address of each page or form and the date you read it. Compare them with the law and note any difference. If the guidance and the law disagree, ask the authority which applies, and keep the answer.

• Then: Record each difference with its source, date and what you will do

Step

Record each difference with its source, date and what you will do

For each point write the national rule, the official source, the date you checked and the action it causes for you. Use official texts and not summaries from commentary, which are often dated or wrong. Put the result where your registration and incident teams will find it.

• Then: Have counsel confirm each answer

Step

Have counsel confirm each answer

The pack asks that the national law, the authority and its forms are checked against the official text and with counsel before they are relied on, and at each annual review. Keep the date and name of whoever confirmed.

• Then: Do you answer to more than one Member State?

Decision

Do you answer to more than one Member State?

A group, or an entity serving several countries, may face different deadlines, channels and fields in each. You need one record per Member State.

• Yes: Compare the records and decide how to run one process
• No: Feed the differences into registration, incident and training plans

Step

Compare the records and decide how to run one process

Line the records up point by point. A group may design one process to the strictest requirement, such as the earliest deadline, and add the local variations. That is a design choice, not a legal rule. Where laws conflict, take advice.

• Then: Feed the differences into registration, incident and training plans

Step

Feed the differences into registration, incident and training plans

Carry each difference to the place it matters: the registration data and its change deadlines, the incident notification profile with any shorter national clock or extra field, the management body training plan, and the measures library where national law adds detail.

• Then: Is a re-check due, or has the law or authority changed?

Decision

Is a re-check due, or has the law or authority changed?

National laws and authority guidance are still being adopted and amended. Re-check at least at each annual review, and when the authority writes to you, when you enter a new country, or when you hear of an amendment.

• Yes: Find the national measures from official sources (back to an earlier step)
• No: A sourced, counsel-checked record of national differences

Outcome

A sourced, counsel-checked record of national differences

Keep the record with its sources and dates. Do not state your national rules from memory or from a commentary, and do not tell customers or the board that the Directive alone sets your duties. Review it on a schedule.