Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When is a NIS2 readiness gap blocking, and who must hear about it?

4 decision pointsThe pack behind this answer: NIS2 Implementation & Readiness

Add to board memo

The short answer

Recommendation
Treat a gap as blocking when a duty NIS2 places on you directly is rated Not started or Planned. Give it Priority 1, and take it to the management body at its next meeting, or to its chair within 10 working days where that meeting is later. Report every other gap in the quarterly report.
Reasoning
A supervisor weighs most a duty not met at all. The blocking items are the duties NIS2 places on the entity directly: scope and registration, the management body's duties, each of the ten measures and incident reporting. Below In place, any of them is a blocking gap, and one blocking gap makes the readiness result Not ready. A blocking item that is In place but not operating is Priority 2, because a request for evidence would find it incomplete. Any other item below Operating is Priority 3. Every gap goes into the tracker with one owner, a priority, a due date and the change that closes it (NR-09).
Considerations
  • The 30, 90 and 180 days to close and the 10 working days to tell the chair are the pack's defaults (NR-10). Your own rules may set others. This is not legal advice, and national law may add duties of its own.
  • When in doubt, rate the lower level, treat an item as blocking, and treat a duty as applying. If no meeting date is set, tell the chair.
  • A financial entity marks the NIS2 items DORA matches as Not applicable, with counsel's view, and assesses them against DORA instead.
  • An essential entity can be supervised at any time, so the pack tells it to treat Priority 2 gaps as urgent too.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn item is rated below OperatingDecisionDoes the duty apply to you at all?OutcomeNot applicable: record why, and have counsel confirmDecisionIs it a duty NIS2 places on you directly?DecisionIs it Not started or Planned?StepBlocking gap: Priority 1, close within 30 daysDecisionDoes the management body meet within 10 working days?OutcomeReport it to the management body at that meetingOutcomeTell the chair within 10 working daysStepPriority 2: exposed on request, close within 90 daysStepPriority 3: improvement, close within 180 daysOutcomeReport it in the quarterly report to the management body

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    An item is rated below Operating

    Operating means working in full, meeting its own target, with records a supervisor could sample. Below that are In place (documented and working, but incomplete, short of target or thin on records), Planned (owner and approach agreed) and Not started. When in doubt, the pack says to choose the lower level. Every item below Operating is a gap.

    In the pack

  2. Decision

    Does the duty apply to you at all?

    Not applicable is for a duty that does not apply to you, with the reason recorded and confirmed by counsel. The case the pack names is a financial entity under DORA: it does not apply the NIS2 provisions that DORA matches, so with counsel it marks those items Not applicable with that reason and assesses them against DORA instead. If you are not sure, treat the duty as applying.

    In the pack

  3. Outcome

    Not applicable: record why, and have counsel confirm

    It is not a gap and counts neither for nor against the result. A financial entity assesses those items against DORA instead, and tracks the gaps against DORA's requirements in the same way, with counsel's view of which NIS2 provisions do not apply.

    In the pack

  4. Decision

    Is it a duty NIS2 places on you directly?

    These are the blocking items: scope and registration, the management body's approval, oversight and training, each of the ten risk-management measures, and incident reporting. Evidence readiness for a supervisor is the one item in the pack that is not blocking. For an item your national law adds, decide whether it is blocking when you add it. If unsure, treat it as blocking.

    In the pack

  5. Decision

    Is it Not started or Planned?

    A blocking item below In place is a blocking gap: the duty is not in place at all. A supervisor weighs most a duty not met at all. A blocking item that is In place is not blocking, though a request for evidence would find it incomplete. If you cannot show it is in place, rate it lower.

    In the pack

  6. Step

    Blocking gap: Priority 1, close within 30 days

    One blocking gap makes the whole result Not ready. The pack's default is to close it within 30 days of the assessment, or by an earlier date a plan already set. Give it one owner and the change that closes it, and correct it without undue delay. Then decide who hears first.

    In the pack

  7. Decision

    Does the management body meet within 10 working days?

    Count from the date of the assessment. The management body is the board, or the management board in a two-tier structure; where there is no board, the people national law makes responsible for running the entity. NIS2 does not define the term, so confirm with counsel what your national law counts. The 10 working days is the pack's default. If no meeting date is set, take the no branch.

    In the pack

  8. Outcome

    Report it to the management body at that meeting

    Put it on the agenda with its owner, due date and the decision you need, such as approving the missing policy. It stays in each quarterly report until it is closed. Record in your own tracker to whom it was reported and when.

    In the pack

    See also

  9. Outcome

    Tell the chair within 10 working days

    Where the next meeting is later than that, the gap goes to the chair of the management body within 10 working days, with its owner, due date and the decision needed. It stays among the open gaps the full body sees with the quarterly report. In the pack's example, an assessment on 30 September with the next board on 29 October sends the gap to the chair by 14 October.

    In the pack

    See also

  10. Step

    Priority 2: exposed on request, close within 90 days

    The duty is in place but not operating, so a request for evidence of implementation would find it incomplete. The pack's default is to close it within 90 days, or by an earlier planned date. An essential entity can be supervised at any time, so the pack tells it to treat these as urgent too.

    In the pack

  11. Step

    Priority 3: improvement, close within 180 days

    Any other item below Operating, such as evidence readiness. The pack's default is to close it within 180 days of the assessment, or by an earlier planned date. It does not block readiness: with no blocking gap, the result is Ready, with actions.

    In the pack

  12. Outcome

    Report it in the quarterly report to the management body

    Every gap goes into your tracker with one owner, a priority, a due date and the change that closes it. Report the gaps to the management body at least every quarter. Dropping a gap needs the management body's recorded reason.

    In the pack

Practical checklist

  1. Rate each item at the readiness self-assessment, choosing the lower level when in doubt.
  2. Mark Not applicable only where the duty does not apply, with the reason confirmed by counsel.
  3. Check whether the item is a duty NIS2 places on you directly.
  4. Give a blocking item rated Not started or Planned Priority 1, one owner and the change that closes it.
  5. Count working days from the assessment to the management body's next meeting.
  6. Put the gap on that meeting's agenda, or tell the chair within 10 working days, with the decision you need.
  7. Give a blocking item In place but not operating Priority 2, and any other item below Operating Priority 3.
  8. Report every open gap to the management body in the quarterly report until it is closed.

Evidence to have ready

  • The readiness self-assessment, with each item's level and the evidence or fact that decides it.
  • The gap tracker: each gap's priority, owner, due date and the change that closes it.
  • The record of each blocking gap reported, to whom and when.
  • The quarterly reports to the management body showing the open gaps.
  • The reason, confirmed by counsel, for each item marked Not applicable, and the body's recorded reason for any gap withdrawn.

Assumptions

  • You have rated each requirement at a readiness self-assessment, as Not started, Planned, In place, Operating or Not applicable.
  • The 30, 90 and 180 days and the 10 working days are the CISO Times NIS2 pack's defaults. Your own rules may set others.
  • This applies NIS2's duties as the pack states them. It is not legal advice, and your national law may add duties of its own.

Not covered here