NIS2 Implementation & Readiness — Guide
- Version 1.1
- Updated
- Next review
NIS2 Implementation & Readiness
NIS2 puts cybersecurity on the management body’s agenda by name. The directive says who is caught, what the management body must approve and oversee, which ten risk-management measures an entity must have, and how quickly significant incidents are reported. Most organisations lose time on the first question and never reach the rest. This pack takes you from “are we in scope?” to a readiness position the board can act on.
Is this for you?
This pack is for you if:
- nobody has written down whether you are an essential entity, an important entity, or out of scope, and why;
- your board has not formally approved your cybersecurity measures, or has not had a report on them this quarter;
- you could not show a supervisor, within a week, the records behind each of the ten measures.
What NIS2 asks of an entity
| Area | What it asks | Where the pack helps |
|---|---|---|
| Scope | Work out whether you are covered, and as an essential or important entity (Articles 2 and 3) | The scope assessment |
| Registration | Give your competent authority the information it asks for, and keep it current (Articles 3 and 27) | The registration data sheet |
| Management body | Approve the risk-management measures, oversee them, and follow training (Article 20) | The accountability record and training plan |
| Measures | Put in place the ten measures of Article 21(2), proportionate to your risks | The measures library and readiness self-assessment |
| Incidents | Report significant incidents on NIS2’s clock (Article 23) | The incident management pack |
National law transposes the directive, so the authority, the registration route and some details differ by Member State. The pack leaves those as fields for you to confirm against your national law and with counsel. It helps you apply the tests; it is not legal advice.
How it runs in practice
Take a food distributor with 900 staff and €104 million turnover. Food wholesale is an Annex II sector and the firm is large, so the scope assessment makes it an important entity, with the reasoning recorded and confirmed by counsel in May. The board approved the measures in July, with cryptography left outstanding until its policy is written, and gets a report every quarter. The September self-assessment rates 17 items: 10 operating, 6 in place and 1 planned. Staff training is in place, not operating, because it stands at 92% against a 95% target. The planned item is the cryptography policy for Article 21(2)(h), so the result is Not ready, with one blocking gap due by 30 October. The next board meeting is 29 October, so the chair hears of the gap by 14 October. The board sees it in one sentence, with the decision it needs to take.
Start with these three
- NIS2 Scope & Entity Classification Assessment: the tests in the order NIS2 applies them, with your reasoning recorded.
- NIS2 Readiness Self-Assessment: each requirement rated from Not started to Operating, and the gaps that block readiness.
- Management Body Cybersecurity Accountability Record: the approval and each oversight review, as a supervisor would ask to see them.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Run the scope assessment and take it to counsel. | The scope decision is written down, with its reasons. |
| Week 2 | Confirm registration with your competent authority. | The data sheet matches what the authority holds. |
| Week 3 | Run the readiness self-assessment and log every gap. | Each gap has an owner, a priority and a due date. |
| Week 4 | Brief the management body and book its training. | The board has approved the measures and minuted the blocking gaps. |
What to report to the board
Report these every quarter:
- the scope decision, and whether anything has changed it;
- the readiness result in words: Ready, Ready, with actions, or Not ready;
- blocking gaps, with owners and due dates;
- management body training completed and booked.
A blocking gap goes to the board at its next meeting, or to its chair within ten working days if that meeting is later.
Everything in the pack
| Document | What it does | Format |
|---|---|---|
| NIS2 Scope & Entity Classification Assessment | In scope or not, essential or important, and why | Excel |
| NIS2 Article 21 Measure-to-Control Mapping Library | Each measure in NIS2’s words, what to be able to show, and the documents that support it | Excel |
| NIS2 Readiness Self-Assessment | Readiness by requirement, with blocking gaps | Excel |
| Management Body Cybersecurity Accountability Record | Approval and oversight of the measures | Word |
| Management Body Cybersecurity Training Plan | Who has been trained, and who is due | Excel |
| NIS2 Documentation & Evidence Checklist | What a supervisor may ask for, and where it is | Excel |
| NIS2 Gap & Remediation Tracker | Gaps into owned, dated actions | Excel |
| NIS2 Competent Authority Registration Data Sheet | The information registration asks for | Excel |
| NIS2 Management Briefing Deck | Obligations, position and decisions, for the board | PowerPoint |
The measures library gives NIS2’s own words and the CISO Times documents that help with each measure. It does not map NIS2 to ISO/IEC 27001 or to the NIST CSF: mappings are published in the CISO Times Library, each with how closely the two match and where they differ; confirm one against both texts before relying on it.
Adapting it
- Small organisation: most small firms are out of scope unless a size-independent case applies. Record the reasoning anyway: it is the first thing a supervisor or customer asks for.
- Financial entity: DORA applies instead of NIS2’s risk-management and reporting duties. Record that in the scope assessment and use DORA’s requirements.
- IT run by an outside provider: several measures depend on the provider. Name them in the measures library and check the contract gives you the records you need.
Where it maps
- NIS2: Articles 2, 3, 20, 21, 23 and 27.
- ISO/IEC 27001:2022: Clause 4.2 and Annex A 5.31.
- NIST CSF 2.0: GV.OC-03.
What changed
Each change to this pack's documents since it was published, newest first.Changes across all packs
The note on mappings says the CISO Times Library shows each mapping with how closely the two match and where they differ, and to confirm one against both texts before relying on it, instead of a verification state.
- Guide 1.0 → 1.1
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
Test cases TC-21 to TC-23 answer SQ-03 with Annex I, as the Assessment sheet's check requires of every SQ-04 type; classifications unchanged.
Names the P27 documents.
The training interval is this pack's default, not the Directive's.
Names the P24 documents.
Names the P25 documents.
Names the P26 documents.
Adds the P23 documents under measure (c), business continuity and backup management.
Lists the published security maturity assessment documents (P19) that support measure (f).
Lists the published security control assurance documents (P20) that support measure (f).
Names the P22 documents.
Counts the published security maturity assessment documents (P19) the measure library now lists.
- NIS2 Documentation & Evidence Checklist 1.1 → 1.2
Counts the published security control assurance documents (P20) the measure library now lists.
- NIS2 Documentation & Evidence Checklist 1.2 → 1.3
Lists the published access, privileged access and classification documents that support each measure.
Counts the published access, privileged access and classification documents the measure library now lists against each measure.
- NIS2 Documentation & Evidence Checklist 1.0 → 1.1
Published. The guide and nine documents, at 1.0.