NIS2 Implementation & Readiness — Guide
- Version 1.2
- Updated
- 9 documents
- Excel, Word, PowerPoint
NIS2 Implementation & Readiness
NIS2 puts cybersecurity on the management body’s agenda by name. The directive says who is caught, what the management body must approve and oversee, which ten risk-management measures an entity must have, and how quickly significant incidents are reported. Most organisations lose time on the first question and never reach the rest. This pack takes you from “are we in scope?” to a readiness position the board can act on.
Is this for you?
This pack is for you if:
- nobody has written down whether you are an essential entity, an important entity, or out of scope, and why;
- your board has not formally approved your cybersecurity measures, or has not had a report on them this quarter;
- you could not show a supervisor, within a week, the records behind each of the ten measures.
What NIS2 asks of an entity
| Area | What it asks | Where the pack helps |
|---|---|---|
| Scope | Work out whether you are covered, and as an essential or important entity (Articles 2 and 3) | The scope assessment |
| Registration | Give your competent authority the information it asks for, and keep it current (Articles 3 and 27) | The registration data sheet |
| Management body | Approve the risk-management measures, oversee them, and follow training (Article 20) | The accountability record and training plan |
| Measures | Put in place the ten measures of Article 21(2), proportionate to your risks | The measures library and readiness self-assessment |
| Incidents | Report significant incidents on NIS2’s clock (Article 23) | The incident management pack |
National law transposes the directive, so the authority, the registration route and some details differ by Member State. The pack leaves those as fields for you to confirm against your national law and with counsel. It helps you apply the tests; it is not legal advice.
How it runs in practice
Take a food distributor with 900 staff and €104 million turnover. Food wholesale is an Annex II sector and the firm is large, so the scope assessment makes it an important entity, with the reasoning recorded and confirmed by counsel in May. The board approved the measures in July, with cryptography left outstanding until its policy is written, and gets a report every quarter. The September self-assessment rates 17 items: 10 operating, 6 in place and 1 planned. Staff training is in place, not operating, because it stands at 92% against a 95% target. The planned item is the cryptography policy for Article 21(2)(h), so the result is Not ready, with one blocking gap due by 30 October. The next board meeting is 29 October, so the chair hears of the gap by 14 October. The board sees it in one sentence, with the decision it needs to take.
Start with these three
- NIS2 Scope & Entity Classification Assessment: the tests in the order NIS2 applies them, with your reasoning recorded.
- NIS2 Readiness Self-Assessment: each requirement rated from Not started to Operating, and the gaps that block readiness.
- Management Body Cybersecurity Accountability Record: the approval and each oversight review, as a supervisor would ask to see them.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Run the scope assessment and take it to counsel. | The scope decision is written down, with its reasons. |
| Week 2 | Confirm registration with your competent authority. | The data sheet matches what the authority holds. |
| Week 3 | Run the readiness self-assessment and log every gap. | Each gap has an owner, a priority and a due date. |
| Week 4 | Brief the management body and book its training. | The board has approved the measures and minuted the blocking gaps. |
What to report to the board
Report these every quarter:
- the scope decision, and whether anything has changed it;
- the readiness result in words: Not ready, No blocking gap found (which is not a finding that the measures are implemented), or All items operating;
- blocking gaps, with owners and due dates;
- management body training completed and booked.
A blocking gap goes to the board at its next meeting, or to its chair within ten working days if that meeting is later.
Everything in the pack
- Excel
NIS2 Scope & Entity Classification Assessment
In scope or not, essential or important, and why
- Excel
NIS2 Article 21 Measure-to-Control Mapping Library
Each measure in NIS2’s words, what to be able to show, and the documents that support it
- Excel
NIS2 Readiness Self-Assessment
Readiness by requirement, with blocking gaps
- Word
Management Body Cybersecurity Accountability Record
Approval and oversight of the measures
- Excel
Management Body Cybersecurity Training Plan
Who has been trained, and who is due
- Excel
NIS2 Documentation & Evidence Checklist
What a supervisor may ask for, and where it is
- Excel
NIS2 Gap & Remediation Tracker
Gaps into owned, dated actions
- Excel
NIS2 Competent Authority Registration Data Sheet
The information registration asks for
- PowerPoint
NIS2 Management Briefing Deck
Obligations, position and decisions, for the board
No document matches those words.
The measures library gives NIS2’s own words and the CISO Times documents that help with each measure. It does not map NIS2 to ISO/IEC 27001 or to the NIST CSF: mappings are published in the CISO Times Library, each with how closely the two match and where they differ; confirm one against both texts before relying on it.
Adapting it
- Small organisation: most small firms are out of scope unless a size-independent case applies. Record the reasoning anyway: it is the first thing a supervisor or customer asks for.
- Financial entity: DORA applies instead of NIS2’s risk-management and reporting duties. Record that in the scope assessment and use DORA’s requirements.
- IT run by an outside provider: several measures depend on the provider. Name them in the measures library and check the contract gives you the records you need.
Where it maps
- NIS2: Articles 2, 3, 20, 21, 23 and 27.
- ISO/IEC 27001:2022: Clause 4.2 and Annex A 5.31.
- NIST CSF 2.0: GV.OC-03.