NIS2 Field Course
A visual introduction for security professionals who already know the controls but have not worked under the law. Each module maps NIS2 back to concepts you know from the CISSP CBK.
● Explore the NIS2 timelineWhat NIS2 is, and what it is not
NIS2 is an EU directive. It tells the 27 member states what their national cybersecurity laws must contain. Organisations comply with those national laws, not with the directive itself.
NIS2 replaced the 2016 NIS Directive (2016/1148), which covered a narrow set of "operators of essential services" and left each country to decide who was in scope. The result was uneven: similar hospitals or energy firms were regulated in one country and not in the next. NIS2 fixes that with a size-based rule, a much longer sector list, harder reporting clocks, personal accountability for management, and fines comparable to GDPR.
The directive has three layers: obligations on entities (risk management, reporting, governance, registration), capabilities each member state must build (strategy, authorities, CSIRTs), and cooperation across the EU.
Think of it in Domain 1 terms: the directive is the regulatory requirement; the national law is the applicable law you document in your compliance register; Art. 21 is the baseline your control framework must meet. "Due care" stops being a concept and becomes a legal duty of the management body.
- Jul 2016NIS1 adoptedDirective 2016/1148. Member states pick their own "operators of essential services".
- 27 Dec 2022NIS2 publishedIn the Official Journal; enters into force 16 Jan 2023. CER Directive (physical resilience) published the same day.
- 1 Sep 2024Latvia's National Cybersecurity Law in forceOne of the few early transpositions.
- 17 Oct 2024Transposition deadlineMost member states miss it. Same day: Implementing Regulation 2024/2690 sets detailed measures for digital-infrastructure and digital-service entities.
- 17 Apr 2025National entity lists dueMember states must have identified their essential and important entities (Art. 3(3)).
- Nov 2025Digital Omnibus proposalSingle entry point for incident reports; alignment with DORA and CER.
- 6 Dec 2025Germany's NIS2 law in forceNo transition period; about 29,500 entities.
- 20 Jan 2026Targeted NIS2 amendment proposedAlongside a revised Cybersecurity Act (CSA2). Covered in Module 10.
- 11 Sep 2026Cyber Resilience Act reporting startsReporting of exploited vulnerabilities adds a parallel clock to NIS2.
- You are hereToday on the timeline. Check the sources for the latest legal status.
- 17 Oct 2027Commission review dueFirst formal review of the directive (Art. 40), then every 36 months.
Who is in scope
Two questions decide it: does the organisation provide a service listed in Annex I or II, and is it at least a medium-sized enterprise? A short list of service types are in scope regardless of size.
Size is measured at the enterprise level, including partner and linked enterprises under the SME Recommendation, so a 40-person subsidiary of a large group is usually not "small". This is the most common scoping mistake, and the reason group structure belongs in your scoping memo.
Jurisdiction. As a rule you answer to every member state where you are established (Art. 26). Cloud, data-centre, CDN, DNS, TLD, managed and managed-security service providers, and online platforms are the exception: they answer to the state of their main establishment only, and must register in the EU-wide ENISA registry (Art. 27). Public electronic-communications providers answer where they provide the service.
Management is on the hook
Article 20 moves cybersecurity accountability out of the IT department and onto the management body, by name.
Personal liability
Member states must ensure natural persons with management responsibility can be held liable for breaching their duties Art. 32(6).
Temporary ban
For essential entities that ignore orders, authorities can temporarily bar the CEO or legal representative from managerial functions Art. 32(5)(b).
No delegation of accountability
National laws such as Germany's frame this as a personal duty of the management. A CISO can execute; the board still owns it.
This is senior-management responsibility from Domain 1 written into statute. Practically, expect to produce: a board resolution approving the security programme, minutes showing periodic oversight, and training attendance records for every board member. Supervisors ask for exactly these.
The ten minimum measures
Article 21 requires "appropriate and proportionate" technical, operational and organisational measures based on an all-hazards approach, then names ten areas that must be covered at minimum.
Proportionality depends on the entity's exposure, size, the likelihood and severity of incidents, and their societal and economic impact. Measures must reflect the state of the art and take account of European and international standards Art. 21(1). "All-hazards" means physical and environmental events count too, not only cyberattacks.
Supply chain carries extra weight. Art. 21(3) requires you to consider each direct supplier's specific vulnerabilities, the overall quality of their products and their secure-development practices, and the results of EU coordinated risk assessments (Art. 22, used so far for 5G). This is how NIS2 reaches suppliers who are not themselves in scope: through your contracts and questionnaires.
Detailed rules for digital entities. For DNS, TLD, cloud, data-centre, CDN, managed and managed-security service providers, trust service providers and online platforms, Implementing Regulation 2024/2690 spells the measures out in a technical annex and defines when an incident is significant. ENISA's 2025 technical implementation guidance maps those requirements to common standards and is useful for everyone else as a reference.
If you run an ISO/IEC 27001 ISMS, you already cover most of Art. 21. The gaps are usually in the specifics: incident classification against NIS2 thresholds, supplier security clauses, crisis communications, and board training. Build one control matrix with a column per regime (ISO, NIS2, DORA, local law) instead of separate programmes.
Three clocks for significant incidents
Article 23 requires staged reporting to the CSIRT or competent authority for any significant incident: a fast early warning, a fuller notification, then a final report.
An incident is significant if it has caused, or can cause, severe operational disruption or financial loss to the entity, or considerable material or non-material damage to others Art. 23(3). The clock starts when you become aware of a significant incident, which in practice means after initial triage confirms it meets the threshold.
DORA's initial notice is due within 4 hours of classifying an incident as major and no later than 24 hours after detection; its intermediate report follows within 72 hours of the initial one. The CRA's 14-day final report runs from when a fix is available. The Digital Omnibus proposes a single entry point so one submission can satisfy several regimes, but that is not yet law.
Add a "regulatory classification" step to your IR runbook right after triage, with a named decision-maker and a timestamp: that timestamp is your T0. One incident can trigger NIS2, GDPR and contractual notices at once. Pre-draft the 24-hour early-warning template; nobody writes well at hour 20.
Supervision, enforcement and fines
The essential/important split matters most here. Essential entities can be audited at any time; important entities are supervised after the fact, when there is evidence of a problem.
Ex-ante and ex-post
- On-site inspections and off-site supervision
- Regular and targeted audits by an independent body
- Ad hoc audits after a significant incident
- Security scans
- Requests for evidence of policy implementation
- Can suspend certifications and bar managers temporarily
Ex-post only
- Triggered by evidence, indication or information of non-compliance
- Same inspection and audit tools, used reactively
- Binding instructions and orders
- No managerial ban power under the directive
These are the minimum maximums the directive requires member states to allow: at least €10M or 2% of worldwide turnover for essential entities and €7M or 1.4% for important entities, whichever is higher. Member states may go further and many add separate penalties, for example for failing to register. If a data-protection authority has already fined the same conduct under GDPR, the NIS2 authority cannot fine it again Art. 35(2).
Registration, disclosure and information sharing
Unlike NIS1, nobody tells you that you are in scope. You self-assess, then register with the national authority.
Self-registration
Entities submit name, address, contact details, sector and member states served; member states build their lists from this Art. 3(4). Digital-infrastructure providers also submit public IP ranges to the ENISA registry Art. 27.
Vulnerability disclosure
Each member state designates a CSIRT as coordinator for coordinated vulnerability disclosure, and ENISA runs the European Vulnerability Database Art. 12.
Information sharing
Entities may join sharing arrangements for threat intelligence, IoCs and TTPs Art. 29, and anyone can report incidents, threats or near misses voluntarily Art. 30.
Registration data must stay current: changes must be notified within two weeks under Art. 3(4), and within three months for the digital-provider registry under Art. 27. Put "update NIS2 registration" into your change-management checklist for new countries, new legal entities and new services.
Where NIS2 meets DORA, GDPR, CER and the CRA
NIS2 is the horizontal baseline. Where a sector-specific EU law sets equivalent requirements, that law applies instead (Art. 4).
For banks and insurers the practical answer is usually "DORA, not NIS2" for risk management and reporting, while MaRisk/BAIT-style national supervisory expectations continue alongside. For an MSP serving those banks, both apply at once: NIS2 for its own operations, and DORA third-party requirements pushed down by contract.
National implementation: Latvia and Germany side by side
The directive sets a floor. National laws rename things, add roles, set registration deadlines and sometimes widen scope. Always read the local law.
Latvia
in force since 2024- Law
- National Cybersecurity Law (Nacionālās kiberdrošības likums)
- In force
- 1 Sep 2024, replacing the IT Security Law
- Authorities
- National Cybersecurity Centre (NKC) supervises; CERT.LV is the CSIRT
- Terms
- Essential and important service providers
- Key dates
- Registration by 1 Apr 2025; cybersecurity manager notified by 1 Oct 2025
- Extras
- Mandatory cybersecurity manager role; detailed minimum requirements set by Cabinet regulation
Germany
in force since Dec 2025- Law
- NIS2UmsuCG, a full rewrite of the BSI Act (BSIG)
- In force
- 6 Dec 2025, no transition period
- Authority
- BSI (Federal Office for Information Security)
- Terms
- "Besonders wichtige" and "wichtige Einrichtungen"; about 29,500 entities
- Key dates
- Statutory registration deadline 6 Mar 2026; BSI grace period ran to 31 Jul 2026. Registration needs an ELSTER organisation certificate
- Extras
- Board oversight and training duty (§38 BSIG); up to €500,000 for registration or notification failures
| Country | Status | Notable feature |
|---|---|---|
| Belgium | In force Oct 2024 | Compliance through CyberFundamentals (CyFun) or ISO 27001; ISO route requires certification by April 2027 |
| Austria | NISG 2026, in force 1 Oct 2026 | Very recent; expect guidance to follow |
| Hungary | In force | Requires local registration even for providers whose main establishment is elsewhere |
| France | Still pending (mid-2026) | Combined NIS2/CER/DORA "Loi Résilience" stalled in the National Assembly |
| Spain | Still pending (mid-2026) | Second reasoned opinion from the Commission in May 2026 |
For a group operating in several countries, start with a jurisdiction matrix: legal entity × country × service × local classification × registration status. Map controls once to Art. 21, then add a thin national overlay for local deadlines, roles and reporting portals.
The 2026 amendment proposal
On 20 January 2026 the Commission proposed targeted changes to NIS2 together with a revised Cybersecurity Act. It is a proposal: nothing below applies yet.
Proposed scope changes
- ~New small mid-cap tier: under 750 staff and turnover ≤€150M or balance ≤€129M. These can be important at most, never essential
- +European Digital Identity Wallet and Business Wallet providers become essential regardless of size
- +Operators of submarine data-transmission infrastructure added as essential
- −Micro and small DNS providers leave scope
- −Clarified definitions for chemicals, healthcare, electricity producers and hydrogen, with a size threshold for small electricity producers
Proposed obligation changes
- +Harmonised ransomware data: on request, disclose whether a ransom was demanded and paid, how much and to whom
- ~EU certification of an entity's cyber posture (under CSA2) can demonstrate Art. 21 compliance
- ~Once an EU implementing act sets technical measures, member states cannot add their own on top
- ~Push to reduce duplicate supplier questionnaires through an EU ICT supply-chain framework
- +National strategies must include post-quantum cryptography migration (target 2030 for critical uses)
Do not pause a programme waiting for the amendment. Core duties (Art. 20, 21, 23) are untouched. The things worth starting now: a crypto inventory for PQC, a ransomware decision-and-disclosure procedure, and a supplier assurance approach that could later lean on certification.
Your first 90 days on a NIS2 programme
A practical sequence for a security lead walking into an organisation that has just discovered it is in scope.
Scope and register
- Scoping memo: services vs Annex I/II, enterprise size including group links, every country of establishment
- Classification per country (local terms and thresholds)
- Register on each national portal; record evidence of submission
Governance kickoff
- Board briefing on Art. 20 duties and personal liability
- Book management-body training; keep attendance records
- Board resolution approving the programme and risk appetite; named accountable executive
Gap assessment against Art. 21
- Control matrix: Art. 21(2)(a)–(j) × ISO 27001 Annex A × local law × current evidence
- Use Implementing Regulation 2024/2690 as the depth benchmark even if it does not apply to you
- Risk-ranked remediation plan the board can approve
Incident reporting readiness
- Significance criteria and a classification step with named decision-maker
- Templates for 24h, 72h and 1-month reports; portal accounts tested
- Tabletop exercise that runs the full clock, including GDPR and customer notices
Supply chain programme
- Supplier inventory tiered by criticality
- Contract clauses: security requirements, incident notice to you, audit rights, exit
- Assessment cadence proportionate to tier
Evidence pack and supervisor readiness
- One folder a supervisor could walk through: policies, approvals, risk register, test results, training records, incident log
- Effectiveness metrics reported to management (Art. 21(2)(f))
- Mock audit before any real one
Check yourself
Scenario questions in the style of an exam item. Answers are explained immediately.
Working through NIS2 in your organisation?
We help teams scope NIS2, run the Article 21 gap assessment, prepare incident reporting and build the evidence a supervisor will ask for, alongside DORA and ISO 27001 where they overlap.
Glossary
- Essential entity
- Higher tier; proactive supervision, higher fines, possible management ban.
- Important entity
- Lower tier; same security duties, supervision only after evidence of a problem.
- Competent authority
- The national body that supervises and enforces.
- CSIRT
- Computer Security Incident Response Team; usually receives incident reports and coordinates vulnerability disclosure.
- Single point of contact
- Liaison for cross-border cooperation between member states.
- Significant incident
- One that causes or can cause severe disruption or financial loss, or considerable damage to others.
- Near miss
- An event that could have compromised security but was prevented; voluntary reporting only.
- Main establishment
- Where cybersecurity decisions are mainly taken; decides jurisdiction for cloud, DNS, MSPs and platforms.
- Management body
- The board or equivalent; carries the Art. 20 duties.
- All-hazards
- Measures must cover physical and environmental threats as well as cyber.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- Covington: Commission proposes targeted NIS2 amendments (Jan 2026)
- DLA Piper: NIS2 update, scope and new entities (Feb 2026)
- Freshfields: EU cybersecurity package and small mid-cap thresholds
- Morrison Foerster: Easing the NIS2 burden (Mar 2026)
- Deloitte: Navigating NIS2 compliance (Mar 2026)
- COBALT: Summary of Latvia's National Cyber Security Law
- Latvia: National Cybersecurity Law (English), likumi.lv
- Scheja & Partners: German NIS2 Implementation Act
- Schutzwerk: BSI registration deadline 31 July 2026
- NIS2 transposition tracker by country