Compliance walkthrough
How to comply with the NIS2 Directive: video walkthrough
A walkthrough of building a NIS2 programme: entities classified, the Article 21 measures in operation, incident reporting on the Directive's clock and a management body that approves and oversees.
Key takeaways
- NIS2 is an EU directive applied through each Member State's national law.
- Scope turns on sector, size and activity; classify every entity first.
- Article 21 names ten risk-management measures as a minimum.
- Significant incidents are reported on a clock that starts at 24 hours.
- The management body approves, oversees and is trained; no NIS2 certificate exists.
What NIS2 asks of an organisation
The NIS2 Directive, formally Directive (EU) 2022/2555, is the European Union's law on measures for a high common level of cybersecurity. It replaced the first NIS Directive and extended the rules to 18 sectors and to most medium-sized and large organisations in them. Four duties sit at its core: take appropriate and proportionate risk-management measures, including ten that Article 21 names; report significant incidents on a clock that starts at 24 hours; have the management body approve and oversee the measures, with its members trained; and cooperate with a supervisor that can inspect, instruct and fine.
As a directive, NIS2 works through national law. Each Member State's act names the competent authority and the CSIRT, runs registration and reporting and sets the penalties, so a group in several countries meets one set of measures through several regimes. No NIS2 certificate exists: compliance is demonstrated to your supervisor and, increasingly, to customers. This short film walks through how the programme is built.
Building the NIS2 programme
Begin by defining what the programme must cover: the legal entities, Member States and services; each entity's sector, size and likely category; the competent authority and CSIRT; any sector-specific law such as DORA; and the customers already asking for NIS2 measures. A scoping memo per entity and country, with its category, authority and registration, is the first piece of evidence.
A gap analysis then tests policies, controls, incident procedures and supplier arrangements against the ten Article 21 measures, the reporting and governance duties and, for cloud, managed service and other digital providers, the Implementing Regulation. The measures are then built and put into operation on an all-hazards basis, incident reporting is rehearsed against the Directive's deadlines, and the management body records its approval and completes its training. Internal audit and review show what remains before supervision.
Whether the measures are sufficient is for your national competent authority to judge and for customers to weigh. Sterling's expert and experienced consultants design and implement the measures with your teams under Sterling OS™, and an ISO/IEC 27001 system, where one exists, provides supporting evidence rather than proof of compliance. Legal interpretation stays with your advisers.
NIS2 Directive at a glance
- Purpose
- A high common level of cybersecurity: risks to network and information systems managed, significant incidents reported, management bodies accountable
- Relevant to
- Medium-sized and large entities in the 18 sectors of Annexes I and II operating in the EU, some of any size, and their suppliers through contracts
- Edition
- Directive (EU) 2022/2555, applied through national laws from 18 October 2024; Implementing Regulation (EU) 2024/2690 details the measures for cloud, managed service and other digital providers
- Certification
- None exists for NIS2 as such. Your national competent authority supervises; an ISO/IEC 27001 certificate is supporting evidence, not proof of compliance
- Sterling's role
- Scoping and implementation with your team, Effivity, training, internal audit and supervision readiness, then Sustain™
- Cost and timing
- Total investment for a NIS2 compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 9 months
NIS2 Directive: questions people ask
Is there a NIS2 certification?
No. The Directive creates obligations that your national competent authority supervises, not a certificate. Article 24 lets Member States require certain ICT products, services or processes certified under European cybersecurity certification schemes, a different matter. The Commission's January 2026 package proposes a future EU certification of an entity's cybersecurity posture with a presumption of conformity; until one exists, a "NIS2 certificate" is a vendor's badge.
Does ISO/IEC 27001 certification make us NIS2 compliant?
Not by itself, though it is the strongest starting point. Articles 21 and 25 point to European and international standards, and ENISA's June 2025 guidance maps the Implementing Regulation to ISO/IEC 27001:2022 while stating that following it does not in itself mean compliance. Typical gaps: a narrower certificate scope, the reporting clock, management-body duties, registration and supplier requirements. Belgium's authority lists ISO/IEC 27001 as one recognised pathway for essential entities.
Are we an essential or an important entity?
It depends on sector, size and national decisions. Annex I entities above the medium-sized ceilings are essential, as are qualified trust service providers, top-level domain registries and DNS service providers of any size, public electronic communications providers of at least medium size, central government bodies and critical entities under the CER Directive; other entities in scope are important unless designated essential. Measures are the same; supervision and fine ceilings differ.
We are outside the EU. Can NIS2 still affect us?
Yes. In-scope cloud, data centre, content delivery, DNS and domain, managed and managed security service providers and certain online platforms that serve the Union must designate a representative in a Member State where they offer services. More often NIS2 arrives by contract, because entities in scope must manage their direct suppliers' security. NIS2 does not apply in the United Kingdom, which has its own NIS Regulations 2018; a bill before Parliament in September 2026 would amend them.
What has to be reported, and how fast?
Significant incidents, which cause or could cause severe operational disruption or financial loss to you, or considerable material or non-material damage to others. Your CSIRT or competent authority gets an early warning within 24 hours of your becoming aware, a notification with an initial assessment within 72 hours, an intermediate report if asked and a final report within one month of the notification. The Implementing Regulation adds thresholds for digital providers, such as direct financial loss above €500,000 or 5% of annual turnover, whichever is lower.
Keep exploring
Related to this video
The complete guide
Everything on NIS2 Directive
Start with the NIS2 Directive page, or go straight to the guide you need.
On the NIS2 Directive page
Often combined with NIS2 Directive
More videos: Information security, cyber and cloud
- How to implement NIST CSF 2.0Implementation walkthrough · 3 min 15 s
- NIST CSF 2.0 explainedTwo-minute brief · 2 min
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
- NIST SP 800-171 requirements explainedTwo-minute brief · 2 min
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your NIS2 compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice