NIS2 Directive · Cybersecurity risk management and incident reporting in the EU
NIS2 compliance consulting for cybersecurity your management body can approve, oversee and prove.
Meet the NIS2 Directive as your national law applies it: every entity classified, the ten Article 21 measures in operation, early warnings inside 24 hours and notifications inside 72, and a management body that approves, oversees and is trained. Sterling's expert and experienced consultants build the programme with your teams, prepare the evidence your authority and customers will ask for, and stay with you once it runs, in 60+ countries. We ensure a successful NIS2 compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cybersecurity governance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the measures, the governance and the evidence; compliance is supervised by your national competent authority
8,100+ client engagements in 60+ countries.
NIS2 client experience
What it is
What is NIS2 and what does it require?
The NIS2 Directive, formally Directive (EU) 2022/2555, is the European Union's law on measures for a high common level of cybersecurity. It replaced the first NIS Directive of 2016 and extended the rules to 18 sectors and to most medium-sized and large organisations in them. Four duties sit at its core: take appropriate and proportionate risk-management measures, including ten that Article 21 names; report significant incidents on a clock that starts at 24 hours; have the management body approve and oversee the measures, its members trained; and cooperate with a supervisor that can inspect, instruct and fine.
As a directive, NIS2 works through national law: each Member State's act names the competent authority and the CSIRT, runs registration and reporting and sets the penalties, so a group in several countries meets one set of measures through several regimes. No NIS2 certificate exists; compliance is demonstrated to your supervisor and, increasingly, to customers who must manage their suppliers.
Current text. Directive (EU) 2022/2555 of 14 December 2022 entered into force on 16 January 2023; Member States had until 17 October 2024 to transpose it, and the first NIS Directive was repealed from 18 October 2024. The Commission opened infringement procedures against 23 Member States in November 2024, sent reasoned opinions to 19 in May 2025 and, on 8 July 2026, referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition, noting that most others had complied; the Dutch law took effect on 15 August 2026. Targeted amendments proposed by the Commission in January 2026 were still before the European Parliament and the Council in September 2026, so the current text applies. NIS2 transposition by Member State: where each country stands
Who it is for
Who needs to comply with NIS2?
Scope turns on sector, size and activity in the Union. Article 2 covers public or private entities of a type in Annex I (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration, space) or Annex II (postal and courier, waste management, chemicals, food, manufacturing of medical devices, electronics, electrical equipment, machinery and vehicles, digital providers, research) that are at least medium-sized under the EU SME definition (broadly, 50 or more staff, or turnover and balance sheet both above €10 million). Some, such as DNS and trust service providers, are covered whatever their size. Large Annex I entities are generally essential, most others important. Organisations come to Sterling from four starting points:
- Your sector and size put you in scope. A medium-sized food processor, hospital group, logistics operator or water utility is covered once its national law applies, and may have to register. The first deliverable is a documented answer per legal entity and country.
- A customer in scope is asking about your security. Article 21 makes in-scope entities manage the security of their direct suppliers, so software houses, BPOs, component makers and logistics firms, in Europe and beyond, receive NIS2 questionnaires and clauses. A documented set of measures answers them once.
- You run cloud, data centre, managed or managed security services. In scope, such providers answer to the Member State of their main establishment, must meet Implementing Regulation (EU) 2024/2690 and, if based outside the EU but serving it, designate a representative there.
- You were under NIS1, or hold ISO/IEC 27001, and assume you are covered. Former operators of essential services now face management-body accountability and the 24-hour early warning; a certified ISMS usually covers much of Article 21 but not the reporting clock, the classification or the board's duties.
Business benefits
How NIS2 compliance strengthens resilience and board oversight
The case is clearest where an incident would hurt most: ransomware that stops operations, a compromised managed service provider, a supplier breach, the authority's call the morning after. We build the programme around those scenarios and give each an owner, a measure and a record.
- Incidents contained and reported on timeA significance rule, a response team and ready templates for each report, rehearsed before a real incident tests them.
- A board that can answer for cybersecurityMeasures approved by the management body, regular reporting and training records, so oversight is documented and liability managed rather than feared.
- Supply chain risk under contractSuppliers tiered by criticality, clauses and assessments in place, and managed service providers held to the standard you are held to.
- Operations that recoverBackups, disaster recovery and crisis management exercised against realistic scenarios, with restore times measured, not assumed.
- Customers who stop re-askingOne evidence set for the NIS2 questionnaires of customers who are in scope and must manage their suppliers.
- One programme for several laws and standardsThe same measures serve national NIS2 laws, ISO/IEC 27001, ISO 22301 and, for financial entities, DORA, with differences mapped, not duplicated.
Track a handful of indicators: hours from detection to a significance decision, critical suppliers assessed, MFA coverage of privileged and remote access, restore tests passed, management-body training completed. A thicker policy binder proves nothing.
Requirements
What are the main NIS2 requirements?
NIS2 has 46 articles in nine chapters. What an organisation must build sits mainly in Chapter IV (governance, risk-management measures, reporting), framed by the scope rules of Articles 2 and 3 and the supervision rules of Chapter VII. The tables map them to practice; national law may add detail, and legal interpretation stays with your advisers.
| Article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 2, 3 Scope, essential and important entities | Establish whether each entity is in scope by sector (Annexes I and II), size and the size-independent cases, and its category; give the authority your details and report changes within two weeks | A scoping memo per entity and country, with category, authority and registration |
| Art. 20 Governance | The management body approves the risk-management measures, oversees their implementation and can be held liable for infringements; its members must follow training | A recorded approval, regular reporting to the management body, a training record per member |
| Art. 21 Cybersecurity risk-management measures | Appropriate and proportionate technical, operational and organisational measures on an all-hazards basis, reflecting the state of the art and relevant standards, including at least the ten below; supplier vulnerabilities weighed; shortfalls corrected without undue delay | A risk analysis for systems and sites, an implementation record per measure, a corrective-action log |
| Art. 23 Reporting obligations | Report significant incidents to your CSIRT or competent authority: early warning within 24 hours of becoming aware, notification within 72 hours, intermediate report on request, final report within one month of the notification | A significance rule, an on-call decision-maker, authority contacts and report templates, rehearsed |
| Art. 24 to 27 Certification, standards, jurisdiction and registry | Use certified ICT products or services where your Member State requires it; standards are encouraged; cloud, data centre, DNS and managed service providers, among others, fall under their main establishment, register and, if established outside the Union, designate a representative in it | Procurement checks, a jurisdiction map and a representative where required |
| Art. 31 to 34 Supervision and enforcement | Essential entities: proactive supervision with inspections, audits and security scans; important entities: supervision after the fact; binding instructions, and fines with maxima of at least €10 million or 2% (essential) and €7 million or 1.4% (important) of worldwide turnover, whichever is higher | An evidence file an inspector can work from and a named owner for supervisory requests |
| Implementing Regulation (EU) 2024/2690 Digital providers | For DNS, TLD, cloud, data centre, content delivery, managed and managed security service providers, online platforms and trust service providers: requirements in 13 areas and criteria for significant incidents | The Annex mapped to your controls, using ENISA's June 2025 guidance and its ISO/IEC 27001:2022 mapping |
Article 21(2): the ten minimum measures
| Measure | What the Directive names | Typical evidence |
|---|---|---|
| (a) Risk analysis and security policies | Policies on risk analysis and information system security | Approved policies and a current risk register |
| (b) Incident handling | Incident handling | Response procedures and an incident log with lessons |
| (c) Continuity and crisis management | Business continuity, such as backup management and disaster recovery, and crisis management | Recovery plans, restore tests, crisis exercises |
| (d) Supply chain security | Supply chain security, including security aspects of relationships with direct suppliers or service providers | A supplier register, assessments and clauses |
| (e) Acquisition, development and maintenance | Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure | Change records, patch status, a disclosure route |
| (f) Assessing effectiveness | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Metrics, internal audits and technical tests |
| (g) Cyber hygiene and training | Basic cyber hygiene practices and cybersecurity training | Secure baselines and training records |
| (h) Cryptography | Policies and procedures on cryptography and, where appropriate, encryption | A cryptography policy and key management |
| (i) People, access and assets | Human resources security, access control policies and asset management | Leaver records, access reviews, an asset inventory |
| (j) Authentication and secure communications | Multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems, where appropriate | MFA coverage and an emergency channel that works when e-mail does not |
What does useful NIS2 evidence look like?
A classification memo per entity with its registration; the measures as the management body approved them, with minutes and training records; a risk analysis linked to the ten measures; an incident log showing when you became aware, how significance was decided and when each report went out; restore tests and crisis exercises; supplier assessments and clauses; MFA coverage, access reviews and the asset inventory; the internal audit. We build these from your real systems and keep them in Effivity from the first workshop, so an inspector sees measures that operate.
NIS2 requirements explained, article by articleCompliance process
How do you become NIS2 compliant?
The programme is scoped, built and operated before anyone supervises it. Sterling designs and builds the measures with your team; whether they are sufficient is for your national competent authority to judge and for customers to weigh, and neither relies on a consultant's report.
- 01Define what the programme must cover.Legal entities, Member States and services; each entity's sector, size and likely category; the competent authority and CSIRT; any sector-specific law such as DORA; customers already asking for NIS2 measures.
- 02Gap analysis: review the current position against Article 21 and your national law.The gap analysis tests policies, controls, incident procedures and supplier arrangements against the ten measures, the reporting and governance duties and, for digital providers, the Implementing Regulation; it keeps what works and sets actions, owners and dates.
- 03Implement, and record the evidence as you go.Management-body approval and training, policies, the reporting procedure, continuity and recovery, supplier clauses, MFA, encryption, access and asset controls, and registration where due.
- 04Audit, review and address the findings.An internal audit, an exercise that runs the 24-hour and 72-hour clock and a management review with the management body; we raise findings before anyone external does and close them with evidence.
- 05Complete the regulator or customer review.Answer registration, information requests, inspections or targeted audits, and customers' supplier assessments, from an evidence package that already exists; add ISO/IEC 27001 certification if an audited certificate helps.
- 06Keep the programme running after go-live.Measures and risks reviewed at planned intervals and after major change, incidents learned from, suppliers reassessed, training repeated and national changes absorbed.
Test an offer by what it will deliver: who classifies your entities and on what evidence, how the measures are checked against your systems, who rehearses the reporting clock with you and where the evidence will live. The Directive provides no certificate; your authority and customers look at the measures, not a badge. How to choose a credible NIS2 provider · The certification buyer's checklist
Cost
How much does NIS2 compliance cost?
The cost of a NIS2 programme follows the entities and countries in scope, whether an ISMS exists and how much technology must change: a managed service provider with an ISO/IEC 27001 certificate starts far closer to compliance than a manufacturer building its first security programme across three Member States. Constant in a Sterling proposal: every component visible, one all-inclusive proposal.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Entities, countries and services in scope, category, current maturity, deliverables, and how much of the work your team carries (Design™ or Drive™) |
| Supervision and independent review | Targeted security audits by an independent body are paid by the audited entity unless the authority decides otherwise; any ISO/IEC 27001 certification or penetration testing you choose is shown separately |
| Internal resources and remediation | Time from IT, security, legal and procurement, management-body training, and missing technology such as MFA, logging, backup or encryption |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Annual reviews, incident exercises, supplier reassessments, refresher learning and national updates under Sustain™ |
What moves the price
- Legal entities and Member States in scope, and how their laws differ
- Essential or important status, and whether the Implementing Regulation applies
- Whether an ISO/IEC 27001 ISMS or a NIS1 programme exists
- Technical gaps in MFA, logging, recovery, encryption or supplier control
- The date set by your authority, a registration deadline or a customer
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Audit, certification and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does NIS2 compliance take?
Plan on four to nine months to a programme that operates and has evidence behind it: nearer four with a working ISO/IEC 27001 ISMS and a tested incident process, nearer nine where multi-factor authentication, logging, recovery or supplier controls must be built first, or several national laws apply. Because a registration or customer date may come sooner, scope, classification, reporting contacts and the management body's approval go first, each a milestone in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Entity and group data for the classification, and access to IT, security and supplier information |
| Build and implementation | Management-body decisions, technical changes such as MFA, encryption and backup, supplier contracts and training |
| Evidence and review | Measures operating long enough to produce records, an incident exercise, internal audit and management review |
| Regulator or customer review | Your authority's registration and supervisory timetable, any inspection or targeted audit, and customers' assessment cycles |
Bring any registration notice, authority letter or customer deadline to the first call. We will say what can be in place by then and which decisions must be taken in the first fortnight. Full NIS2 compliance promised within a week, before anyone has looked at your systems, is paper, not a plan.
Challenges
Common NIS2 implementation challenges
NIS2 programmes stall on five predictable problems. Each has a practical answer.
Nobody is sure whether the company is essential, important or out of scope.
We classify entity by entity with your legal advisers: sector, headcount and financial figures under the SME definition, the size-independent cases and any national designation, in a memo that survives an acquisition or an authority's question.
The board must approve and oversee measures it has never been briefed on.
A decision paper per measure, a briefing and training for the management body and a quarterly security report give members what Article 20 expects: knowledge to judge the risks, and a record of approval and oversight.
A 24-hour early warning is impossible with today's incident process.
A written significance rule, a decision-maker on call, pre-filled templates and a tested contact route turn the clock into a procedure. An exercise shows where the hours are lost before a real incident does.
Suppliers and managed service providers sit outside your controls.
A supplier register tiered by criticality, security clauses at each new contract or renewal, and assessments that start with providers holding privileged access: the supply chain duty met in order of risk.
Several countries, several transposing laws and one security team.
One common core of measures and evidence, with a national layer for each country's registration, reporting portal, authority and penalties; financial entities under DORA are mapped once, not twice.
Your engagement
What your NIS2 engagement includes
Your agreed scope covers what an operating NIS2 programme and a prepared team need, from one team, under one all-inclusive proposal.
Scope, classification and implementation plan
Entities, countries and categories confirmed with your legal advisers, the gap measured, and actions, owners and dates agreed before work starts.
Measures, policies and procedures
The ten measures in proportion to your risks, the reporting procedure, supplier requirements and, where it applies, the Implementing Regulation's Annex, on Sterling's template sets adapted to your systems.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before an authority or a customer looks.
Supervision readiness and support
Preparation for registration, information requests, inspections, targeted audits and supplier assessments, and support through ISO/IEC 27001 certification if you pursue it.
Compliance is supervised by your national competent authority. Sterling's part is consulting, not legal advice.
How we deliver
How Sterling supports your NIS2 implementation
Sterling OS™, our delivery operating system, runs every NIS2 engagement in five phases, each with named deliverables, decision owners and evidence. Your internal capacity decides how much of the work Sterling carries; the method, the software and the accountability do not vary.
- 01Design™Guided implementation: your security lead, IT and process owners build the measures with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the scoping, drafting, supplier and reporting work with your teams.
- 03Sustain™After go-live: annual reviews, incident exercises, supplier reassessments and refreshers, year after year.
- 04Automate™The programme in Effivity: entities, risks, measures, incidents, suppliers, audits and management review in one workspace.
- 05Revise™Changes in national laws and guidance, the 2026 amendment proposals if adopted, and changes in your entities, services or countries.
In week one we agree the engagement team, the weekly session, the deliverables and which decisions go to the management body; progress is tracked against them, so a slipping measure shows early.
How Sterling OS™ worksOften combined with
Standards organisations pair with NIS2 Directive
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · NIS2 compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the NIS2 Directive.
Every Sterling NIS2 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so entities, risks, the ten measures and their owners, incidents and reports, suppliers, continuity tests, training, audits and management review sit in one place, and an inspector sees a programme in daily use, not a folder compiled the week before. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entity register, classification and registration
Each legal entity with its sector, size, category, authority and registration status, reviewed when the group, its services or the national list changes, so the classification is a record, not a memory.
Management-body approval, oversight and training
The measures as approved, the decisions behind them, reporting to the management body and a training record for every member, ready when a supervisor asks who is accountable.
Risk analysis and the ten measures, one by one
An all-hazards risk register linked to the ten Article 21 measures and, for digital providers, the Implementing Regulation's Annex, each with owner, status, policy and evidence.
Suppliers, service providers and contract clauses
A supplier register tiered by criticality, with assessments, clauses and review dates, so supplier-specific vulnerabilities are tracked, not assumed.
Backups, recovery and crisis exercises
Continuity and recovery plans, restore tests and crisis exercises with their lessons, each linked to the systems and services it protects.
The 24-hour, 72-hour and one-month clock
An incident workflow that decides significance, starts the clock at awareness and holds templates for every report due, with each submission kept as evidence.
Evidence ready for inspections and audits
Audit findings, effectiveness reviews, scan results and corrective actions in one place, so an inspection or information request is answered from the system.
Training, access, assets and management review
Cyber hygiene training linked to Sterling Academy, access reviews, the asset inventory, cryptography decisions and management review; forms and reports adapted to your work, without code.
What this means at the audit
An inspector, or the independent body carrying out a targeted security audit, asks for the approved measures, the risk analysis, the incident log with its reporting times, supplier assessments, restore tests and the management body's training records. Effivity shows each on one screen, with dates, owners and evidence. Sustain™ then runs in the same workspace, so the next supervisory request finds a programme that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your registers, policies and records migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, BCMS, QMS, PIMS and more when you integrate other standards
NIS2 client experience
Client letters on file, available on request.
Signed client letters for NIS2 are available on request. The client feedback wall lists every letter by standard.
Programmes with NIS2 in scope
Where NIS2 sits in an integrated programme.
- 01Integrated management systems
Managed service and cloud providers: security, continuity and NIS2 as one programme
How a programme of this kind runs: an ISO/IEC 27001 ISMS supplies the risk method and most controls; ISO 22301 carries backup, recovery and crisis management; the NIS2 layer adds classification and registration, management-body approval and training, the reporting clock, supplier clauses and, where it applies, the Implementing Regulation's Annex, on one evidence base and one audit calendar.
Sterling Academy · NIS2 e-learning
Train every employee on NIS2, not just the security team.
Article 21 names cyber hygiene and cybersecurity training among the minimum measures, and Article 20 requires management-body members to follow training. Sterling Academy delivers e-learning for the whole workforce and the people who run the programme: video lessons with checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- NIS2 awareness for every employee, the training evidence Article 21(2)(g) asks for
- The same course for management-body members, whose training Article 20(2) requires
- Practitioner courses for the security lead, risk owners and incident handlers
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Progress by department and a training report
- New hires trained as they arrive, and a Sterling consultant reachable when a learner needs one
Where we work
Where Sterling delivers NIS2 Directive
Keep exploring
Explore more about NIS2 Directive
Watch a video on how to comply with NIS2 here.
Watch a video on NIS2 requirements here.
Why Sterling
Want successful NIS2 compliance? Come to Sterling.
Whether one entity in one Member State is in scope or a group spans several, Sterling builds one set of measures with a national layer for registration, reporting and supervision, so a new country or questionnaire does not start a new project.
Across 60+ countries since 2003
Programmes for technology and managed service providers, BPOs, manufacturers, logistics, healthcare and financial firms, with one engagement team accountable in every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with audit, certification and legal fees identified separately. No surprises, ever.
Measures your people can run
Proportionate measures, procedures that match how incidents and suppliers are really handled, and software that holds the evidence, so security becomes routine, not a pre-inspection scramble.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, and who build the NIS2 measures properly the first time, so a supervisor confirms what already works.
The Sterling Promise
What our NIS2 compliance success guarantee means
We stay with you until the agreed NIS2 programme outcome is achieved: entities classified, the measures operating, the management body briefed and trained, the reporting procedure rehearsed and the evidence in place, so your team can answer the authority, a customer or an incident on its own. Clear explanations, included software and workforce learning make it a lasting capability.
The engagement defines the entities, countries, scope, outcome and responsibilities. Your organisation supplies accurate information, gives access to the systems and suppliers in scope and operates the agreed measures. Compliance is supervised by your national competent authority; classification and legal interpretation remain with your legal advisers. Our commitment covers the agreed programme support; it is neither legal advice nor a warranty that no incident will occur.
After the programme is in place
What happens after NIS2 compliance?
Under NIS2, compliance is continuous. Measures must stay appropriate as threats, systems and suppliers change; significant incidents restart the reporting clock; the management body keeps overseeing and training; national lists of entities are reviewed at least every two years; and essential entities can be inspected without any incident.
Under Sterling OS™ Sustain™ we run that cycle with you: an annual review of measures and risks, an incident exercise, supplier reassessments, refreshers, a watch on national laws and the proposed amendments, and the internal audit, so the programme is current whenever it is tested.
FAQs
Frequently asked questions about NIS2
Is there a NIS2 certification?
No. The Directive creates obligations that your national competent authority supervises, not a certificate. Article 24 lets Member States require certain ICT products, services or processes certified under European cybersecurity certification schemes, a different matter. The Commission's January 2026 package proposes a future EU certification of an entity's cybersecurity posture with a presumption of conformity; until one exists, a "NIS2 certificate" is a vendor's badge.
Does ISO/IEC 27001 certification make us NIS2 compliant?
Not by itself, though it is the strongest starting point. Articles 21 and 25 point to European and international standards, and ENISA's June 2025 guidance maps the Implementing Regulation to ISO/IEC 27001:2022 while stating that following it does not in itself mean compliance. Typical gaps: a narrower certificate scope, the reporting clock, management-body duties, registration and supplier requirements. Belgium's authority lists ISO/IEC 27001 as one recognised pathway for essential entities.
Are we an essential or an important entity?
It depends on sector, size and national decisions. Annex I entities above the medium-sized ceilings are essential, as are qualified trust service providers, top-level domain registries and DNS service providers of any size, public electronic communications providers of at least medium size, central government bodies and critical entities under the CER Directive; other entities in scope are important unless designated essential. Measures are the same; supervision and fine ceilings differ.
We are outside the EU. Can NIS2 still affect us?
Yes. In-scope cloud, data centre, content delivery, DNS and domain, managed and managed security service providers and certain online platforms that serve the Union must designate a representative in a Member State where they offer services. More often NIS2 arrives by contract, because entities in scope must manage their direct suppliers' security. NIS2 does not apply in the United Kingdom, which has its own NIS Regulations 2018; a bill before Parliament in September 2026 would amend them.
What has to be reported, and how fast?
Significant incidents, which cause or could cause severe operational disruption or financial loss to you, or considerable material or non-material damage to others. Your CSIRT or competent authority gets an early warning within 24 hours of your becoming aware, a notification with an initial assessment within 72 hours, an intermediate report if asked and a final report within one month of the notification. The Implementing Regulation adds thresholds for digital providers, such as direct financial loss above €500,000 or 5% of annual turnover, whichever is lower.
What does NIS2 require of the management body?
Approval of the risk-management measures, oversight of their implementation, liability for infringements and training for its members (Article 20). For essential entities, where other enforcement has failed, authorities can seek a temporary ban on a chief executive or legal representative exercising managerial functions until deficiencies are remedied (Article 32).
What are the maximum fines under NIS2?
For infringements of Article 21 or 23, national law must allow fines with a maximum of at least €10 million or 2% of the undertaking's total worldwide annual turnover in the preceding financial year, whichever is higher, for essential entities, and at least €7 million or 1.4% for important entities. Member States may go higher.
Has our country transposed NIS2 yet?
Most Member States have notified full transposition. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to do so; the Dutch law then took effect on 15 August 2026, while France's bill was still before Parliament in September 2026. Where a law is pending, the Directive shows what it will require.
We are a financial entity under DORA. Does NIS2 still apply?
For financial entities in its scope, DORA, Regulation (EU) 2022/2554, applied since 17 January 2025, is the sector-specific act that Article 4 of NIS2 defers to: its ICT risk-management and incident-reporting rules apply instead. Group companies outside DORA may still fall under NIS2.
What do you need to prepare a NIS2 proposal?
The entities and countries involved, their sectors, headcount and turnover, any registration by an authority, what exists today and any regulator or customer deadline. That is enough for a scoped, all-inclusive proposal; you do not need to classify your entities first.
Before the first call
Prepare a useful NIS2 readiness brief
Nothing needs classifying before the first call; an account of your entities, services and who is asking is enough. Seven questions:
- Which legal entities, countries and services are involved, and in which Annex I or II sector does each sit?
- What are each entity's headcount, turnover and balance sheet, and how is it linked to the group?
- Has an authority registered or designated you, or were you an operator of essential services under NIS1?
- Who is asking: the national authority, a customer's supplier questionnaire, the board, an insurer?
- What exists today: ISO/IEC 27001, ISO 22301, SOC 2, an incident procedure, supplier security clauses?
- Who in the management body will approve the measures, and who from IT, legal and procurement can give time?
- Is there a registration deadline, an inspection, a customer date or a contract renewal to plan around?
With these answers we can scope the work and prepare a realistic, all-inclusive proposal. They prepare a discussion; they are neither a scored assessment nor a legal classification.
Don’t be fooled by certification scams
If it takes ten days, it is not NIS2 compliance.
NIS2 has no certificate, which has not stopped anyone from selling one: "NIS2 certified" badges, one-day compliance tools, policy packs with another organisation's name still inside, board training certificates presented as proof of compliance. They cost less than a programme until an inspector asks for the incident log or a significant incident arrives on a Friday night.
How to choose a credible NIS2 provider
- Ask what will exist at the end: the classification, the approved measures, the reporting procedure, supplier controls, trained people and the evidence behind each.
- Ask what any "NIS2 certificate" actually is. The Directive provides none. Genuine certifications, such as ISO/IEC 27001 from an accredited body, support compliance and should be named for what they are.
- Ask how the measures will be tested against your systems, with your own IT and supplier data, not scored from a questionnaire.
- Identify who carries each task, which legal, audit or certification costs are separate, and what support exists when an incident or an inspection tests the programme.
- Ask how the management body will be involved. Measures the board has not approved, and members who have not been trained, fall short of Article 20.
- Walk away from "NIS2 compliant in a week", "NIS2 certified" seals and policy packs sold as compliance. The Directive asks for measures that operate and incidents reported on time; paperwork delivers neither.
Keep exploring
More on NIS2 Directive and related standards
Every NIS2 Directive guide
More in Information security, cyber & cloud
Talk to a consultant
Plan your NIS2 compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice