NIS2 compliance: a practical guide

By Paul Gillet · Updated 2026-10-17

NIS2 is the EU's main cybersecurity law: Directive (EU) 2022/2555. As a directive, it works through each member state's national law, which was due by 17 October 2024. The core obligations are the same everywhere, but registration, supervision, penalties and some details vary by country, so always check the national law where you operate.

Are you in scope?

NIS2 covers entities in 18 sectors. Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research.

As a rule, an entity is in scope if it operates in one of those sectors in the EU and is at least medium-sized (50 or more staff, or annual turnover and balance sheet above €10 million). Some are in scope whatever their size, such as DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications networks. Entities are classed as essential or important; both must meet the same measures, but supervision and maximum fines differ.

What NIS2 requires

• Governance (Article 20): management bodies must approve the risk-management measures, oversee them, and take cybersecurity training. They can be held liable for failures.
• Risk-management measures (Article 21): an all-hazards approach covering (a) risk analysis and security policies; (b) incident handling; (c) business continuity, backups, disaster recovery and crisis management; (d) supply-chain security; (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure; (f) assessing the effectiveness of these measures; (g) basic cyber hygiene and training; (h) cryptography and encryption; (i) human-resources security, access control and asset management; and (j) multi-factor or continuous authentication and secured communications.
• Incident reporting (Article 23): for a significant incident, an early warning to the CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month.
• Registration: most entities must register with their national authority.

The Implementing Regulation

For certain digital providers, the Commission spelled out the Article 21 measures in Implementing Regulation (EU) 2024/2690: DNS service providers, TLD registries, cloud computing and data centre services, content delivery networks, managed service and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. Its Annex is far more specific than Article 21 itself. ControlMapping's NIS2 requirements are the points of that Annex, with ENISA's titles and ENISA's official mapping to ISO 27001 and NIST CSF 2.0. Other entities follow their national law, but the Annex and ENISA's implementation guidance are a sound reference for anyone.

The steps

1. Confirm scope and classification under the national law of each country you operate in, and register where required.
2. Brief the management body: they must approve the measures and complete training, so start there.
3. Run a gap assessment against Article 21, or against the Implementing Regulation's Annex if it applies to you. If you hold ISO 27001, start from the ISO 27001 → NIS2 comparison.
4. Implement the missing measures, with supply-chain security and vulnerability handling usually needing the most new work.
5. Build the reporting procedure: decide who judges whether an incident is significant, and practise meeting the 24-hour and 72-hour deadlines, including out of hours.
6. Keep evidence of effectiveness (Article 21(2)(f)): audits, tests and metrics that show the measures work.

Does ISO 27001 make you NIS2 compliant?

Not on its own, but it gets you much of the way. ENISA's mapping links every point of the Implementing Regulation to ISO 27001 clauses or Annex A controls, so an ISO-certified organisation has most of the technical and organisational measures. What ISO doesn't give you: the reporting deadlines, management training and liability, registration, and the specific technical requirements some Annex points spell out in more detail than Annex A. Your national authority, not your certification body, decides whether you comply.

Supervision and penalties

National authorities supervise essential entities proactively (audits, inspections, security scans) and important entities after the fact, usually following an incident or a complaint. Maximum fines are at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.

How this site helps

Every NIS2 requirement point here links to ISO 27001 and NIST CSF 2.0 through ENISA's mapping, and on to the other frameworks through those. The table below shows how much of NIS2 each framework you already have covers.

Already have another framework?

How many NIS2 requirements each framework you may already follow maps to. Open a gap report for the requirement-by-requirement list.

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Counts come from the same data as the gap analysis; a mapping means related requirements, not proof that one satisfies the other.

Questions

When did NIS2 start to apply?

Member states had to apply their national NIS2 laws from 18 October 2024. Several were late, so check the status where you operate.

What are the NIS2 incident reporting deadlines?

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.

Does NIS2 apply to companies outside the EU?

It can. Some digital providers that offer services in the EU without an establishment there must designate a representative in a member state.

Not legal or compliance advice. Check the official text and your auditor, assessor or regulator before relying on it.