NIS2,
measure by measure.

Build a NIS2 programme that can withstand scrutiny

NIS2 preparation becomes useful when it changes operational decisions. Which services would fail if a supplier became unavailable? Who approves security priorities? Can the organisation recognise a significant incident and escalate it while facts are still incomplete? A credible programme connects these questions to accountable owners and evidence.

The directive establishes the European framework, but organisations must also examine applicable national legislation and sector-specific rules. Treat an EU-level requirements assessment as a starting point, not a legal determination covering every country where the business operates.

Establish who falls within scope

Annexes I and II identify covered sectors and entity types, including energy, transport, health, digital infrastructure, certain ICT services, manufacturing activities, waste management and food businesses. Check the actual service or activity against the relevant category rather than relying on a broad industry label.

The general size rule covers medium-sized enterprises and organisations exceeding the medium-sized enterprise ceilings within the listed categories. Exceptions bring certain entities into scope regardless of size, including specified electronic communications, trust service and DNS providers. Public administration also has particular rules.

Do not assess a group solely by the headcount of one local office. Ownership relationships, the entity providing the service and specific designation criteria can matter. Record the legal entity, countries, activity, size assessment and reasoning. Obtain legal confirmation where classification or jurisdiction remains unclear.

Essential and important entities differ particularly in supervision arrangements. The distinction is not permission for an important entity to postpone risk management or incident readiness. Both categories need a defensible compliance programme under the applicable rules.

Translate governance and security duties into evidence

Article 20 requires management bodies to approve cybersecurity risk-management measures and oversee their implementation. It also requires training for those management bodies. Governance should therefore produce decisions, resource commitments and follow-up, not merely an executive signature on a policy.

Article 21 requires appropriate and proportionate technical, operational and organisational measures. Its coverage includes:

• risk analysis and information system security policies;
• incident handling, business continuity and crisis management;
• supply chain security;
• secure acquisition, development and maintenance;
• assessment of the effectiveness of measures;
• cyber hygiene, training and cryptography;
• personnel security, access control and asset management;
• multifactor authentication and secure communications where appropriate.

Give each area an owner, an expected outcome and evidence requirements. For example, a backup policy does not show that a service can be restored. A restoration exercise should establish what was recovered, which dependencies were needed and what problems remain unresolved.

Certain digital providers are also subject to Implementing Regulation (EU) 2024/2690. Check whether these more detailed requirements apply before choosing a control baseline. A generic maturity questionnaire may overlook requirements specific to the service you provide.

Understand the timeline and reporting clocks

The directive set 17 October 2024 as the national transposition deadline and provided for application of national measures from 18 October 2024. Those EU dates do not, by themselves, establish the actual legislative position or transitional arrangements in every Member State.

Check enacted legislation, commencement provisions, competent authority guidance and registration procedures for each relevant jurisdiction. For France, consult ANSSI and the published national texts. This guide does not assume that French transposition was completed by November 2026 or infer a binding deadline from draft material.

Article 23 establishes staged reporting for significant incidents: an early warning within 24 hours of awareness, followed by an incident notification within 72 hours. A final report is normally due no later than one month after that notification. Ongoing incidents have specific reporting arrangements, and trust service providers have a distinct notification deadline. Build the procedure for your entity category rather than applying one timetable indiscriminately.

Enforcement and business stakes

For infringements of Articles 21 and 23, Article 34 requires maximum administrative fines of at least €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher. For important entities, the corresponding figures are €7 million or 1.4%.

These are minimum levels for the maximum fines that national systems must provide, not automatic penalties for every failure. National implementation and the circumstances of an infringement matter. Supervisory and corrective powers also extend beyond financial penalties.

Operational disruption remains a separate exposure. An unavailable service can harm customers, interrupt dependent organisations and undermine contractual commitments. Compliance evidence should support resilience, rather than distract teams from unresolved operational weaknesses.

A seven-step path to compliance

1. Document the scope assessment. List legal entities, services, countries and potential categories. Retain the reasoning and unresolved questions. Identify which authorities, registrations and national requirements need confirmation before adopting a compliance deadline.

2. Secure a management mandate. Assign executive oversight and operational responsibility. Agree decision rights, resources and escalation routes. Arrange management training and record approval of the planned risk-management measures.

3. Map service dependencies. Connect business services to applications, infrastructure, people and suppliers. Identify dependencies whose loss could stop delivery. Include outsourced administration and other access paths that could transmit an incident.

4. Assess gaps and prioritise treatment. Compare existing practices with the applicable requirements. Prioritise weaknesses that threaten service continuity or enable compromise. Give each action an owner, a completion condition and a realistic delivery date.

5. Implement and verify controls. Gather access reviews, supplier assessments, recovery test results and training records. Check that evidence covers the relevant systems and period. A document with the right title is not necessarily proof of an effective measure.

6. Rehearse incident reporting. Exercise the process with technical, legal and management participants. Test significance assessment, escalation, authority contacts and approval of initial information. Include a scenario where key personnel or normal communications are unavailable.

7. Maintain oversight. Review residual risks, overdue actions and material changes with management. Update the programme when services, suppliers or legislation change. Close actions only after checking the intended outcome, and retain the decision trail.

How Domyno helps organise the work

Domyno combines a SaaS platform with a dedicated human expert. Agents prepare work and a human validates it. This supports structured preparation while retaining contextual review of the material produced.

Asset management helps organise the technical scope, while third-party management supports supplier work. Controls & compliance brings together a shared control library, evidence and action plans. These capabilities support a compliance programme; they do not replace legal classification or management accountability.

Primary references

Use the directive on EUR-Lex and, for France, ANSSI’s NIS2 guidance, alongside applicable national legislation.

To discuss your scope, evidence and next implementation priorities, request a demonstration.