14 NIS2 Directive

Modern economies depend on interconnected digital infrastructure.

Organizations responsible for:

energy
transportation
healthcare
banking
digital infrastructure
cloud services
managed services
public administration
manufacturing
communications

can no longer treat cybersecurity as simply an internal IT issue.

A major cyber incident affecting one organization can disrupt:

Customers
     ↓
Suppliers
     ↓
Critical Services
     ↓
Industries
     ↓
National Infrastructure

The European Union therefore introduced an expanded cybersecurity framework:

NIS2 Directive

NIS2 establishes cybersecurity risk-management and incident-reporting obligations for organizations operating in important sectors across the European Union.

The central question is:

Can Essential
and Important
Organizations
Continue Operating
During Serious
Cybersecurity Incidents?

Learning Objectives

By the end of this lesson, you will be able to:

explain the purpose of NIS2.
understand the evolution from NIS to NIS2.
identify essential and important entities.
understand NIS2 sector coverage.
understand management-body accountability.
explain cybersecurity risk-management measures.
understand incident handling requirements.
understand business continuity and crisis management.
understand backup and disaster recovery.
understand supply chain security.
understand vulnerability management.
understand secure development requirements.
understand cybersecurity effectiveness assessments.
understand cryptography and encryption requirements.
understand access-control requirements.
understand MFA and secure communications.
understand cybersecurity awareness and training.
understand significant incident reporting.
understand the NIS2 reporting lifecycle.
understand supervision and enforcement.
understand evidence requirements.
build an enterprise NIS2 compliance program.
integrate NIS2 with ISO 27001, NIST CSF, DORA, CIS Controls, and enterprise GRC.

1. What Is NIS2?

NIS2 is the commonly used name for:

Directive (EU)
2022/2555

It establishes measures intended to achieve a high common level of cybersecurity across the European Union.

NIS2 replaced the earlier:

NIS Directive

and significantly expanded its scope and requirements.

Conceptually:

NIS
      ↓
Expanded Scope
      ↓
Stronger Governance
      ↓
Stronger Risk Management
      ↓
Stronger Reporting
      ↓
NIS2

2. Why NIS2 Was Introduced

Modern organizations depend on:

Cloud

Networks

Applications

Identity

Data

Suppliers

Managed Services

Digital Platforms

These dependencies create systemic cybersecurity risk.

For example:

Cloud Provider
      ↓
Healthcare Provider
      ↓
Hospital Systems
      ↓
Patient Services

A cyber incident can therefore become:

Technology Incident
      ↓
Business Disruption
      ↓
Critical Service Disruption
      ↓
Societal Impact

3. NIS2 Objective

The objective is not merely:

Protect Computers

The broader objective is:

Protect
Essential Services
and Important
Economic Activities

through stronger cybersecurity governance and resilience.

4. NIS2 Governance Model

A simplified model is:

Management Body
      ↓
Cybersecurity Governance
      ↓
Risk Assessment
      ↓
Security Measures
      ↓
Monitoring
      ↓
Incident Management
      ↓
Reporting
      ↓
Continuous Improvement

5. Essential and Important Entities

NIS2 generally categorizes in-scope organizations as:

Essential Entities

or:

Important Entities

The classification affects areas such as supervisory approach and enforcement.

6. Essential Entities

Depending on sector, size and other applicability criteria, essential entities may include organizations operating in areas such as:

Energy

Transport

Banking

Financial Market Infrastructure

Health

Drinking Water

Wastewater

Digital Infrastructure

ICT Service Management

Public Administration

Space

Applicability must always be assessed against the Directive and the relevant Member State’s implementing legislation.

7. Important Entities

Other covered sectors can include:

Postal Services

Waste Management

Chemical Manufacturing

Food

Manufacturing

Digital Providers

Research

again subject to the applicable classification criteria.

8. Size-Cap Rule

NIS2 generally focuses on:

Medium
and
Large Organizations

within covered sectors.

However, certain organizations may fall within scope regardless of normal size thresholds because of factors such as their criticality or specific role.

Therefore:

Small Company
≠
Automatically Out of Scope

9. Applicability Assessment

A GRC analyst should determine:

Country
      ↓
Sector
      ↓
Entity Type
      ↓
Organization Size
      ↓
Special Applicability Rules
      ↓
Essential / Important
      ↓
Applicable Requirements

10. Member State Implementation

An important distinction is that NIS2 is a:

Directive

rather than an EU regulation applied identically through a single operational rulebook.

Member States transpose the Directive into national law.

Therefore organizations should evaluate:

NIS2
      +
National Implementation
      +
Regulator Guidance

11. Management-Body Accountability

NIS2 makes cybersecurity governance a leadership responsibility.

The management body must approve and oversee cybersecurity risk-management measures.

Conceptually:

Board / Management
      ↓
Approve
      ↓
Oversee
      ↓
Cybersecurity
Risk Management

12. Cybersecurity Is Not Only the CISO’s Responsibility

Weak governance:

Cybersecurity
      ↓
IT Department

Mature governance:

Management Body
      ↓
Business
Risk
Security
Technology
Legal
Compliance

13. Management Training

Management should maintain sufficient cybersecurity understanding to:

Understand Risk

Evaluate Controls

Challenge Management

Review Incidents

Make Risk Decisions

Training should therefore be treated as part of governance.

14. Cybersecurity Risk Management

NIS2 requires organizations to implement appropriate and proportionate:

Technical

Operational

Organizational

measures for cybersecurity risk.

15. All-Hazards Approach

Organizations should consider a broad range of threats.

For example:

Cyberattack

Ransomware

Insider Threat

System Failure

Supplier Failure

Human Error

Physical Event

Natural Disaster

Cyber resilience cannot be designed around malware alone.

16. Risk Management Lifecycle

Identify
      ↓
Assess
      ↓
Treat
      ↓
Monitor
      ↓
Review

17. Cyber Risk Register

Maintain:

Risk ID

Asset / Service

Threat

Vulnerability

Likelihood

Impact

Existing Controls

Residual Risk

Risk Owner

Treatment

Due Date

18. Example Risk

Risk:

Compromise of
privileged cloud
administrator accounts
could disrupt critical
customer services.

Controls:

MFA

PAM

Conditional Access

Logging

Access Reviews

19. Security Policies

Organizations should establish policies covering relevant areas such as:

Cybersecurity

Risk Management

Access Control

Incident Response

Business Continuity

Supply Chain Security

Vulnerability Management

Cryptography

Secure Development

20. Incident Handling

NIS2 requires capabilities for:

Preventing

Detecting

Responding

Recovering

from cybersecurity incidents.

A mature process:

Detect
      ↓
Triage
      ↓
Classify
      ↓
Contain
      ↓
Eradicate
      ↓
Recover
      ↓
Report
      ↓
Learn

21. Incident Response Plan

Document:

Roles

Responsibilities

Severity

Escalation

Communication

Regulatory Reporting

Recovery

Evidence

Lessons Learned

22. Security Operations

Detection capabilities may include:

SIEM

SOC

EDR

NDR

Cloud Monitoring

Identity Monitoring

Application Monitoring

23. Business Continuity

NIS2 explicitly connects cybersecurity with continuity.

Organizations should prepare for:

Cyberattack

Infrastructure Failure

Supplier Failure

Data Loss

Service Disruption

24. Business Continuity Lifecycle

Business Impact Analysis
        ↓
Critical Services
        ↓
Recovery Requirements
        ↓
Continuity Strategy
        ↓
Recovery Plans
        ↓
Testing

25. Critical Services

Identify:

Service

Owner

Supporting Systems

Data

People

Suppliers

RTO

RPO

26. Disaster Recovery

Recovery plans should address:

Applications

Infrastructure

Networks

Cloud

Identity

Data

Third Parties

27. Backup Management

Backups should be:

Available

Protected

Recoverable

Tested

A backup existing does not prove:

Recovery Capability

28. Crisis Management

Some incidents exceed normal technical response.

Example:

Ransomware
      ↓
Production Outage
      ↓
Customer Disruption
      ↓
Regulatory Reporting
      ↓
Media Attention

This requires:

Crisis Management

29. Crisis Management Team

May include:

Executive Leadership

Security

IT

Business

Legal

Compliance

Communications

HR

30. Supply Chain Security

Supply chain security is a major NIS2 requirement.

Organizations increasingly depend on:

Cloud Providers

Software Vendors

MSPs

MSSPs

SaaS Providers

Hardware Vendors

Consultants

31. Supply Chain Risk

Example:

Organization
      ↓
Software Vendor
      ↓
Compromised Update
      ↓
Organization Compromised

32. Supplier Security Lifecycle

Identify Supplier
      ↓
Criticality
      ↓
Due Diligence
      ↓
Security Requirements
      ↓
Contract
      ↓
Monitoring
      ↓
Reassessment
      ↓
Exit

33. Supplier Criticality

Assess:

Service Criticality

Data Access

System Access

Business Dependency

Subcontractors

Recovery Dependency

34. Supplier Due Diligence

Review:

Security Program

Certifications

Incident History

Access Controls

Encryption

Vulnerability Management

Business Continuity

Incident Response

35. Contract Security

Contracts should establish appropriate requirements for:

Security

Incident Notification

Data Protection

Access

Audit

Continuity

Termination

36. Supplier Monitoring

Vendor risk does not stop after:

Contract Signing

Monitor:

Security Posture

Incidents

Findings

Certifications

Service Changes

Subcontractors

37. Vulnerability Management

Organizations need structured processes for:

Discover
      ↓
Assess
      ↓
Prioritize
      ↓
Remediate
      ↓
Validate

38. Vulnerability Prioritization

Consider:

CVSS

Exploitability

Internet Exposure

Asset Criticality

Threat Intelligence

Business Impact

39. Vulnerability Disclosure

Organizations should establish appropriate processes for handling vulnerability information.

Conceptually:

Vulnerability Reported
      ↓
Validate
      ↓
Assess
      ↓
Remediate
      ↓
Communicate

40. Secure Development

Security should be integrated into:

Design

Development

Testing

Deployment

Maintenance

41. Secure SDLC

Requirements
      ↓
Threat Modeling
      ↓
Secure Coding
      ↓
Security Testing
      ↓
Deployment
      ↓
Monitoring

42. Application Security Testing

May include:

SAST

DAST

SCA

Secrets Scanning

Container Scanning

Penetration Testing

43. Software Supply Chain

Modern applications depend heavily on:

Libraries

Packages

Containers

APIs

CI/CD

Repositories

These dependencies must be governed.

44. Cybersecurity Effectiveness

Organizations should assess whether security measures actually work.

Control Designed
      ↓
Implemented
      ↓
Operating
      ↓
Effective

45. Control Testing

Test areas such as:

MFA

Backups

Logging

EDR

Firewalls

Incident Response

Recovery

Vendor Controls

46. Security Metrics

Examples:

MFA Coverage

Critical Patch Compliance

EDR Coverage

Logging Coverage

Backup Success

Recovery Test Success

Critical Findings

Incident Response Time

47. Cryptography

NIS2 includes policies and procedures concerning:

Cryptography

and where appropriate:

Encryption

48. Encryption

Protect sensitive information:

Data at Rest

Data in Transit

using appropriate cryptographic controls.

49. Key Management

Encryption depends on:

Key Generation

Storage

Rotation

Access

Revocation

Destruction

50. Access Control

Organizations should establish:

Identity Governance

Authentication

Authorization

Least Privilege

Privileged Access

Access Reviews

51. Identity Lifecycle

Joiner
      ↓
Access Provisioning
      ↓
Role Change
      ↓
Access Review
      ↓
Leaver
      ↓
Access Removal

52. Privileged Access

Administrative access should receive stronger controls.

Privileged Account
      ↓
MFA
      ↓
PAM
      ↓
Approval
      ↓
Monitoring

53. Multi-Factor Authentication

NIS2 includes the use of:

Multi-Factor Authentication

or continuous authentication solutions where appropriate.

54. Secure Communications

Organizations should consider secure:

Voice

Video

Text

Emergency Communication

where appropriate.

55. Human Security

Technology alone cannot provide resilience.

Employees should understand:

Phishing

Passwords

MFA

Data Handling

Incident Reporting

Social Engineering

56. Cybersecurity Training

Training should be:

Role Based

Periodic

Relevant

Measured

57. Significant Incidents

NIS2 establishes reporting requirements for incidents having significant impact on the provision of services.

The organization therefore needs:

Incident
      ↓
Impact Assessment
      ↓
Significant?
     / \
   No   Yes
         ↓
Regulatory Reporting

58. Significant Incident Assessment

Consider factors such as:

Service Disruption

Users Affected

Duration

Financial Loss

Operational Impact

Cross-Border Impact

using applicable legal criteria.

59. NIS2 Incident Reporting Lifecycle

One of the most important operational requirements is the staged reporting process.

Conceptually:

Significant Incident
        ↓
Early Warning
        ↓
Incident Notification
        ↓
Intermediate Reporting
        ↓
Final Report

60. Early Warning

For a reportable significant incident, NIS2 establishes an:

Early Warning

generally within:

24 Hours

of becoming aware of the significant incident.

61. Incident Notification

A more detailed:

Incident Notification

generally follows within:

72 Hours

of becoming aware of the significant incident.

62. Intermediate Report

Competent authorities or CSIRTs may request:

Intermediate
Status Reports

as the incident develops.

63. Final Report

Final Report

is generally required no later than:

One Month

after the incident notification.

Exact reporting obligations must be implemented according to applicable NIS2 and national requirements.

64. Reporting Workflow

Organizations should not discover reporting requirements during an incident.

Create:

Incident Detected
      ↓
Security Triage
      ↓
NIS2 Assessment
      ↓
Legal / Compliance
      ↓
Reportable?
      ↓
Regulatory Workflow

65. Reporting Matrix

Maintain:

Incident

Threshold

Regulator

Early Warning

Notification

Final Report

Owner

66. Reporting Ownership

Define who:

Detects

Classifies

Approves

Submits

Tracks

Closes

regulatory reports.

67. Incident Evidence

Retain:

Timeline

Logs

Impact Assessment

Decisions

Communications

Notifications

Root Cause

Corrective Actions

68. Supervision

NIS2 strengthens supervisory capabilities.

Authorities may use mechanisms such as:

Requests for Information

Security Audits

Inspections

Evidence Reviews

Compliance Orders

depending on entity classification and national implementation.

69. Essential vs Important Supervision

A major conceptual distinction is:

Essential Entities
      ↓
More Proactive
Supervisory Regime

while:

Important Entities
      ↓
Generally More
Reactive Supervision

The precise supervisory model depends on applicable law.

70. Enforcement

Failure to comply can result in:

Corrective Orders

Supervisory Measures

Administrative Fines

Management Consequences

71. Executive Accountability

This is one of the most important lessons from NIS2:

Cyber Risk
=
Enterprise Governance

not simply:

Technical Security

72. NIS2 Compliance Program

A practical implementation program:

Determine Scope
      ↓
Establish Governance
      ↓
Assess Risk
      ↓
Map Requirements
      ↓
Implement Controls
      ↓
Manage Suppliers
      ↓
Build Incident Reporting
      ↓
Test Resilience
      ↓
Collect Evidence
      ↓
Monitor
      ↓
Improve

73. Phase 1 — Determine Scope

Identify:

Legal Entities

Countries

Sectors

Services

Organization Size

Essential / Important Status

74. Phase 2 — Governance

Establish:

Executive Accountability

Cybersecurity Committee

Risk Ownership

Security Policies

Management Reporting

75. Phase 3 — Gap Assessment

Compare:

NIS2 Requirement
        ↓
Current Control
        ↓
Evidence
        ↓
Gap

76. Requirement Register

Maintain:

Requirement

National Law

Applicability

Control

Owner

Evidence

Status

77. Control Mapping

Example:

Enterprise Control
IAM-001

Privileged MFA
      ↓
NIS2
      ↓
ISO 27001
      ↓
NIST CSF
      ↓
CIS Controls

78. Common Control Framework

Avoid creating:

NIS2 MFA Control

ISO MFA Control

SOC 2 MFA Control

NIST MFA Control

Create:

One Enterprise
MFA Control

and map multiple frameworks to it.

79. Evidence Library

Maintain evidence such as:

Policies

Risk Registers

Access Reviews

Vulnerability Reports

Training Records

Incident Records

Recovery Tests

Vendor Assessments

Audit Reports

80. Evidence Traceability

Requirement
      ↓
Control
      ↓
Owner
      ↓
Evidence
      ↓
Test
      ↓
Finding

81. NIS2 Gap Register

Example:

Gap ID

Requirement

Current State

Risk

Action

Owner

Due Date

Status

82. Example Gap

Requirement:

Supply Chain
Security

Current state:

Critical Vendors
Identified

Gap:

No Continuous
Vendor Monitoring

83. Remediation

Implement Vendor
Monitoring Process

Assign Owner

Define Review Frequency

Track Findings

Report Exceptions

84. NIS2 Dashboard

Example:

NIS2 CYBERSECURITY DASHBOARD

Critical Cyber Risks          12

Risks Above Appetite           4

Critical Vendors              28

Critical Vendor Findings       7

Critical Vulnerabilities      14

Overdue Patches                9

Open Audit Findings            6

Significant Incidents          2

Illustrative only.

85. Executive Reporting

Management needs to know:

What Are Our
Material Cyber Risks?

Which Critical
Services Are Exposed?

Which Controls
Are Failing?

Which Vendors
Create Material Risk?

Which Incidents
Occurred?

Can We Recover?

What Requires
Management Action?

86. NIS2 and ISO 27001

ISO 27001 provides:

Information Security
Management System

NIS2 provides:

Legal Cybersecurity
Obligations

Together:

ISO 27001
      +
NIS2 Requirements
      =
Strong Compliance
Foundation

But ISO 27001 certification does not automatically prove full NIS2 compliance.

87. NIS2 and NIST CSF

NIST CSF provides:

Govern

Identify

Protect

Detect

Respond

Recover

which can help structure many NIS2 cybersecurity capabilities.

88. NIS2 and CIS Controls

CIS Controls provide practical technical safeguards such as:

Asset Management

Access Control

Vulnerability Management

Logging

Malware Defenses

Backup

Incident Response

89. NIS2 and DORA

DORA focuses primarily on:

EU Financial Sector
Digital Operational
Resilience

NIS2 covers a broader range of:

Essential
and Important
Sectors

90. DORA vs NIS2

Conceptually:

DORA
Financial Sector
Operational Resilience

NIS2
Cross-Sector
Cybersecurity

Organizations must determine which legal regime applies and how sector-specific rules interact.

91. NIS2 and Supply Chain Risk

Traditional vendor assessment:

Questionnaire
      ↓
Risk Rating

Mature NIS2 supply-chain governance:

Criticality
      ↓
Due Diligence
      ↓
Contract
      ↓
Security Monitoring
      ↓
Incident Management
      ↓
Reassessment
      ↓
Exit

92. Common Mistake — Treat NIS2 as ISO Certification

NIS2 is:

Legislation

not:

Certification

93. Common Mistake — Cybersecurity Owned Only by IT

NIS2 creates:

Management
Accountability

94. Common Mistake — Ignore National Law

Do not implement:

EU Directive
Only

without reviewing:

Member State
Implementation

95. Common Mistake — No Scope Assessment

Before implementing controls determine:

Which Entity?

Which Country?

Which Sector?

Essential or Important?

Which Services?

96. Common Mistake — Ignore Suppliers

Your strongest internal controls can be undermined by:

Critical Supplier
Compromise

97. Common Mistake — Questionnaire-Only TPRM

Supplier security requires:

Assessment
+
Contracts
+
Monitoring
+
Incident Governance
+
Reassessment

98. Common Mistake — No Incident Reporting Playbook

During ransomware is the wrong time to ask:

Do We Need
to Notify
the Regulator?

99. Common Mistake — Backup Equals Recovery

Always test:

Can We Restore?

How Long?

How Much Data
Will We Lose?

100. Common Mistake — Compliance Percentage Only

Weak reporting:

NIS2 Compliance
96%

may hide:

Critical Service
Cannot Recover

or:

Privileged Accounts
Without MFA

101. End-to-End Example — Healthcare Provider

Organization:

Large EU
Healthcare Provider

Critical services:

Patient Records

Clinical Systems

Diagnostic Systems

Identity

Communications

102. Step 1 — Scope

Determine:

Country

Entity

Sector

Size

NIS2 Applicability

103. Step 2 — Critical Services

Identify:

Electronic
Patient Records

as a critical service.

104. Step 3 — Dependencies

Patient Records
      ↓
Clinical Application
      ↓
Database
      ↓
Cloud
      ↓
Identity
      ↓
Network

105. Step 4 — Risk

Scenario:

Ransomware
Compromises
Clinical Systems

Impact:

Patient Care
Disrupted

106. Step 5 — Controls

Implement:

MFA

EDR

Segmentation

Backup

SIEM

Vulnerability Management

107. Step 6 — Supplier Risk

Cloud provider supports:

Patient Records

Perform:

Due Diligence

Contract Review

Continuity Assessment

Incident Review

Monitoring

108. Step 7 — Recovery

Define:

RTO

RPO

Backup

Failover

Recovery Procedure

109. Step 8 — Testing

Simulate:

Clinical Database
Unavailable

Measure:

Detection

Escalation

Recovery

RTO

Communication

110. Step 9 — Incident Reporting

If an incident has significant impact:

Incident
      ↓
NIS2 Classification
      ↓
Early Warning
      ↓
Incident Notification
      ↓
Final Report

111. Step 10 — Improvement

Incident / Test
      ↓
Finding
      ↓
Corrective Action
      ↓
Owner
      ↓
Retest

112. NIS2 Operating Model

Management Body
      ↓
Cybersecurity Governance
      ↓
Enterprise Risk
      ↓
Critical Services
      ↓
Technology & Suppliers
      ↓
Security Controls
      ↓
Detection
      ↓
Incident Management
      ↓
Continuity
      ↓
Regulatory Reporting
      ↓
Continuous Assurance

113. Three Lines Model

First Line

Business
Technology
Security Operations

Own and Operate
Controls

Second Line

Risk
Compliance
GRC

Monitor and
Challenge

Third Line

Internal Audit

Independent
Assurance

NIS2 Readiness Checklist

Scope

legal entities identified.
countries identified.
sectors identified.
size criteria assessed.
essential/important classification assessed.
national implementation reviewed.
applicable regulators identified.

Governance

management accountability established.
cybersecurity governance defined.
policies approved.
risk owners assigned.
management training established.
executive reporting implemented.

Risk Management

cybersecurity risk methodology established.
critical services identified.
risks assessed.
controls mapped.
residual risks calculated.
risks above appetite escalated.

Incident Handling

incident response plan maintained.
severity model established.
escalation process established.
incident roles assigned.
evidence retention established.
lessons learned performed.

Business Continuity

BIA completed.
critical services mapped.
RTO established.
RPO established.
backups protected.
recovery procedures maintained.
recovery tested.
crisis management established.

Supply Chain

critical suppliers identified.
supplier criticality assessed.
due diligence performed.
security requirements contractualized.
supplier incidents monitored.
reassessments performed.
findings tracked.

Vulnerability Management

vulnerability scanning established.
prioritization methodology defined.
patch SLAs established.
critical vulnerabilities tracked.
remediation validated.
disclosure processes established.

Secure Development

secure SDLC established.
security requirements defined.
threat modeling performed where appropriate.
code security testing established.
dependency scanning implemented.
secrets scanning implemented.

Access Control

IAM established.
least privilege enforced.
MFA implemented.
privileged access controlled.
access reviews performed.
leaver access removed.

Cryptography

cryptography policy established.
encryption requirements defined.
key management established.
certificate management established.

Incident Reporting

significant-incident criteria documented.
24-hour early-warning process established.
72-hour notification process established.
final-report process established.
regulator contacts maintained.
reporting ownership assigned.
reporting workflow tested.

Assurance

requirement register maintained.
controls mapped.
evidence retained.
controls tested.
findings tracked.
remediation verified.
management reporting established.

NIS2 Deliverables

After completing this lesson, you should be able to create:

01 NIS2 Applicability Assessment

02 Essential / Important Entity Assessment

03 NIS2 Requirement Register

04 NIS2 Governance Model

05 NIS2 RACI

06 Cybersecurity Risk Register

07 Critical Service Register

08 Critical Service Dependency Map

09 NIS2 Control Framework

10 NIS2 Control Mapping Matrix

11 Cybersecurity Policy Framework

12 Incident Response Plan

13 Significant Incident Assessment Matrix

14 NIS2 Regulatory Reporting Matrix

15 Business Continuity Plan

16 Disaster Recovery Plan

17 Crisis Management Plan

18 Recovery Test Register

19 Critical Supplier Register

20 Supplier Security Assessment

21 Supplier Contract Security Matrix

22 Supplier Monitoring Register

23 Vulnerability Management Standard

24 Secure SDLC Standard

25 Cryptography Standard

26 Identity & Access Control Standard

27 Security Awareness Program

28 NIS2 Evidence Register

29 NIS2 Gap Register

30 NIS2 Executive Dashboard

Practical Activity — NIS2 Applicability Assessment

Scenario:

Organization:
European Cloud
Service Provider

Employees:
800

Customers:
Financial Services
Healthcare
Manufacturing

Determine:

Sector

Entity Type

Size

Country

Potential NIS2 Scope

Essential / Important
Classification

Document assumptions requiring legal validation.

Practical Activity — Build a Cyber Risk Register

Create risks for:

Ransomware

Cloud Administrator
Compromise

Critical Supplier
Failure

Customer Data
Breach

DDoS

For each record:

Likelihood

Impact

Controls

Residual Risk

Owner

Treatment

Practical Activity — Supplier Risk Assessment

Critical provider:

Managed Cloud
Service Provider

Assess:

Security

Access

Data

Incident Response

BCP

Vulnerability Management

Subcontractors

Contract

Monitoring

Practical Activity — Incident Reporting Exercise

Scenario:

08:00
Ransomware Detected

09:30
Customer Services
Unavailable

12:00
10,000 Customers
Affected

14:00
Incident Declared
Significant

Build the reporting workflow for:

Early Warning

Incident Notification

Intermediate Updates

Final Report

Identify:

Owner

Approver

Authority

Evidence

Timeline

Practical Activity — Recovery Test

Critical service:

Customer Portal

Scenario:

Primary Database
Unavailable

Test:

Detection

Escalation

Failover

Data Recovery

RTO

RPO

Customer Communication

Record:

Expected Result

Actual Result

Gap

Owner

Remediation

Retest

NIS2 GRC Mindset

When working with NIS2, ask:

Does NIS2
Apply to Us?

Which Legal
Entities Are
in Scope?

Which Countries
Do We Operate In?

Which National
Laws Apply?

Which Sector
Are We In?

Are We an
Essential Entity?

Are We an
Important Entity?

Which Services
Are Critical?

Who Owns
Cybersecurity Risk?

Has Management
Approved the
Security Measures?

Does Management
Understand the Risk?

Are Cyber Risks
Documented?

Which Risks Are
Above Appetite?

Do We Have
Effective Incident
Handling?

Can We Detect
Cyberattacks?

Can We Contain
an Incident?

Can We Recover?

Are Backups
Actually Tested?

What Happens
During a Crisis?

Which Suppliers
Support Critical
Services?

Have We Assessed
Those Suppliers?

Do Contracts
Contain Security
Requirements?

Are Suppliers
Continuously
Monitored?

How Do We
Manage Vulnerabilities?

Are Critical
Patches Applied?

Is Software
Developed Securely?

Are Dependencies
Scanned?

Are Cryptographic
Controls Appropriate?

Is MFA
Implemented?

Is Privileged
Access Controlled?

Are Employees
Trained?

What Makes
an Incident
Significant?

Who Performs
the NIS2 Assessment?

Who Sends
the Early Warning?

Can We Meet
the 24-Hour
Requirement?

Can We Meet
the 72-Hour
Requirement?

Who Prepares
the Final Report?

Do We Retain
Evidence?

Can Every
Requirement Map
to a Control?

Can Every
Control Map
to Evidence?

Are Controls
Actually Effective?

Which Findings
Are Overdue?

What Does
Management Need
to Know?

What Decision
Is Required?

Are We Simply
Compliant?

Or Can We
Actually Protect
and Recover
the Essential
Services Society
Depends On?

That is the mindset of a GRC professional working with the NIS2 Directive.

Key Takeaways

NIS2 is Directive (EU) 2022/2555.
It establishes a higher common level of cybersecurity across the EU.
NIS2 significantly expanded the original NIS framework.
Organizations can be classified as essential or important entities.
Applicability depends on factors including sector, entity type, size, and national implementation.
NIS2 makes cybersecurity an executive governance responsibility.
Management bodies must approve and oversee cybersecurity risk-management measures.
Cybersecurity risk management should address technical, operational, and organizational risk.
Incident handling is a core NIS2 requirement.
Business continuity, backup, disaster recovery, and crisis management support cyber resilience.
Supply chain security is a major NIS2 focus.
Critical suppliers should be assessed before and throughout the relationship.
Vulnerability handling and disclosure require structured governance.
Secure development and software supply-chain security should be integrated into the technology lifecycle.
Organizations should assess the effectiveness of cybersecurity controls.
Cryptography, access control, MFA, and secure communications form important protective measures.
Human security and cybersecurity training remain critical.
Significant incidents trigger structured regulatory-reporting obligations.
The reporting process can include a 24-hour early warning, 72-hour incident notification, intermediate reporting, and a final report.
Organizations should build reporting requirements directly into incident-response procedures.
NIS2 strengthens regulatory supervision and enforcement.
Essential and important entities can face different supervisory approaches.
NIS2 should be mapped into an enterprise control framework rather than creating duplicate compliance controls.
ISO 27001, NIST CSF, CIS Controls, and other frameworks can support NIS2 implementation.
NIS2 and DORA overlap in cybersecurity and resilience objectives but have different scopes and legal structures.
Mature NIS2 programs focus on the resilience of critical services rather than compliance percentages alone.

Knowledge Check

Before continuing, make sure you can answer:

What is NIS2?
What EU directive established NIS2?
Why was NIS2 introduced?
How does NIS2 differ from the original NIS Directive?
What is an essential entity?
What is an important entity?
Which sectors can fall within NIS2?
How does organization size affect applicability?
Why must national implementation be reviewed?
What responsibilities does the management body have?
Why is management cybersecurity training important?
What are cybersecurity risk-management measures?
What does an all-hazards approach mean?
What is a cybersecurity risk register?
What capabilities support incident handling?
Why is business continuity part of cybersecurity resilience?
What is RTO?
What is RPO?
Why should backup restoration be tested?
What is crisis management?
Why is supply chain security important?
How should critical suppliers be identified?
What should supplier due diligence evaluate?
Why should security requirements appear in contracts?
Why is continuous supplier monitoring necessary?
What is vulnerability management?
What is coordinated vulnerability disclosure?
What is secure SDLC?
Why does software supply-chain security matter?
How should cybersecurity-control effectiveness be evaluated?
Why is cryptography important?
Why is key management important?
What is least privilege?
Why should privileged accounts receive stronger controls?
How does MFA support NIS2?
Why is cybersecurity awareness important?
What is a significant incident?
What is the NIS2 early warning?
What is the general early-warning timeline?
What is the incident-notification timeline?
What is the purpose of the final report?
Why should regulatory reporting be built into incident-response procedures?
How does supervision differ between essential and important entities?
Why is executive accountability important?
What evidence supports NIS2 compliance?
How can ISO 27001 support NIS2?
How can NIST CSF support NIS2?
How can CIS Controls support NIS2?
How does NIS2 differ from DORA?
What makes an effective NIS2 compliance program?

What’s Next?

➡️ Next: 15 — Framework Selection & Compliance Strategy

You have now examined major enterprise cybersecurity, risk, resilience, privacy, and compliance frameworks individually.

The next challenge is not learning another framework.

It is learning:

Which Framework
Should We Use?

Organizations rarely operate under only one requirement.

A modern enterprise may need to address:

NIST CSF

NIST RMF

CIS Controls

COBIT

ISO 31000

ISO 22301

ISO 27701

HITRUST

FedRAMP

CSA CCM

SWIFT CSCF

RBI / SEBI / IRDAI

DORA

NIS2

Implementing each independently creates:

Duplicate Controls

Duplicate Evidence

Duplicate Testing

Compliance Silos

Higher Cost

Instead, you will learn to build:

Business Requirements
        ↓
Regulatory Obligations
        ↓
Framework Selection
        ↓
Common Control Framework
        ↓
Control Mapping
        ↓
Shared Evidence
        ↓
Continuous Assurance

You will learn how GRC professionals determine:

Which Framework Applies?

Which Framework Should
Be Primary?

Which Requirements
Overlap?

Which Controls
Can Be Shared?

Which Requirements
Are Unique?

How Should Evidence
Be Reused?

How Do We Avoid
Compliance Duplication?

How Do We Build
One Enterprise
Compliance Strategy?

This brings the entire Enterprise Compliance Frameworks Overview module together.

➡️ Next: 15 — Framework Selection & Compliance Strategy