NIS2

NIS2 Directive (EU) 2022/2555

NIS2 sets cybersecurity and incident-reporting requirements for entities within its scope, implemented through national law. This library groups the directive into review topics. Confirm your entity's scope and national requirements before using the checklist.

Start my free NIS2 assessmentNo account · No credit card · Save when useful

Reference guides

Check the law and deadlines in your jurisdiction

Planning the review

Depends on service criticality and existing measures

Budget considerations

Review measures and evidence as risks and operations change

Keeping it current

Cross-Framework Control Mapping

Key NIS2 controls mapped to equivalent requirements in other frameworks. Work done for one framework reduces effort on the others.

NIS2 Control	ISO 27001	SOC 2	GDPR
Risk Management (Art. 21(2)(a))	A.5.1, Clauses 6.1.2, 6.1.3	CC3.1, CC3.2	Art. 24, Art. 35
Incident Handling (Art. 21(2)(b))	A.5.24, A.5.25, A.5.26	CC7.3, CC7.4	Art. 33, Art. 34
Business Continuity (Art. 21(2)(c))	A.5.29, A.5.30	A1.2, A1.3	Art. 32(1)(c)
Supply Chain (Art. 21(2)(d))	A.5.19, A.5.20, A.5.21	CC9.2	Art. 28
Cryptography (Art. 21(2)(h))	A.8.24	CC6.1, CC6.7	Art. 32(1)(a)
Access Control (Art. 21(2)(i))	A.5.15, A.5.18, A.8.2	CC6.1, CC6.3	Art. 25, Art. 32

Where auditors look first

The highest-risk NIS2 controls - the ones auditors probe earliest and where gaps cost the most. Start your assessment here.

Annex.I.1Energy Sector Cybersecurity Requirements Annex.I.2Transport Sector Cybersecurity Requirements Annex.I.3Banking and Financial Market Infrastructure Cybersecurity Requirements Annex.I.5Healthcare Sector Cybersecurity Requirements Annex.I.6Water and Wastewater Sector Cybersecurity Requirements Annex.I.8Digital Infrastructure and ICT Service Cybersecurity Requirements Art.20.1Management Body Accountability and Governance Art.21.1Cybersecurity Risk Management Framework

Key NIS2 terms

Plain-language definitions for the concepts you will meet while working through NIS2.

Frequently Asked Questions

Does NIS2 apply to our company?

Check the entity types in Annexes I and II, the applicable enterprise-size rules, group relationships and exceptions. Then check the national implementing law and regulator guidance. A headcount or turnover figure on its own is not a complete scope assessment.

Does ISO 27001 certification cover NIS2?

It can support your evidence, but it does not establish NIS2 compliance. Review service scope, incident reporting, management responsibilities and national requirements separately.

What does the free NIS2 link open?

A short readiness check to help identify priorities. The reference library and downloadable workbook cover a wider set of topics.

When do the obligations apply?

The directive set 17 October 2024 as the transposition deadline. Check commencement dates, transitional provisions and obligations in the law applicable to your entity; the EU deadline alone does not establish retroactive enforcement.

Control Categories

This library groups 46 review topics into 4 categories.

Cybersecurity Risk Management Measures

13 reference guides

Incident Reporting & Response

11 reference guides

Supervision, Enforcement & Governance

12 reference guides

Sector-Specific Requirements

10 reference guides

Who Needs NIS2?

Energy and utilities companiesTransport and logistics providersBanking and financial market infrastructuresHealthcare organizationsDigital infrastructure providers (DNS, IXPs, cloud, data centers)ICT service management (B2B)Public administration entitiesManufacturing of critical products

Applicable Regions

European UnionEuropean Economic Area

Related Frameworks

Organizations pursuing NIS2 often also work toward these standards.

ISO 27001 GDPR

Start your NIS2 self-assessment

Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.

Start Free Assessment

Start without an account · Sign up only to save