What Is the NIS2 Directive? EU Cybersecurity Obligations, Risk Management and Compliance Guide

What Is the NIS2 Directive?

The NIS2 Directive is European Union legislation that aims to raise the cybersecurity level of organisations operating in critical and important sectors across the EU, and that regulates risk management, incident reporting, management accountability and supervision obligations.

Officially titled Directive (EU) 2022/2555, NIS2 widens the scope of the original NIS Directive and brings more sectors and types of organisation within cybersecurity obligations.

The core objective of NIS2 is to achieve a high, common level of cybersecurity for network and information systems across the European Union.

The Directive does not target the use of security technologies alone; it aims to ensure that organisations manage their cybersecurity risks, report security incidents on time, assess supplier risks and establish accountability at senior management level.

Quick facts about NIS2

Topic	Description
Official instrument	Directive (EU) 2022/2555
Core objective	Strengthening cybersecurity resilience across the EU
Scope	Certain organisations in critical and important sectors
Risk management	Article 21
Incident reporting	Article 23
Management accountability	Article 20
Entity classification	Essential and Important Entities
Deadline for transposition into national law	17 October 2024
Supervision and penalties	National implementation by the relevant Member State

Short answer: NIS2 compliance means that an organisation determines which obligations apply to it under the Directive and the applicable national legislation, and runs its cybersecurity risk management, incident reporting, supplier security and management oversight through demonstrable processes.

1. Why Was the NIS2 Directive Created?

As digital services and critical infrastructures become more interdependent, the impact of cybersecurity incidents grows wider.

A cyber incident at an energy distribution company can affect not only that company but also the businesses and individuals it serves.

Similarly, an outage at a cloud service provider can bring the operations of many organisations to a halt at the same time.

Although the original NIS Directive helped establish a common European approach to cybersecurity, there were areas to improve in terms of sector coverage, differences in implementation and supervision mechanisms.

NIS2 was prepared in response to these needs.

Core problems NIS2 focuses on

• Different levels of security maturity across critical sectors
• Cybersecurity risks originating in the supply chain
• Late or inadequate reporting of security incidents
• Insufficient cybersecurity oversight at management level
• Divergent practices between countries
• Growing dependence on cloud and managed service providers
• Ransomware and service disruption risks

NIS2 adopts a risk-based approach that recognises these problems cannot be solved simply by purchasing technology.

2. When Did NIS2 Enter into Force?

The NIS2 Directive entered into force in January 2023.

The deadline set for EU Member States to transpose the Directive into their national legislation was 17 October 2024.

As of 18 October 2024, NIS2 replaced the previous NIS framework.

However, how an EU directive applies in practice must be assessed together with the national legislation and competent authorities of the Member State concerned.

Points to watch as of 2026

Organisations should review the current legislation in the EU country in which they operate.

Registration and notification obligations may be handled through different administrative mechanisms depending on the country.

Supervisory powers and enforcement procedures are made concrete through national legislation.

In January 2026, the European Commission proposed certain targeted amendments to NIS2. Amendments that are only proposals must not be confused with the binding provisions currently in force until they are adopted and enter into force.

Important: An organisation's compliance assessment should be based not only on the text of the Directive but on the national legislation in force in the relevant country.

3. Which Sectors Does NIS2 Cover?

NIS2 addresses different sectors under Annex I and Annex II.

Annex I: Sectors of high criticality

Energy.

Transport.

Banking.

Financial market infrastructures.

Health.

Drinking water.

Waste water.

Digital infrastructure.

ICT service management (business-to-business).

Public administration.

Space.

Annex II: Other critical sectors

Postal and courier services.

Waste management.

Manufacture, production and distribution of chemicals.

Production, processing and distribution of food.

Certain manufacturing activities.

Digital providers.

Research organisations.

From a manufacturing perspective

It should not be assumed that all manufacturing companies automatically have the same status under NIS2.

The relevant manufacturing sub-sector, the size of the organisation, the services it provides and the national legislation must all be assessed.

4. What Are Essential Entities and Important Entities?

Under NIS2, organisations are classified, according to certain conditions, as Essential Entities and Important Entities.

This distinction matters particularly for the supervisory approach and the enforcement mechanisms.

Criterion	Essential Entities	Important Entities
General approach	Organisations of higher criticality	Other important organisations within scope
Supervision	Proactive (ex ante) and reactive (ex post) supervisory powers	Generally a reactive (ex post) supervisory approach
Risk management	Article 21 obligations	Article 21 obligations
Incident reporting	Article 23 obligations	Article 23 obligations
Penalties	Maximum limits specific to the relevant category	Maximum limits specific to the relevant category

An important distinction

Essential or Important status is not determined by looking at the sector name alone.

The size of the organisation, its activities and the specific classification provisions set out in the Directive are taken into account.

For some types of organisation there are special rules that apply regardless of size.

5. How Is Company Size Assessed under NIS2?

NIS2 generally focuses on medium-sized and large organisations operating in the sectors concerned.

However, size criteria alone are not sufficient.

The assessment considers

Number of employees.

Annual turnover.

Balance sheet total.

Relationships with partner and linked enterprises.

Sector of activity.

Criticality of the service provided.

Specific determinations made by the Member State.

Example

When assessing whether a company providing managed security services in the EU falls within the scope of NIS2, not only the number of employees but also the nature of the service and any applicable special provisions must be examined.

Critical point

It cannot be said that all small organisations are automatically out of scope.

The Directive contains cases in which it applies regardless of size.

6. Are Companies in Türkiye Affected by NIS2?

Türkiye is not a member of the European Union.

For this reason, it cannot be said that the NIS2 Directive applies directly and generally to all companies in Türkiye.

That said, companies in Türkiye may encounter NIS2-related obligations for various reasons.

First scenario: Operating in the EU

The services an organisation provides in the EU and its operating structure may be assessed under the NIS2 implementation of the country concerned.

Second scenario: A subsidiary in the EU

The EU subsidiary of a group headquartered in Türkiye may fall within scope.

Third scenario: Supplier relationships

A customer in the EU that is within the scope of NIS2 may require its supplier to meet contractual security obligations.

Fourth scenario: Managed services

Organisations that qualify as an MSP or MSSP and operate in the EU market may require a specific assessment.

Example

A company that develops software in Türkiye provides services to a critical infrastructure operator in the EU.

The customer may set requirements in the contract covering security testing, incident reporting, access control and supply chain security.

This does not mean that the supplier in Türkiye is automatically an Essential Entity under NIS2.

Conclusion: For organisations in Türkiye, direct legal scope and contractual security requirements arising from customers should be assessed separately.

7. NIS2 Article 20: Accountability of Senior Management

One of the notable aspects of NIS2 is that it ties cybersecurity risk management to the accountability of senior management.

Under Article 20, the management bodies of the organisations concerned must approve cybersecurity risk-management measures and oversee their implementation.

There are also provisions requiring members of management bodies to receive appropriate training.

Topics that can be addressed at management level

Cybersecurity strategy.

Risk appetite.

Acceptance of critical risks.

Security investments.

Incident response readiness.

Supplier risks.

Business continuity.

Audit results.

Example

The information security team identified a critical gap in access control.

Remediating the risk requires investment.

Management must assess the risk and the recommended measures and make the necessary decisions.

Critical point

NIS2 compliance is not a responsibility that can be completed by handing it over to the IT department alone.

8. NIS2 Article 21: Cybersecurity Risk Management

NIS2 Article 21 requires organisations within scope to take appropriate and proportionate technical, operational and organisational cybersecurity risk-management measures.

The measures must be assessed according to the risks the organisation is exposed to, its size, the likely impact of incidents and other applicable conditions.

Core measure areas under Article 21

Area	Implementation example
Risk analysis and security policies	Enterprise risk methodology
Incident handling	SOC, response procedures
Business continuity and crisis management	Backup, disaster recovery
Supply chain security	Supplier risk assessment
Secure system development and maintenance	Secure SDLC, vulnerability management
Assessing the effectiveness of measures	Control testing and audits
Cyber hygiene and training	Awareness, baseline security controls
Cryptography	Encryption and key management
Human resources and access security	IAM, asset management
MFA and secure communications	Appropriate authentication and communication controls

Key point

Article 21 is not a product list that mandates the use of a single brand or technology.

Security measures must be implemented on a risk basis and in a demonstrable way.

9. How Is a NIS2 Risk Analysis Carried Out?

Risk analysis starts with the organisation understanding its critical services and the systems that support them.

Step 1: Identifying critical services

Which services are important to customers or to society?

Which services, if disrupted, could cause serious impact?

Step 2: Asset inventory

Servers.

Applications.

Databases.

Cloud systems.

Network devices.

OT systems.

Third-party connections.

Step 3: Threat analysis

Ransomware.

Credential theft.

Supplier breach.

DDoS.

Insider threats.

Misconfigurations.

Step 4: Impact assessment

Service disruption.

Financial loss.

Customer impact.

Legal consequences.

Operational damage.

Step 5: Risk treatment

Risk reduction.

Risk avoidance.

Risk sharing.

Justified risk acceptance.

Example risk record

Field	Example
Critical service	Cloud-based customer application
Threat	Compromise of an administrator account
Vulnerability	Lack of MFA
Impact	Service disruption and data access
Control	Phishing-resistant MFA, PAM, monitoring
Owner	IT and information security
Verification	Access testing and log review

10. Incident Management under NIS2

NIS2 requires organisations not only to detect cybersecurity incidents but also to respond to them appropriately.

Stages of incident management

Preparation.

Detection.

Analysis.

Classification.

Response.

Recovery.

Notification.

Post-incident review.

Example

Ransomware activity is detected in an organisation's critical application.

The SOC team verifies the alert.

The response team identifies the affected systems.

The business continuity team assesses the impact on the service.

The legal and compliance teams review the NIS2 notification requirements.

Senior management is informed.

Critical point

Not every security alert is a significant incident subject to notification under NIS2.

The incident must be assessed against the significance criteria in the relevant legislation.

11. What Are the NIS2 Incident Reporting Deadlines?

NIS2 Article 23 provides for a staged reporting approach for significant incidents.

Reporting timeline

Stage	General deadline	Purpose
Early warning	Within 24 hours of becoming aware at the latest	To make the competent authority aware of the incident
Incident notification	Within 72 hours of becoming aware at the latest	Initial assessment of impact and severity
Intermediate report	Upon request by the competent authority	Sharing the current status
Final report	Within one month of the 72-hour incident notification at the latest	Detailed assessment of the incident

Special cases

Different reporting conditions may apply to certain trust service providers.

If the incident is still ongoing at the final report stage, a progress report and a later final report may be required.

Critical point

The 24-hour and 72-hour deadlines do not mean that all cybersecurity incidents must be reported automatically.

The definition of a significant incident and the implementation in the relevant country must be taken into account.

12. How Is a Significant Incident Determined under NIS2?

Under NIS2 Article 23, criteria such as severe operational disruption of services, financial loss, or considerable damage to other natural or legal persons are assessed in deciding whether an incident is significant.

Example indicators

Unavailability of a critical service.

A significant number of customers affected.

Severe operational disruption.

High financial impact.

Cross-border impact.

Considerable material or non-material damage.

Example

A short-lived security alert with limited impact may fall outside the scope of reporting after the necessary review.

By contrast, an attack that seriously disrupts a critical service may require notification.

Key point

For certain digital service providers, Implementing Regulation 2024/2690 sets out the criteria for significant incidents in more detail.

13. How Is a 24-Hour Early Warning Prepared?

The purpose of the early warning is to inform the competent authority about a significant incident without waiting for all technical details to be completed.

Information that can be considered in preparation

Time the incident was detected.

Affected service.

Initial incident classification.

Suspected malicious activity.

Possible cross-border impact.

Status of the initial response.

Example

Unauthorised access is detected on the critical management platform of a managed service provider.

Initial analysis suggests that some customer services may have been affected.

The organisation quickly assesses whether the incident meets the significant-incident criteria and starts the applicable notification process.

Critical point

The early warning is not designed to wait for the final forensic report to be prepared.

14. How Is a 72-Hour Incident Notification Prepared?

The incident notification updates the information obtained after the early warning.

Content examples

Initial technical assessment of the incident.

Affected systems.

Impact on the service.

Severity of the incident.

Indicators of compromise, if known.

Initial measures taken.

Technical evidence

Security logs.

SIEM alerts.

EDR records.

Network traffic.

System timeline.

Key point

Evidence integrity must be preserved while preparing the notification, and unverified information must not be presented as a definitive finding.

15. Is a SOC Service Mandatory for NIS2?

NIS2 does not explicitly require all organisations to purchase a specific commercial SOC service.

However, appropriate capabilities must be established for detecting, analysing and responding to security incidents.

Contributions a SOC can make

Centralised security monitoring.

Event correlation.

Threat detection.

Alert prioritisation.

Incident escalation.

Response coordination.

Reporting.

When can 24/7 monitoring be considered?

If critical services run without interruption.

If the impact of an incident is high.

If rapid response to attacks is required.

If there are contractual or sectoral requirements.

Conclusion

A SOC is one of the important operational capabilities that support NIS2 risk management; however, it does not by itself deliver regulatory compliance.

16. How Does a SIEM Support NIS2 Compliance?

SIEM systems can centrally evaluate event logs collected from different security sources.

Log sources

Firewall.

VPN.

Active Directory.

Servers.

Cloud infrastructures.

EDR.

Databases.

Critical applications.

Example correlation

An administrator account logs in from an unusual country.

Privileged access is then performed.

Shortly afterwards, a high-volume data transfer is observed.

If suitable use cases have been defined, the SIEM can correlate these activities.

Key point

Collecting logs alone is not sufficient.

Log integrity, time synchronisation, alert quality and incident response processes must also be assessed.

17. NIS2 and Supply Chain Security

Supply chain security is one of the core risk-management areas under NIS2 Article 21.

Organisations are expected to assess the security risks in their relationships with their direct suppliers and service providers.

Example suppliers

Cloud providers.

Software developers.

MSP and MSSP organisations.

Data centre service providers.

Network service providers.

Industrial automation suppliers.

Assessment topics

The supplier's security maturity.

Data access.

Remote access methods.

Subcontractors.

Reporting of security incidents.

Business continuity.

Service termination.

Example

The remote maintenance provider of an energy company has access to OT systems.

This access must be assessed in terms of authentication, session recording, authorisation and access duration.

18. What Should NIS2 Supplier Contracts Contain?

Contractual security provisions help manage supplier risks.

Example headings

Security responsibilities.

Access control.

Confidentiality.

Incident reporting obligations.

Subcontractor management.

Security testing.

Audit rights.

Data return and destruction.

Service continuity.

Example approach

A contractual process can be created requiring a critical service provider to inform its customer without delay when it detects a security incident.

Critical point

The notification deadline in a supplier contract and the organisation's own NIS2 notification to the competent authority are separate obligations.

The processes should be designed so that they support each other.

19. NIS2 and Vulnerability Management

Vulnerability management covers identifying, prioritising and remediating security weaknesses in systems.

Process

Asset discovery.

Vulnerability detection.

Risk assessment.

Prioritisation.

Remediation.

Re-verification.

Prioritisation criteria

Technical severity of the vulnerability.

Information on active exploitation.

Whether the system is exposed to the internet.

Impact on critical services.

Existing compensating controls.

Example

An internet-facing VPN appliance has a critical vulnerability that is being actively exploited.

This risk must be assessed not only by its CVSS score but together with its accessibility and business impact.

20. Penetration Tests under NIS2

Penetration tests can support the assessment of the effectiveness of security controls.

Example test areas

External network.

Internal network.

Web applications.

Mobile applications.

API.

Active Directory.

Cloud infrastructure.

Wireless network.

OT systems.

Example

An authorisation vulnerability is found in a critical customer portal.

The finding is fed into the risk management process.

The fix is applied.

A retest is performed.

Critical point

NIS2 does not contain a general schedule prescribing the same scope and frequency of penetration testing for all organisations.

Tests should be planned according to risks and any applicable specific requirements.

21. NIS2 and Secure Software Development

NIS2 covers security measures relating to the acquisition, development and maintenance of network and information systems.

Secure development practices

Security requirements.

Threat modelling.

Secure coding.

Source code analysis.

Dependency security.

Security testing.

Change management.

Example

An organisation develops in-house the software that delivers its critical service.

Requirements for authentication, access control and secure data handling must be addressed during the development phase.

Key point

SAST, DAST and SCA tools can support secure development processes.

However, using these tools alone does not satisfy all NIS2 obligations.

22. NIS2 and Business Continuity

NIS2 treats business continuity and crisis management as part of its risk-management measures.

Core components

Business impact analysis.

Identifying critical services.

Recovery priorities.

Backup.

Disaster recovery.

Crisis communication.

Exercises.

RTO and RPO

RTO: The target recovery time of the service.

RPO: The acceptable data loss target.

Example

A critical application of a healthcare organisation becomes unavailable.

The business continuity plan must already define an alternative way of working and recovery priorities.

Critical point

Taking a backup is not the same as being able to recover successfully from it.

Restore tests must be carried out.

23. The NIS2 Approach to Ransomware

Ransomware attacks can cause service disruption, data loss and operational damage.

Defence layers

MFA.

EDR/XDR.

Network segmentation.

Patch management.

Privileged access management.

Secure backup.

Incident monitoring.

Response exercises.

Example

An attacker uses a compromised administrator account to try to reach the backup systems.

Privileged access controls, network separation and a secure backup architecture can reduce the impact of the incident.

Key point

Ransomware defence should not rely on a single security product.

24. NIS2 and Cloud Security

Cloud services matter under NIS2 both as critical supplier relationships and in respect of certain provider categories.

Assessment areas

Cloud asset inventory.

Identity and access management.

Configuration security.

Logging.

Encryption.

Backup.

Incident management.

Supplier responsibilities.

Example

An organisation runs its critical customer service on a cloud platform.

The cloud provider's security responsibilities must be distinguished from the customer's responsibilities for configuration and access security.

Critical point

The fact that a cloud provider holds security certifications does not remove the customer's security obligations for its own systems.

25. NIS2 and Managed Security Services

Under NIS2, Managed Service Providers and Managed Security Service Providers are of particular importance.

What is an MSP?

It refers to organisations that provide services relating to the installation, operation, management or maintenance of customers' information technology systems.

What is an MSSP?

It refers to managed security service providers that offer services for managing cybersecurity risks.

Example services

SOC.

MDR.

SIEM management.

Security monitoring.

Security operations.

Management of security systems.

Key point

Whether an organisation is regarded as an MSP or MSSP depends on the nature of the services it actually provides and on the applicable legislation.

The mere presence of the words cybersecurity in a company name is not sufficient.

26. What Is EU Implementing Regulation 2024/2690?

Commission Implementing Regulation (EU) 2024/2690 sets out more detailed technical and methodological requirements under NIS2 for certain digital infrastructure, ICT service management and digital service providers.

Examples of the types of organisation concerned

DNS service providers.

Top-level domain name registries.

Cloud computing providers.

Data centre providers.

Content delivery network providers.

MSP.

MSSP.

Online marketplace providers.

Search engine providers.

Social networking platform providers.

Trust service providers.

Technical areas of application

Risk management.

Security policies.

Incident management.

Business continuity.

Supplier security.

Access control.

Asset management.

System security.

Critical point

Regulation 2024/2690 is not a general catalogue of technical controls applied in the same way to all sectors under NIS2.

The types of organisation to which it applies must be verified separately.

27. What Does the ENISA NIS2 Technical Guidance Provide?

In June 2025, ENISA published NIS2 technical implementation guidance for certain types of organisation.

This guidance contains explanations on implementing the security measures under Regulation 2024/2690.

Contributions the guidance can make

Understanding control requirements.

Technical implementation examples.

Evidence examples.

Control mappings.

Current-state analysis.

Improvement planning.

Key point

The ENISA technical guidance is a useful implementation resource.

However, it does not replace the binding legal texts and the relevant national legislation.

28. The Relationship between NIS2 and ISO/IEC 27001

ISO/IEC 27001 is the international standard for establishing and continually improving an information security management system.

NIS2, on the other hand, creates legal obligations for certain organisations.

Common areas

Risk management.

Security policies.

Access control.

Incident management.

Business continuity.

Supplier security.

Security audits.

Example mapping

NIS2 requirement	Related ISO 27001 approach
Risk management	ISMS (Information Security Management System) risk assessment
Incident management	Information security incident management
Supplier security	Supplier security controls
Access control	Identity and authorisation management
Business continuity	Information security during disruption
Control effectiveness	Internal audit and performance evaluation

Critical point

Holding an ISO 27001 certificate does not mean automatic compliance with NIS2.

NIS2-specific scope, management accountability, and registration and reporting obligations must be assessed separately.

29. The Relationship between NIS2 and IEC 62443

IEC 62443 is a family of standards for the security of industrial automation and control systems.

NIS2, in turn, regulates the cybersecurity obligations of organisations in certain sectors.

Common areas

Industrial risk management.

Network segmentation.

Access security.

Incident management.

Supplier security.

Secure product development.

Business continuity.

Example

If an energy operator is within the scope of NIS2, it must put in place appropriate security measures for its OT systems.

The IEC 62443-3-2 and 3-3 approaches can support the assessment of industrial system risks and security requirements.

For manufacturers

IEC 62443-4-1 and 4-2 can be useful for the secure development of industrial products and the assessment of their technical security capabilities.

Critical point

Conformity with IEC 62443 does not mean that all of NIS2's legal and administrative obligations have been met.

30. The Difference between NIS2 and GDPR

NIS2 and GDPR are different pieces of legislation.

Topic	NIS2	GDPR
Core objective	Cybersecurity of network and information systems	Protection of personal data
Main approach	Cybersecurity risk management	Data protection and data subject rights
Incident reporting	Significant cybersecurity incidents	Personal data breaches that meet the notification conditions
Organisational scope	Certain sectors and organisations	Data processing activities within its scope of application
Core technical areas	Cyber resilience	Personal data security

Example

A ransomware attack may both have halted a critical service and caused a personal data breach.

In that case, the NIS2 and GDPR notification obligations must be assessed separately.

Key point

A notification made under one regulation may not automatically satisfy the obligation under the other.

31. How Are NIS2 Audits Carried Out?

Under NIS2, supervisory and enforcement powers are applied according to the organisation's classification and the relevant national legislation.

Evidence that may be assessed

Risk assessment reports.

Security policies.

Incident response records.

Training records.

Supplier assessments.

Penetration test reports.

Vulnerability management records.

Business continuity exercises.

Management decisions.

The Essential and Important distinction

More comprehensive proactive and reactive supervisory mechanisms are envisaged for Essential Entities.

For Important Entities, the general approach is reactive supervision.

Critical point

The scope and methods of supervision should be assessed within the framework of the competent authority and the national legislation of the Member State concerned.

32. What Are the NIS2 Fines?

NIS2 provides for high maximum administrative fines for certain infringements.

Essential Entities

There is a maximum-fine provision whose minimum ceiling is based on EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.

Important Entities

There is a maximum-fine provision whose minimum ceiling is based on EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher.

Important clarification

These figures are not fixed fines applied automatically for every infringement.

The Directive contains minimum requirements concerning the maximum penalty framework that Member States are to set.

The actual penalty depends on the nature of the infringement, the category of the organisation, national legislation and the relevant assessments.

33. Board Reporting in NIS2 Compliance

Measurable reporting processes should be established so that cybersecurity risks can be monitored at management level.

Example indicators

Number of open critical vulnerabilities.

Proportion of high-risk assets.

MFA coverage rate.

Incident detection time.

Incident response time.

Backup restore success.

Critical supplier assessment rate.

Number of overdue corrective actions.

Example management report

Indicator	Example target
MFA on critical systems	100%
Critical supplier assessment	100%
Restore testing of critical backups	All planned tests
High-risk findings	Closed within the defined risk timeframe
Incident response exercise	Within the annual plan

These targets are examples; they are not mandatory numerical thresholds that NIS2 sets for all organisations.

34. The Most Common Mistakes in NIS2 Compliance

1. Not performing a scope assessment

The obligations the organisation is actually subject to must be determined.

2. Treating NIS2 as merely ISO 27001

Legal and sectoral obligations must be assessed separately.

3. Not creating an incident reporting plan

Significant-incident criteria and reporting processes must be defined.

4. Neglecting management accountability

Senior management oversight must be ensured.

5. Not assessing supplier security

Critical third-party relationships must be included in the risk analysis.

6. Buying technology alone

Security processes and responsibilities must be established.

7. Not updating the risk inventory

New threats and system changes must be assessed.

8. Not testing business continuity

Recovery capabilities must be verified.

9. Not collecting audit evidence

Implemented controls must be backed by records.

10. Ignoring differences in national legislation

The current practices of EU Member States must be reviewed.

35. How Is a NIS2 Gap Analysis Performed?

A gap analysis compares the organisation's current cybersecurity practices with the applicable NIS2 obligations.

Step 1: Legal scope

The organisation's activities are identified.

The relevant country and sector are assessed.

Essential or Important status is examined.

Step 2: Current security posture

Policies.

Risk analyses.

Technical controls.

Incident management.

Supplier processes.

Step 3: Requirements mapping

Article 20.

Article 21.

Article 23.

Applicable national provisions.

Relevant implementing regulations.

Step 4: Gap report

Missing controls.

Partially implemented controls.

Evidence gaps.

Priority risks.

Step 5: Roadmap

Action.

Owner.

Priority.

Target date.

Verification method.

36. Documents That Can Be Prepared for NIS2 Compliance

Management

Cybersecurity policy.

Management responsibility matrix.

Risk appetite approach.

Management review records.

Risk management

Asset inventory.

Risk assessment report.

Risk treatment plan.

Control inventory.

Operations

Incident response plan.

Incident reporting procedure.

Business continuity plan.

Disaster recovery plan.

Supplier management

Supplier inventory.

Risk assessment records.

Security contract addenda.

Supplier monitoring reports.

Technical security

Vulnerability reports.

Penetration test reports.

Access review records.

Security monitoring reports.

Key point

Preparing documents alone is not sufficient.

The defined processes must be implemented and their effectiveness verified.

37. A 90-Day Sample NIS2 Compliance Roadmap

Days 1–15: Scope and Current State

The legal scope is assessed.

The relevant country regulations are identified.

Critical services are defined.

Existing security controls are reviewed.

Days 16–30: Risk Analysis

The asset inventory is reviewed.

Threat scenarios are identified.

Risks are assessed.

Priority improvements are planned.

Days 31–50: Technical Controls

Access control.

MFA.

Vulnerability management.

Logging.

Security monitoring.

Backup.

Days 51–65: Incident and Supplier Management

Incident reporting processes are established.

Supplier risks are assessed.

Business continuity plans are updated.

Days 66–80: Testing and Validation

Security tests are carried out.

An incident response exercise is held.

Recovery processes are verified.

Days 81–90: Management Review

Gaps are reported.

Corrective actions are planned.

Management is informed.

Monitoring mechanisms are established.

Important clarification

The 90-day plan is a sample starting roadmap.

It does not constitute a guarantee of full legal compliance or certification.

38. NIS2 Compliance Checklist

Scope

• Has the relevant sector been identified?
• Have activities in EU countries been assessed?
• Has Essential or Important status been examined?
• Have national legislative obligations been identified?

Management

• Have cybersecurity responsibilities been defined?
• Is management oversight in place?
• Has management training been considered?

Risk management

• Have critical services been identified?
• Is there an asset inventory?
• Has a risk analysis been carried out?
• Has a risk treatment plan been created?

Technical security

• Has access control been assessed?
• Has MFA implementation been assessed?
• Is vulnerability management being carried out?
• Are security logs being monitored?
• Are security controls being tested?

Incident management

• Is there an incident response plan?
• Have significant-incident criteria been defined?
• Have those responsible for reporting been designated?
• Have the 24-hour and 72-hour reporting processes been planned?

Business continuity

• Are there recovery plans for critical services?
• Have backup processes been assessed?
• Are restore tests being carried out?

Supplier security

• Have critical suppliers been identified?
• Have supplier risks been assessed?
• Have contractual security obligations been reviewed?

Audit

• Are evidence records being kept?
• Is control effectiveness being evaluated?
• Are gaps being tracked?

39. SECURESYS NIS2 Compliance Advisory

SECURESYS provides advisory and security services that help organisations assess the technical and organisational cybersecurity requirements that may arise under NIS2.

NIS2 Technical Gap Analysis

Existing cybersecurity controls are compared against the identified requirements.

Cybersecurity Risk Assessment

Critical services, assets, threats and existing security controls are assessed.

SOC and SIEM Services

Monitoring and detection of security events, and support for response processes, can be provided.

Penetration Tests

Security tests can be carried out on web, mobile, API, internal network, external network and other relevant systems.

Source Code Analysis

Secure development and source code security processes for critical software can be supported.

Supplier Security

Third-party access and technical security requirements can be assessed.

Incident Response Readiness

Incident response procedures, reporting workflows and exercise processes can be planned.

ISO 27001 and IEC 62443 Integration

Technical mappings can be built between NIS2 requirements and corporate information security management and industrial security processes.

In the SECURESYS approach, NIS2 compliance is treated not merely as checking regulatory articles, but as reducing the organisation's real cybersecurity risks and operating controls in a sustainable way.

Direct legal scope and interpretations of the legislation should be assessed together with experts competent in the law of the country concerned.

Frequently Asked Questions (FAQ)

1. What is NIS2?

It is the directive that regulates cybersecurity risk management, incident reporting and supervision obligations for certain critical and important organisations in the European Union.

2. Which sectors does NIS2 cover?

It covers energy, transport, health, digital infrastructure, ICT service management, certain manufacturing activities and other relevant sectors.

3. Is NIS2 mandatory for companies in Türkiye?

There is no general direct obligation for all companies in Türkiye. EU activities and contractual relationships must be assessed separately.

4. When did NIS2 enter into force?

It entered into force in January 2023. The deadline for Member States to transpose it into national law was 17 October 2024.

5. What is an Essential Entity?

It refers to organisations classified as essential entities under NIS2 according to certain conditions.

6. What is an Important Entity?

It refers to the relevant organisations that fall within the scope of NIS2 but are not classified as Essential Entities.

7. Is ISO 27001 mandatory for NIS2?

NIS2 does not set an ISO 27001 certificate as a general requirement for all organisations. ISO 27001 can support compliance work.

8. Is a SOC mandatory for NIS2?

Purchasing a specific commercial SOC service is not a general requirement. Appropriate incident detection and response capabilities must be established.

9. What is the NIS2 incident reporting deadline in hours?

For significant incidents, the general approach is an early warning within 24 hours of becoming aware and an incident notification within 72 hours.

10. When is the NIS2 final report prepared?

The general rule is that the final report is submitted within one month of the 72-hour incident notification at the latest. There are special provisions for ongoing incidents.

11. Which technical measures does NIS2 require?

It covers risk management, incident management, access control, secure development, business continuity and other appropriate security measures.

12. Is a penetration test required under NIS2?

Security tests can support the assessment of control effectiveness. Their scope and frequency are determined according to risks and applicable requirements.

13. Does NIS2 cover supplier security?

Yes. Supply chain security falls within Article 21.

14. Are NIS2 and GDPR the same?

No. NIS2 focuses on cybersecurity resilience, while GDPR focuses on the protection of personal data.

15. Can NIS2 and IEC 62443 be applied together?

Yes. IEC 62443 can support meeting the security requirements of OT/ICS systems in particular.

16. How large is the NIS2 fine?

The Directive sets different minimum maximum-fine thresholds for Essential and Important entities. Actual penalties depend on national legislation.

17. Does NIS2 hold the management body liable?

Yes. Article 20 contains provisions requiring management bodies to approve cybersecurity risk-management measures and oversee their implementation.

18. What does NIS2 advisory cover?

It can cover scope assessment, technical gap analysis, risk management, control development, incident response readiness and organising audit evidence.

19. How long does NIS2 compliance take?

It varies according to the organisation's size, its existing security maturity, its activities and the requirements of the country concerned.

20. Is there a NIS2 compliance certificate?

NIS2 does not create a single general certification requirement for all organisations. Conformity and audit requirements should be assessed according to the relevant legislation and, where they exist, sectoral schemes.

Conclusion: What Approach Should Be Taken to NIS2 Compliance?

NIS2 is one of the European Union's key pieces of legislation aimed at strengthening cybersecurity resilience.

For a successful compliance programme, the organisation's legal scope must first be determined.

The national legislation of the relevant Member State must be assessed.

Critical services and assets must be defined.

A cybersecurity risk analysis must be carried out.

Technical and organisational measures appropriate to the risks must be implemented.

Incident detection, response and reporting processes must be established.

Supplier security must be managed.

Business continuity and recovery capabilities must be tested.

Senior management oversight must be ensured.

The effectiveness of controls must be evaluated regularly.

The core purpose of NIS2 compliance is not merely to meet regulatory requirements, but to build a measurable and sustainable security management that increases the resilience of critical services against cyberattacks.

Official Sources and References

NIS2 Directive – Directive (EU) 2022/2555: https://eur-lex.europa.eu/eli/dir/2022/2555/oj

European Commission – NIS2 Policy: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

Commission Implementing Regulation (EU) 2024/2690: https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj

ENISA – NIS2 Technical Implementation Guidance: https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance

ISO/IEC 27001: https://www.iso.org/standard/27001

IEC – International Electrotechnical Commission: https://www.iec.ch