NIS2 Article 20(2) requires every management body member to personally undergo cybersecurity training. Article 21(2)(g) mandates staff awareness programmes. This guide maps both requirements to practical implementation steps.
What does NIS2 require for business continuity? Article 21(2)(c) and CIR 2024/2690 Annex 4 requirements mapped to practical steps for SMEs.
What does NIS2 require for supply chain security? Article 21(2)(d) breakdown, three-tier supplier classification, six mandatory contract clauses from CIR 2024/2690, and a step-by-step monitoring framework.
Step-by-step NIS2 risk assessment guide for SMEs. 5×5 matrix method, threat catalogue, risk register, and worked example for Article 21 compliance.
Last verified: March 2026. Based on ENISA Technical Implementation Guidance v1.0 (June 2025), Commission Implementing Regulation (EU) 2024/2690, and Directive (EU) 2022/2555 (NIS2). In June 2025, the European Union Agency for Cybersecurity (ENISA) published what is arguably the most important…
ISO 27001 covers 70-80% of NIS2 requirements. Learn the key differences, full controls mapping table, and how to close the compliance gap efficiently.
NIS2 Article 23 requires an early warning within 24 hours and a full notification within 72 hours. Miss either deadline and the failure to report is itself a violation. Complete guide to the four-phase NIS2 incident reporting timeline.
NIS2 fines reach €10 million or 2% of global turnover for essential entities — and Article 20 makes directors personally liable. Full breakdown of NIS2 penalties, supervisory measures, and how to protect yourself.
Does NIS2 apply to your organisation? Complete guide to NIS2 scope: 18 sectors, Essential vs Important entities, size thresholds, always-in-scope rules, and a 5-step self-assessment.
Complete NIS2 compliance checklist covering all 7 phases and 59 actionable items — governance, risk assessment, all 10 Article 21 measures, incident management, supply chain, training, and testing. Free PDF download.
