NIS2 in Mergers and Acquisitions: The 20-Point Due Diligence Checklist to Run Before You Sign
NIS2 never says “merger”. Yet a deal can pull a target into scope on completion day, with no grace period. The 20-point NIS2 M&A due diligence checklist.
-
-
NIS2 CSIRT Reporting Portals: Where to File in All 27 EU Countries — and Why the EU’s Own Directory Still Lists NIS1 Authorities
NIS2 CSIRT reporting portals: the EU’s own directory is unlinked, dated July 2025, and silent on contact hours for 12 of 27 states. Where you actually file.
-
NIS2 Cross-Border Incident Notification: Why You File With One CSIRT, Not Five
Cross-border NIS2 incident? You file with one CSIRT, not five. Article 23(6) puts multi-country notification on your regulator – here is who files what.
-
NIS2 1-Month Final Report: The Clock Starts at Your 72-Hour Filing, and Article 23(4)(d) Asks for Only Four Things
Your NIS2 final-report clock starts when you file the 72-hour notice, not at the incident. Article 23(4)(d)’s four items, three of them unconditional.
-
NIS2 Critical Infrastructure Attack: The 24-Hour Cross-Border Flag Is Your Only Lever on EU Escalation
A cross-border critical infrastructure attack can escalate to EU-CyCLONe under Article 16 and nobody tells you. The real large-scale threshold, explained.
-
NIS2 72-Hour Incident Notification: Article 23(4)(b) Requires Three Things, Not Ten — and 5 Mistakes That Add a Separate Violation
NIS2’s 72-hour notification: Article 23(4)(b) names three elements, two of them conditional. What to file, and how to draft it mid-investigation.
-
NIS2 24-Hour Early Warning: Only Two Facts Are Required — Here’s What to Write
Article 23(4)(a) names just two facts for the NIS2 24-hour early warning. Here’s what to write when you know neither cause nor scope — and what to omit.
-
Your API Breach Is Reportable Under NIS2 Before You Count a Single Record
An API breach under NIS2 is not decided by record count. For most CIR digital providers a maliciously caused compromise is significant on its own facts.
-
NIS2 Incident Classification: The 5 Questions That Settle Significant vs Non-Significant Before the 24-Hour Clock Runs Out
Five questions settle significant vs non-significant under NIS2 Article 23(3) in ten minutes – the test asks what an incident could cause, not what it did.
-
NIS2 OT Incident Reporting: Why the 30-Minute Thresholds Don’t Apply to Your Plant — and What Does
No EU threshold covers your plant. Here’s the real Article 23 significance test for an OT or ICS incident — and why zero downtime can still be reportable.
