NIS2 compliance guides and resources
One medical device cyberattack starts two clocks at two companies: your 24-hour NIS2 early warning and the manufacturer’s 15-day MDR vigilance report.
A cloud provider outage does not transfer your NIS2 duty. Article 23 measures the disruption to your service, not theirs — here is how to run the test.
NIS2 business email compromise: when a BEC is a significant incident, the two-gate test, and the EUR 250,000 vs EUR 500,000 reporting thresholds.
A NIS2 supply chain attack can start your own 24-hour Article 23 clock — but not when you think. The 5 steps from the vendor’s call to a closed file.
Insider data theft with no downtime can still be reportable under NIS2. The two-limb test, CIR 3(1)(b), and what to revoke before the 24-hour clock runs.
Discovering a zero-day does not start NIS2’s 24-hour clock. Exploitation does. The four scenarios, the real disclosure windows, and CRA’s 11 Sept 2026 date.
NIS2 data breach notification: a GDPR breach doesn’t always start the 24-hour CSIRT clock. The four-case trigger test, what each filing needs, who to tell.
DDoS is 76.7% of EU incidents but most stays below threshold. CIR 2024/2690 Articles 5-14 set outage limits of 30 min, 20 min, or none at all.
Archer has no NIS2 module. Here is Article 21(2)(a)-(j) mapped to the Archer use cases you actually license, plus the three measures with no native home.
Ransomware encrypted your systems? The NIS2 24-hour clock already started. What makes it significant, what to file, and what paying a ransom does not discharge.
