NIS2 Due Diligence: The 3 Factors That Set Your Bar — and the 8 a Regulator Weighs Instead
NIS2 says “due diligence” once — not about suppliers. See the 3 factors that set your bar under Article 21(1), and the 8 a regulator weighs instead.
-
-
The NIS2 Cooperation Group Has No Power Over You — But 3 of Its 19 Tasks Under Article 14 Decide What Your Regulator Asks For
The NIS2 Cooperation Group can’t fine you. But Article 23(11) can turn its 26 May 2026 reporting templates into a mandatory format — the 3 tasks to track.
-
NIS2 Recitals: All 144 Are Non-Binding — and ENISA Still Sends You to 3 of Them to Define Cyber Hygiene
NIS2 has 144 recitals and none are binding. Yet ENISA sends you to three to define “basic cyber hygiene” — the one Article 21 duty with no definition.
-
NIS2 EU-CyCLONe: No Severity Threshold Triggers It — and the Agreed Scale Isn’t Due Until 2027
NIS2 EU-CyCLONe: no severity level triggers Article 16, and the EU’s agreed scale isn’t due until June 2027. What that means for your incident report.
-
NIS2 Has No Force Majeure Clause: What a State-Sponsored Attack Actually Changes Under Articles 21, 23, and 32
Search NIS2 for force majeure and you get zero hits. See what a state-sponsored attack changes under Articles 21, 23 and 32 — and what it never does.
-
NIS2 Single Point of Contact: What Article 8 Requires — and Why It’s Not Your Reporting Address
NIS2 Article 8 makes every Member State name a single point of contact. In 16 of 27 it is also the competent authority — here is who you actually report to.
-
NIS2 Competent Authority vs CSIRT vs Single Point of Contact: Which One Can Fine You
Three national bodies can contact you under NIS2. Only the competent authority can audit, order, or fine you — here is exactly what Articles 32 and 33 let it do.
-
NIS2 CSIRT: The 8 Tasks in Article 11 — and the 2 Services That Only Happen If You Ask
Your NIS2 CSIRT has eight tasks under Article 11(3). Two include services that start only when you ask — how to trigger them, and when it can say no.
-
NIS2 Size Thresholds: Why It Takes 50 Staff — or Both €10M Figures — to Put You In Scope
The NIS2 size threshold is not “50 employees or €10M turnover”. You stop being small at 50 annual work units, or when turnover and balance sheet both top €10M.
-
NIS2 Exemptions: 8 Routes Out of Scope — and Why Only 4 Actually Remove You from the Directive
Eight routes out of NIS2 scope — but only four remove your entity from the Directive. What Article 2(1), 2(7), 2(10) and Article 4 each actually switch off.
