NIS2 compliance guides and resources
NIS2 Article 20 gives management bodies three obligations: approve cybersecurity measures, oversee implementation, and accept personal liability. Here’s what each verb means in practice and what auditors test.
Which NIS2 Article 21 controls cover EU AI Act Annex III requirements — and what remains AI-Act-only. Includes the sector matrix, GPAI supply chain framework, and dual-clock incident protocol.
Could your incident trigger NIS2 reporting? The Art. 23(3) two-limb test, €500K threshold, and exact content for the 24h, 72h, and 1-month reports — in one guide.
NIS1 required ‘appropriate measures.’ NIS2 mandates 10 specific Article 21(2) controls. Diff: scope, incident timelines, penalties, management liability.
Four NIS2 obligations fall outside NIST CSF 2.0’s scope: board liability, entity registration, 24-hour reporting, EU representative. Full function-by-function gap map for US multinationals.
Product manufacturers subject to both NIS2 and the Cyber Resilience Act face dual reporting obligations from September 2026. This guide maps exactly who falls under both regimes, where obligations converge, and how to build one compliance programme.
Five-step NIS2 scope test: Annex I/II sectors, 50+ employees, essential vs important entity class, Art.3(4) group rules, and Art.26 jurisdiction.
Full breakdown of NIS2 Article 32/33 supervisory measures, Article 34 fine maxima, all 8 aggravating/mitigating factors, and a 5-point proportionality framework to cut penalty exposure.
4 NIS2 gaps TISAX can’t close: Article 3(4) registration, Article 23 notification timelines, Article 20 board liability, and CIR 2024/2690 benchmarks. Gap-closing action plan for automotive suppliers.
Which IEC 62443 sub-series covers which Article 21 clause — and where the gaps are. Full mapping for OT teams, plus CIR 2024/2690 applicability.
