Guide

The EU’s 170-page NIS2 guidance says “container” once. Here’s how Article 21 and CIR 2024/2690 really map to containers, Kubernetes and serverless.

NIS2 never defines “qualified auditor” — and the audited entity pays. What Article 32(2) actually says about third-party audits, and how to scope one.

Your CI/CD pipeline is in scope under NIS2 — not just the code it ships. The exact CIR 2024/2690 Annex points covering runners, service accounts and secrets.

NIS2 BYOD: “BYOD” appears zero times in the Directive or CIR 2024/2690. Three Annex 12 points bind personal devices anyway — and CNIL bars full remote wipe.

NIS2 never uses the words remote work. Five provisions reach your staff’s home anyway, and only some of them are binding rather than where appropriate.

NIS2 after an acquisition: your registration update is due in two weeks under Article 3(4). The Day-1 to Day-90 sequence, and how to resolve policy conflicts.

Your cloud migration changes your registered IP ranges, and NIS2 gives you two weeks to tell the regulator. What to do before, during and after cutover.

A 40-person JV can be in NIS2 scope because Annex Article 6(2) adds 50% of each parent’s group data. The partner-vs-linked test, and who is liable.

You have been handed the NIS2 tabletop exercise. Here is the 4-week countdown, the room script, and the record that turns 150 minutes into audit evidence.

NIS2 never says “merger”. Yet a deal can pull a target into scope on completion day, with no grace period. The 20-point NIS2 M&A due diligence checklist.