NIS2 Risk of Non-Compliance: Pricing the Wait-and-See Decision When No Fine Data Exists
No EU regulator has published a verifiable NIS2 fine. Price the risk of non-compliance without that number, and see what a 24-month delay actually costs.
-
-
NIS2 Security Awareness ROI: What a 19,500-Employee Trial Says Your Training Budget Buys
A 19,500-employee trial put security awareness training’s effect at 1.7 points. What that means for your NIS2 budget under Article 21(2)(g) and 21(2)(f).
-
NIS2 Long-Term Compliance Programme: 3 Horizons, 36 Months, and the Year-2 Shift From Project to Run Cost
Article 40 puts the Commission on a 36-month cycle. Plan your long-term NIS2 compliance programme in 3 horizons – and why Year 2 is the budget that gets cut.
-
NIS2 Continuous Improvement: The CIR Fixes 4 Review Deadlines and Leaves 38 for You to Justify
CIR 2024/2690 fixes only 4 review deadlines — 3 annual, 1 quarterly. Here are the 38 it leaves blank, and how to set intervals an auditor will accept.
-
NIS2 Certification Doesn’t Exist at EU Level: What EUCC Covers, Why EUCS Stalled, and What Auditors Accept Instead
There is no EU NIS2 certificate. What EUCC actually certifies, why EUCS still issues none, and the single Article 24(2) route to mandatory certification.
-
NIS2 Vendor Risk Scoring: The Four Criteria the Regulation Names — and the Threshold It Leaves to You
NIS2 vendor risk scoring under Article 21(2)(d): the four criteria the regulation names, why weighted averages fail, and where your pass mark legally sits.
-
NIS2 Cloud Shared Responsibility: The Phrase Appears Nowhere in the Directive — Here’s Who Actually Owns IaaS, PaaS, and SaaS
NIS2 never uses the words “shared responsibility”. Here is the real IaaS/PaaS/SaaS split, and the 3-question test for whether your provider is even in scope.
-
NIS2 Programme Governance: All 12 Governance Actions Point at the Board — and the 4 a Steering Committee Can Never Carry
All 12 NIS2 governance actions point at the management board. Four can never be delegated — here is the steering committee charter and RACI for the other eight.
-
NIS2 Compliance Dashboard: 18 Indicators to Track After Go-Live — and Where Each Number Comes From
CIR 2024/2690 already names your dashboard’s six columns. Here are the 18 NIS2 indicators to fill them, their data sources, and who refreshes each.
-
NIS2 Prioritisation Framework: The 10 Article 21 Measures Risk-Scored — and Why Entity Class Changes the Order
NIS2 prioritisation framework: the 10 Article 21 measures scored on audit exposure, incident likelihood and cost – and why entity class changes the order.
