Persona 01
In-scope mid-market company
50+ employees, €10m+ turnover, operating in one of the 18 NIS2 sectors.
50+ employees, €10m+ turnover, operating in one of the 18 NIS2 sectors.
Cloud / IT services to EU customers — explicit NIS2 obligations even from outside the EU.
Even if not directly in scope, your customers in scope have third-party obligations that flow down to you.
Determines whether you're an essential entity (Annex I), important entity (Annex II), or out of scope. The line between essential and important materially changes obligations and fines.
NIS2 covers 18 sectors — energy, transport, finance, health, ICT, digital infrastructure, public admin, etc. Each has nuanced application rules.
Article 21 sets 10 cybersecurity measures every in-scope entity must implement. Audit identifies which you have, partially have, or are missing.
24-hour early warning, 72-hour incident notification, monthly intermediate report, final report — built into the workbench.
Which national CSIRT, regulator, and sector-specific authority you report to varies by jurisdiction. The audit maps this for you.
NIS2 explicitly requires senior management approval of cybersecurity risk management. Generates the board pack.
The Network and Information Security Directive 2 (Directive (EU) 2022/2555), known as NIS2, is the EU's expanded cybersecurity directive replacing the original NIS Directive of 2016. Member states were required to transpose it into national law by October 2024 — implementation across member states is now substantially complete.
NIS2 dramatically widens the scope. The original NIS Directive covered roughly 14,000 entities across 7 sectors. NIS2 covers an estimated 110,000+ entities across 18 sectors, with a clear "size-cap" rule: every medium and large entity in scope sectors is included. Penalties can reach €10m or 2% of global turnover for essential entities, €7m or 1.4% for important entities.
The two most operationally significant requirements are the 24-hour incident early-warning to the national CSIRT and the obligation for senior management to approve cybersecurity risk-management measures. The latter is novel — it creates personal liability exposure for board-level decision-makers.
One email when it launches. No newsletter. No marketing sequence.