Question 1

What is the NIS2 Directive?

Accepted Answer

NIS2 (Directive 2022/2555) is the EU directive on measures for a high common level of cybersecurity, replacing the original NIS Directive from 2016. It entered into force on 16 January 2023 and EU member states had until 17 October 2024 to transpose it into national law. NIS2 significantly expands the scope of organisations covered, introduces stricter security requirements, harmonises incident reporting timelines across the EU, and strengthens enforcement with fines of up to 10 million euros or 2% of worldwide annual turnover for essential entities. It covers 18 sectors spanning energy, transport, banking, health, digital infrastructure, and more.

Question 2

Who must comply with NIS2?

Accepted Answer

NIS2 applies to two categories of organisations. Essential entities include energy providers, transport operators, banking and financial market infrastructure, health sector organisations, drinking water and wastewater operators, digital infrastructure providers (DNS, TLD, cloud, data centres, CDNs), ICT service management (B2B), public administration, and space operators. Important entities include postal and courier services, waste management, chemical manufacturers, food producers, medical device manufacturers, digital providers (online marketplaces, search engines, social networks), and research organisations. The directive applies to medium-sized enterprises (50+ employees or 10M+ turnover) and above in these sectors, plus certain small entities providing critical services.

Question 3

What are the NIS2 incident notification deadlines?

Accepted Answer

NIS2 establishes a three-stage incident notification process for significant incidents. First, an early warning must be submitted to the national CSIRT or competent authority within 24 hours of becoming aware of the incident, indicating whether it is suspected to be caused by unlawful or malicious acts and whether it could have cross-border impact. Second, an incident notification with an initial assessment must be provided within 72 hours, including severity, impact, and indicators of compromise where available. Third, a final report must be submitted within one month of the incident notification, containing a detailed description, root cause analysis, mitigation measures applied, and cross-border impact. Venvera tracks all three deadlines automatically.

Question 4

What security measures does NIS2 require?

Accepted Answer

NIS2 Article 21 requires organisations to implement at least ten categories of cybersecurity risk management measures: risk analysis and information system security policies, incident handling procedures, business continuity and crisis management, supply chain security including security-related aspects of relationships with direct suppliers, security in network and information system acquisition and development, policies and procedures to assess the effectiveness of cybersecurity measures, basic cyber hygiene practices and cybersecurity training, policies on the use of cryptography and encryption, human resources security with access control policies and asset management, and the use of multi-factor authentication or continuous authentication solutions. Venvera maps your existing controls to each of these ten requirements and identifies gaps.

Question 5

What is NIS2 Article 20 management accountability?

Accepted Answer

NIS2 Article 20 requires that the management bodies of essential and important entities approve the cybersecurity risk management measures taken by the organisation, oversee their implementation, and can be held liable for infringements. Management body members must undergo training to gain sufficient knowledge and skills to identify risks and assess cybersecurity risk management practices. This means board directors and C-level executives have personal accountability for cybersecurity. Organisations must be able to demonstrate that their leadership has formally approved security policies, received cybersecurity training, and actively oversees the implementation of security measures.

Question 6

How does NIS2 apply to financial institutions already subject to DORA?

Accepted Answer

Financial entities that fall under DORA (banks, insurers, investment firms, payment providers) are subject to DORA as the sector-specific lex specialis for ICT risk management and operational resilience. Where DORA provides requirements that are at least equivalent to those in NIS2, the DORA provisions apply. However, NIS2 still sets the baseline and financial entities remain within the NIS2 ecosystem for cross-sector coordination, information sharing, and supervisory cooperation. In practice, complying with DORA will satisfy most NIS2 requirements, but organisations should verify coverage of any NIS2-specific measures not explicitly addressed by DORA. Venvera maps controls across both frameworks so you can see exactly where overlap exists and where gaps remain.

Question 7

What are the penalties for NIS2 non-compliance?

Accepted Answer

NIS2 introduces significant penalties differentiated by entity type. Essential entities face fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. Important entities face fines of up to 7 million euros or 1.4% of total worldwide annual turnover, whichever is higher. Beyond financial penalties, competent authorities can impose non-monetary remedies including binding instructions, implementation orders, security audit orders, threat notification orders to customers, and temporary suspension of certifications or authorisations. Management body members can also be held personally liable and face temporary bans from exercising managerial functions.

Question 8

Is there compliance software for NIS2?

Accepted Answer

Yes. Venvera is NIS2 compliance software covering the ten Article 21 measures, the incident-notification deadlines and the supply-chain and management-accountability obligations. It gives you a scoped control set, a gap assessment that scores your readiness for your national authority, and an evidence workspace behind every measure. Because it maps controls across frameworks, the evidence you already hold for ISO 27001 pre-populates much of your NIS2 posture. Start with a free gap report before committing.

Domain	NIST SP 800-53	NIS2
Encryption	SC-13Cryptographic Protection SC-28Protection of Information at Rest SC-8Transmission Confidentiality and Integrity	Art. 21(2)(h)Are policies and procedures in place governing the use of cryptography, including encryption standards for data at rest and in transit?
Key Management	SC-12Cryptographic Key Establishment and Management	Art. 21(2)(h)Are cryptographic key management procedures documented, covering key generation, distribution, storage, rotation, and destruction?
Access Control	AC-3Access Enforcement AC-6Least Privilege	Art. 21(2)(i)Is there a formal access control policy enforcing least privilege principle, with documented procedures for access provisioning and de-provisioning?
Identity Management	AC-2Account Management IA-4Identifier Management	Art. 21(2)(i)Is there a formal access control policy enforcing least privilege principle, with documented procedures for access provisioning and de-provisioning?
Authentication & MFA	IA-2Identification and Authentication (Organizational Users) IA-5Authenticator Management	Art. 21(2)(j)Is multi-factor authentication or continuous authentication deployed for access to critical systems, remote access, and privileged accounts?
Access Rights Review	AC-2Account Management	Art. 21(2)(i)Are access rights reviewed regularly (at least annually) and recertified, with privileged access subject to enhanced controls and monitoring?
Privileged Access Management	AC-6Least Privilege AC-5Separation of Duties	Art. 21(2)(i)Are access rights reviewed regularly (at least annually) and recertified, with privileged access subject to enhanced controls and monitoring?
Network Security	SC-7Boundary Protection AC-17Remote Access	Art. 21(2)(g)Are basic cyber hygiene practices established and enforced, including patching, password policies, device management, and network segmentation?
Vulnerability Management	RA-5Vulnerability Monitoring and Scanning SI-2Flaw Remediation	Art. 21(2)(e)Is there a vulnerability handling and disclosure process that ensures timely identification, assessment, and remediation of vulnerabilities?
Logging & Monitoring	AU-2Event Logging AU-6Audit Record Review, Analysis, and Reporting AU-12Audit Record Generation SI-4System Monitoring	Art. 21(2)(f)Are security metrics and KPIs defined, tracked, and reported to management to measure the effectiveness of cybersecurity controls?
Incident Management	IR-4Incident Handling	Art. 21(2)(b)Is there a documented incident handling procedure covering detection, analysis, containment, eradication, and recovery phases?
Incident Classification	IR-5Incident Monitoring	Art. 23(3)Are incident classification criteria documented, distinguishing significant incidents based on impact on service provision, affected users, duration, and geographic scope?
Incident Reporting	IR-6Incident Reporting	Art. 23(4)(a)–(b)Can your organisation submit an early warning to the CSIRT within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident?
Incident Response Team	IR-8Incident Response Plan	Art. 21(2)(b)Is there a documented incident handling procedure covering detection, analysis, containment, eradication, and recovery phases?
Post-Incident Review	IR-4Incident Handling	Art. 21(2)(b)Do you perform post-incident reviews for significant incidents, with root cause analysis and lessons learned fed into risk management improvements?
Business Continuity	CP-2Contingency Plan	Art. 21(2)(c)Are business continuity and disaster recovery plans documented, covering all critical services, with defined RTO/RPO targets and tested at least annually?
Backup & Restoration	CP-9System Backup CP-10System Recovery and Reconstitution	Art. 21(2)(c)Are backup procedures implemented with defined scope, frequency, and secure off-site storage, with regular restoration testing?
Crisis Management	CP-4Contingency Plan Testing	Art. 21(2)(c)Is there a crisis management framework with defined escalation procedures, communication plans, and designated crisis management team?
Third-Party Risk Management	SR-2Supply Chain Risk Management Plan	Art. 21(2)(d)Is there a documented supply chain security policy covering ICT product and service procurement, with security requirements for suppliers?
Supplier Due Diligence	SR-6Supplier Assessments and Reviews SA-4Acquisition Process	Art. 21(2)(d)Do you assess the cybersecurity posture and practices of direct suppliers and service providers before entering into agreements?
Supplier Contracts	SR-5Acquisition Strategies, Tools, and Methods PS-7External Personnel Security	Art. 21(2)(d)Do supplier contracts include cybersecurity requirements, incident notification obligations, and audit/assessment rights?
Supplier Monitoring	SR-3Supply Chain Controls and Processes SR-6Supplier Assessments and Reviews	Art. 21(2)(d)Are supply chain risks and supplier cybersecurity performance monitored on an ongoing basis, with periodic re-assessment?
Risk Assessment	RA-3Risk Assessment PM-9Risk Management Strategy	Art. 21(2)(a)Is there a formal, documented risk analysis methodology that identifies and assesses cybersecurity risks to network and information systems?
Information Security Policy	AC-1Policy and Procedures PL-2System Security and Privacy Plans	Art. 21(2)(a)Has the management body approved a comprehensive information security policy covering all network and information systems, reviewed at least annually?
Security Awareness Training	AT-2Literacy Training and Awareness AT-3Role-Based Training	Art. 20(2), Art. 21(2)(g)Is there a cybersecurity awareness and training programme for all staff, including management body members, with regular refresher sessions?
Change Management	CM-3Configuration Change Control	Art. 21(2)(e)Is there a formal change management process for network and information systems that includes security impact assessment and testing?
Secure Development	SA-3System Development Life Cycle SA-8Security and Privacy Engineering Principles	Art. 21(2)(e)Are secure development practices (secure coding guidelines, code review, security testing) applied to in-house and custom-developed software?
Security Testing	SA-11Developer Testing and Evaluation CA-2Control Assessments	Art. 21(2)(f)Are there defined policies and procedures to assess the effectiveness of cybersecurity risk-management measures, including regular security testing?
Penetration Testing	CA-8Penetration Testing	Art. 21(2)(f)Are there defined policies and procedures to assess the effectiveness of cybersecurity risk-management measures, including regular security testing?
Breach Notification	IR-6Incident Reporting SR-8Notification Agreements	Art. 23(4)(a)–(b)Can your organisation submit an early warning to the CSIRT within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident?

Compliance operations

Risk & incidents

Intelligence & reporting

EU financial

Privacy & security

Regional

By industry

By role

Learn

Free tools & offers

Under NIS2, your management is personally liable.

How much of NIS2 do you already have?

NIS2 compliance software for the Article 21 measures and the clocks

What is NIS2, and why is it your board’s problem?

All ten Article 21 measures, in one live register.

A 24-hour incident clock that starts itself.

Find the supplier that takes you down - first.

Prove you can keep running when it breaks.

Cyber hygiene and training, evidenced for the audit.

The evidence that keeps liability off your board.

The spreadsheet or Venvera.

NIS2, answered.

NIS2 guides

Know where you stand on NIS2 before the regulator asks.