Ready for NIS2, wherever you operate.
The EU NIS2 Directive raises the bar for cyber security risk management, incident reporting and board accountability. Cybergen helps you confirm whether it applies, find the gaps and build evidence of compliance.
NIS2 Article 23 reporting stages
A broader, tougher EU cyber law
NIS2 (Directive (EU) 2022/2555) replaced the original NIS Directive and expands it to many more sectors and organisations. Each EU member state implements it in national law, so obligations depend on the entity, its sector, its size and where it operates.
In-scope organisations must manage cyber risk with appropriate measures, report significant incidents on tight deadlines and hold their management bodies accountable.
Does NIS2 apply to you?
A simplified first view. Applicability always depends on your exact services and the relevant national law.
Two categories. Different supervision.
Proactive supervision
- Audits, inspections and security scans
- Fines up to €10 million or 2% of global annual turnover, whichever is higher
- Possible temporary management bans
Reactive supervision
- Supervision when there is evidence of non-compliance
- Fines up to €7 million or 1.4% of global annual turnover, whichever is higher
- The same core risk management and reporting duties
Ten risk management measures, mapped to our services
NIS2 sets out minimum measures that in-scope entities must take. Here is how each maps to Cybergen support.
NIS2 readiness, step by step
Applicability and scoping
Confirm whether NIS2 applies, which entity type you are and which EU jurisdictions are relevant.
Gap assessment
Assess your current position against the applicable requirements and national rules.
Remediation plan and evidence tracker
A prioritised plan with owners, plus a tracker for the evidence regulators may ask for.
Incident reporting readiness
Processes and playbooks to meet the 24-hour, 72-hour and one-month reporting stages.
Supply chain and continuity
Assess supplier security and business continuity arrangements.
Board briefings and support
Management training and ongoing implementation support.
A note for UK organisations
A UK-only company is not automatically subject to NIS2 because it does business with Europe. However, it may face NIS2-driven requirements through contracts with in-scope EU customers, and UK organisations with EU operations may be in scope there. UK cyber regulation is developing separately through the Cyber Security and Resilience Bill. We assess applicability for each client.
Does NIS2 apply to UK companies?
Not automatically. It applies to organisations providing in-scope services in the EU. UK companies may be affected through EU operations or contractual requirements from in-scope customers.
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of the notification.
What is the difference between essential and important entities?
Essential entities face proactive supervision and higher maximum fines. Important entities are supervised reactively. Both must meet the risk management and reporting duties.
Are directors personally accountable?
Management bodies must approve and oversee cyber security risk management measures, undertake training and can be held liable for failures under national implementations.
Can ISO 27001 help with NIS2?
Yes. An ISO 27001 management system covers much of what NIS2 expects, although NIS2 has specific requirements such as reporting deadlines that need separate attention.
Get clarity on NIS2.
Tell us where you operate and what you provide. We will help you confirm applicability and plan your next steps.
Thanks, we've received your enquiry
A member of our team will be in touch shortly.