How well does your organisation meet NIS2?

Assessment areas

• SCO – Scope, registration and legal framework
  Determine first whether the organisation is an essential or important entity (Annex I / Annex II sector, size-cap rule of Art. 2, designation by a Member State), in which Member State(s) it falls under jurisdiction (Art. 26) and which national transposition law applies. Register with the competent authority within the national deadline and keep registration data current; as of October 2026, 24 Member States have transposed NIS2; Ireland, Spain, France and the Netherlands were referred to the Court of Justice on 8 July 2026, and the Netherlands has since brought its law into force (15/08/2026).
• GOV – Governance and management-body accountability
  Art. 20 makes the management body personally accountable: it must approve the cybersecurity risk-management measures, oversee their implementation and follow regular training. Formalise this through board resolutions, a CISO or equivalent with direct reporting, a RACI covering all Art. 21 measures, and a documented management system that generates evidence for supervisors.
• RSK – Risk analysis and security policies
  Art. 21(2)(a) requires policies on risk analysis and information system security. Adopt an all-hazards risk management framework (Annex 2 of Implementing Reg. 2024/2690 is a good template for every entity), document risk assessments and treatment plans, and review them at least yearly and after significant incidents or major changes.
• INC – Incident handling
  Art. 21(2)(b): a documented incident handling process covering detection, logging and monitoring, event assessment and classification, response, evidence preservation and post-incident review. This process also feeds the Art. 23 reporting clock, so the significance criteria must be embedded in triage.
• BCM – Business continuity, backup and crisis management
  Art. 21(2)(c): business continuity and disaster recovery plans, backup management and crisis management. Define RTO/RPO per critical service, keep offline or immutable backups, test restores and run at least one crisis exercise per year involving the management body.
• SCM – Supply chain security
  Art. 21(2)(d): security of relationships with direct suppliers and service providers, taking into account their vulnerabilities, product quality and secure development practices, and the results of EU coordinated risk assessments (Art. 22). Maintain a supplier register with criticality, embed security clauses in contracts and monitor performance.
• SDV – Secure acquisition, development and vulnerability handling
  Art. 21(2)(e): security in acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. Cover secure development life cycle, configuration and change management, patching, network security and a coordinated vulnerability disclosure (CVD) policy aligned with the national CVD framework (Art. 12) and the Cyber Resilience Act.
• EFF – Assessing the effectiveness of measures
  Art. 21(2)(f): policies and procedures to assess the effectiveness of cybersecurity risk-management measures. Define indicators, run internal audits, independent reviews and technical testing, and feed results into management review and continual improvement.
• HYG – Cyber hygiene and training
  Art. 21(2)(g): basic cyber hygiene practices and cybersecurity training for all staff. Implement a documented baseline (updates, hardened endpoints, least privilege, MFA, backups, phishing awareness, secure configuration) and a role-based training programme with records.
• CRY – Cryptography and encryption
  Art. 21(2)(h): policies and procedures regarding the use of cryptography and, where appropriate, encryption. Define approved algorithms and protocols, key management across the life cycle and a roadmap for post-quantum migration, which the January 2026 NIS2 amendment proposal would require Member States to address in national strategies.
• HRA – Human resources, access control, assets and physical security
  Art. 21(2)(i): human resources security, access control policies and asset management. Implementing Reg. 2024/2690 adds explicit expectations on physical and environmental security (Annex 13). Keep an asset inventory, classify information, manage the joiner-mover-leaver cycle, control privileged access and protect premises and equipment.
• MFA – Multi-factor authentication and secure communications
  Art. 21(2)(j): use of multi-factor or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. Prioritise MFA for remote access, privileged accounts and cloud consoles, and provide out-of-band channels for crisis communication.
• REP – Incident reporting and information sharing
  Art. 23: significant incidents must be reported to the CSIRT or competent authority with an early warning within 24 hours, an incident notification within 72 hours, intermediate reports on request and a final report within one month; recipients of services must be informed. Entities under Implementing Reg. 2024/2690 apply its quantitative significance thresholds. Art. 29-30 encourage information sharing and voluntary notification.
• SUP – Supervision, enforcement and interplay with other EU acts
  Essential entities face ex ante supervision (Art. 32) and fines up to EUR 10 million or 2% of worldwide turnover; important entities ex post supervision (Art. 33) and fines up to EUR 7 million or 1.4%. Management bodies can be held liable and, for essential entities, temporarily banned (Art. 32(5)). DORA is lex specialis for financial entities (Art. 4), critical entities under CER are essential entities, and the Cyber Resilience Act adds product reporting duties from 11/09/2026.

Key regulatory dates

Frequently asked questions

Other assessments

• EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
• GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
• DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
• AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)