NIS2: are you in scope, and what must you do?
The EU’s NIS2 Directive reaches far more organisations than its predecessor, including some US companies serving the EU. We tell you plainly whether you are in scope, then build the measures and the reporting process it expects.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
Usually, one of these is true.
This is advisory support, not legal advice. We work alongside your counsel on questions of law and with your national regulators’ published guidance.
- You are a US company with EU subsidiaries, customers or service delivery and are not sure NIS2 applies.
- You operate in a sector the Directive lists, such as health, energy, transport, finance, digital infrastructure, manufacturing or ICT services.
- Your EU customers are pushing NIS2 obligations down the supply chain to you.
- Your board needs to know what management accountability under the Directive means for them.
NIS2 at a glance
| Topic | What to know |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident. |
| Incident notification | Within 72 hours, with an initial assessment. |
| Final report | Within one month of the incident notification. |
| Management duty | Leadership must approve and oversee the risk measures and can be held accountable for failures. |
| Penalties | Up to EUR 10 million or 2% of worldwide turnover for essential entities, and up to EUR 7 million or 1.4% for important entities. |
From scope check to a working process.
Applicability check
Sector, size, entities and where you serve customers. Each member state transposes the Directive into its own law, so we check the countries you operate in.
Gap review against Article 21
Risk analysis, incident handling, business continuity, supply-chain security, vulnerability handling, cryptography, access control and multi-factor authentication.
Incident-reporting process
A playbook and decision tree so the 24-hour and 72-hour clocks are met by people who have rehearsed them.
Governance and board briefing
What leadership must approve, how they evidence oversight, and training for the management body.
Supply-chain and customer response
Evidence packs and contract language for the EU customers who will ask.
Deliverables you can hand to an auditor.
Scoped on the free call and agreed as a fixed fee. Start with an Assess project, then Build and Manage as you need them.
- Written applicability opinion for each EU entity and member state
- Gap assessment against the Article 21 measures
- Incident-reporting playbook and tabletop exercise
- Board briefing and governance records
- Supplier and customer assurance pack
- One control map shared with ISO 27001, SOC 2 and NIST CSF 2.0
Questions about NIS2.
Does NIS2 apply to a US company?
It can, when you provide services in the EU in a listed sector or have EU entities that fall in scope, and some providers must appoint an EU representative. The answer depends on your facts, which is why the applicability check comes first.
Is our country’s law in force yet?
Member states have transposed the Directive at different speeds, and each has its own regulator and details. We confirm the position in each country you operate in rather than assume.
How is this different from GDPR breach notification?
GDPR is about personal data and has its own 72-hour clock to the data-protection authority. NIS2 covers significant incidents to services and runs separately. One incident can trigger both, so the playbook handles them together.
Can ISO 27001 cover NIS2?
It covers a large share of the Article 21 measures, but not the reporting duties or the management-accountability rules. We map what carries over and fill the rest.
Related: ISO 27001 certification · Incident readiness tabletop
Start with a free conversation about NIS2.
A free 30-minute conversation to agree what matters most and what to do first. If you would like to prepare, answer the short questionnaire beforehand.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day