NIS2 Compliance Services
NIS2 compliance support for essential and important entities — including scope assessment, Article 21 cybersecurity requirements, incident response and management-body responsibilities.
NIS2 is the EU directive that mandates cybersecurity risk-management measures, strict incident-reporting timelines and personal management accountability across 18 sectors. Passeca scopes whether you are an essential or important entity, closes the Article 21 measures, stands up the 24-hour reporting process, and builds the evidence trail — usually on an ISO 27001 baseline.
What is NIS2?
NIS2 (Directive (EU) 2022/2555) is the Network and Information Security Directive that establishes a high common level of cybersecurity across the European Union. It repealed and replaced the original 2016 NIS Directive, broadening its scope to 18 sectors, sharpening the obligations on entities and their management bodies, and substantially increasing the maximum penalties.
Unlike a voluntary framework such as ISO 27001, NIS2 is law. It classifies organisations as essential or important entities based on sector and size, requires them to implement risk-management measures (Article 21), report significant incidents on a tight 24/72-hour timeline (Article 23), and holds management bodies personally accountable for cybersecurity oversight. Each member state transposes it into national law, which is enforced by a designated national authority or CSIRT.
Who needs NIS2 compliance?
- You operate in a critical sector. Energy, transport, banking, health, drinking water, digital infrastructure, public administration and space are among the "essential" sectors.
- You are a manufacturer or supplier. Manufacturers of medical, computer and electrical equipment, and many digital-service providers, fall under "important" entities.
- You meet the size threshold. Generally 50+ employees or €10m+ turnover, though critical sub-sectors apply regardless of size.
- You operate in the EU. Some service providers based outside the EU may also need to comply with these rules and appoint a representative in the EU.
What does NIS2 actually require?
NIS2's core obligations sit in two articles. Article 21 lists the minimum set of cybersecurity risk-management measures entities must implement. Article 23 sets the incident-reporting timeline. Together they form the bulk of what an authority will examine.
The Article 21 minimum measures include:
- Policies on risk analysis and information system security — a formal risk-management methodology and security policies.
- Incident handling — detection, response and a process that meets the reporting timeline.
- Business continuity — backup, disaster recovery and crisis management.
- Supply-chain security — managing cybersecurity risk in direct suppliers and service providers.
- Secure development and acquisition — including vulnerability handling and disclosure.
- Cybersecurity training and hygiene practices — ongoing, role-aware awareness.
- Access control and account management — least privilege, MFA and privileged-access management.
- Cryptography — encryption and key management appropriate to the risk.
- Asset and change management, network security and physical security.
Under NIS2, organisations covered by the reporting requirements must report significant cybersecurity incidents in stages: an early warning within 24 hours of becoming aware of the incident, a more detailed notification within 72 hours, and a final report within one month after submitting the incident notification.
Management bodies must also approve and oversee cybersecurity risk management measures and complete relevant cybersecurity training.
How Passeca gets you NIS2 compliant
- 01
Scoping — are you in?
We determine whether your organisation is an essential or important entity under NIS2, in which sector and member state, and what your obligations therefore are. Many organisations are surprised to find they are in scope.
- 02
Risk-management-measures gap analysis
We assess your current measures against the ten minimum measures in Article 21 — governance, incident handling, training, access control, cryptography, supply-chain, and more — and rank the gaps.
- 03
Reporting-readiness assessment
We assess your ability to meet the strict NIS2 reporting timelines — early warning within 24 hours, incident notification within 72 hours, and a final report within one month — and design the process to hit them.
- 04
Implementation
We implement the missing measures, set up the incident-reporting process with your SOC, strengthen supply-chain risk management, and capture evidence in Hyperproof mapped to the NIS2 articles.
- 05
Management accountability & evidence
We brief your management bodies on their personal NIS2 accountability, build the evidence trail, and set up ongoing monitoring so you can demonstrate compliance to a national authority on request.
What you get from the engagement
How long does NIS2 compliance take?
| Starting point | Estimated duration | What the process involves |
|---|---|---|
| No existing ISMS | 6–12 months | Implementing NIS2 Article 21 cybersecurity measures from scratch |
| Existing ISO 27001 | 2–5 months | Identifying and addressing NIS2-specific compliance gaps |
| Incident reporting only | 4–8 weeks | Establishing a process for 24-hour and 72-hour incident reporting with the Security Operations Centre (SOC) |
As EU Member States implement and enforce NIS2 requirements, organisations need to understand their obligations and take steps to meet them. Passeca helps businesses prioritise essential areas, such as incident reporting and management accountability, while building a broader compliance strategy.
Doing more than one framework?
| NIS2 (Art. 21) | ISO 27001 | DORA | |
|---|---|---|---|
| Risk-management measures | |||
| Incident handling | |||
| Strict 24/72-hour reporting | Implicit | ||
| Supply-chain security | ICT third-party | ||
| Management accountability | Implicit | ||
| Nature | EU law | Voluntary std. | EU law |
NIS2, ISO 27001 and DORA share similar approaches to cybersecurity risk management. For financial entities covered by DORA, its specific requirements generally take priority over the equivalent NIS2 obligations. Passeca uses Hyperproof to organise and reuse compliance evidence across applicable requirements, helping businesses reduce duplicate work.
NIS2 compliance, answered
What is NIS2?
Who is in scope of NIS2?
What are the NIS2 incident-reporting timelines?
Are management bodies personally accountable under NIS2?
What are the NIS2 penalties?
Does ISO 27001 satisfy NIS2?
When does NIS2 apply — is there a deadline?
Not sure if NIS2 applies to your business?
Book a free consultation. Passeca will help you understand whether NIS2 applies to your organisation, which national requirements may affect you, and what steps you should take next.
Related