ComplianceEU

EU NIS2 Directive (EU) 2022/2555 Compliance

Build an NIS2 compliance program that works during incidents and audits.

Output: scoped program, owned controls, reporting workflows, and evidence packs aligned to supervision expectations.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

NIS2 compliance is the ability to demonstrate - quickly and credibly - that you govern cybersecurity at management level, that your controls reduce real risk, and that you can report significant incidents on time with evidence. Use this page as the operating model for your NIS2 program.

Section 1

Compliance operating model (what the program must produce)

Treat compliance outputs as artefacts that can be audited: scope memo, control register, incident reporting workflow, and evidence vault.

Scope memo: per legal entity, sector mapping, size-cap logic, essential vs important classification, and jurisdiction assumptions.
Control baseline: Article 21 a-j mapped to control IDs, owners, KPIs, and evidence items (tests, logs, audits, training).
Incident reporting workflow: significant incident triage, 24h/72h/1 month templates, and authority contact routes.
Governance: management approval and oversight cadence (Article 20), training records, and risk acceptance decisions.

Recommended next step

Turn EU NIS2 Directive (EU) 2022/2555 Compliance into an operational assessment

Assessment Autopilot can take EU NIS2 Directive (EU) 2022/2555 Compliance from operationalizing the guidance into a tracked program to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU NIS2 Directive (EU) 2022/2555 Compliance

Start from EU NIS2 Directive (EU) 2022/2555 Compliance and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU NIS2 Directive (EU) 2022/2555

Review your current process, evidence gaps, and next steps for EU NIS2 Directive (EU) 2022/2555 Compliance.

Explore next step

Section 2

Phased implementation plan (fast risk reduction + fast defensibility)

Sequence matters. Prioritise controls that reduce impact and controls that enable reporting and evidence capture.

Phase 1 (0-30 days): scope memo, RACI, incident reporting workflow, backup/restore baseline + restore test, MFA for admin access.
Phase 2 (31-60 days): supplier tiering + contract clauses, vulnerability handling and patch SLAs, monitoring/logging coverage uplift.
Phase 3 (61-90 days): control effectiveness testing cadence (audits/scans/tabletops), KPI dashboards, and management review sign-off.
Phase 4 (ongoing): continuous risk cycles, supplier reviews, and recurring reporting drills.

Section 3

Audit and supervision readiness (design your evidence so it can be produced quickly)

Supervision can involve audits, scans, and requests for policies and evidence. Build an evidence vault with tight access control and clear indexing.

Index evidence by requirement: Article 20, Article 21 a-j, Article 23 reporting, and national transposition specifics.
Maintain an exception register with expiry dates and management approval for risk acceptance.
Keep incident evidence separate from "policy evidence": timelines, logs, IoCs, and reporting submissions must be retrievable.
Prove effectiveness (Article 21(2)(f)) with test results, audit findings, remediation tracking, and KPI trends.

Section 4

Handle national transposition reality (how to stay consistent across jurisdictions)

NIS2 is implemented through Member State transposition and supervision. Your program needs a central baseline with local overlays.

Keep a per-country overlay sheet: competent authority/CSIRT routes, reporting portals, and any additional requirements.
If you operate in multiple Member States, document how you will coordinate incident reporting across jurisdictions.
Track transposition updates and update your scope memo and reporting routes when national rules change.

Primary sources