RequirementsEU

EU NIS2 Directive (EU) 2022/2555 Requirements

Turn NIS2 obligations into owned controls, reporting workflows, and evidence packs.

Focus: Article 20 governance, Article 21 controls, Article 23 reporting, and national overlays.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

NIS2 is a management, controls, and reporting system. Use this page as a structured breakdown of what you must implement, what changes for essential versus important entities, and what evidence you should hold so your compliance position is clear under supervision.

Section 1

The three obligations you must implement (most programs fail by missing one)

NIS2 combines governance, risk management controls, and incident reporting into one system. If any leg is weak, the program collapses during incidents or audits.

Governance under Article 20: management bodies approve the cybersecurity measures, oversee implementation, follow training, and may face liability under national law.
Controls under Article 21: technical, operational, and organisational measures that are appropriate and proportionate, including the listed measures in Article 21(2)(a) to (j).
Reporting under Article 23: early warning within 24 hours, incident notification within 72 hours, final report within 1 month, plus recipient communications where relevant.

Section 2

Scope and classification drives what "good" looks like (essential vs important; sector overlays)

Your implementation must be scoped per legal entity and per service. Classification affects supervision intensity, enforcement expectations, and how quickly you need to close gaps.

Run an applicability test based on Annex I or Annex II, size-cap logic, and regardless-of-size triggers, then document the outcome in a scope memo.
Determine whether the entity is essential or important under Article 3 and record how that changes your supervisory posture.
Check Article 4 overlap with sector-specific Union acts and keep the equivalence analysis in the scope file.
If you are in a category covered by Implementing Regulation (EU) 2024/2690, apply that act as a more prescriptive layer on top of Article 21 and Article 23.

Section 3

Evidence mapping (requirement -> evidence artefacts you should have)

Supervision powers include requests for documented policies and evidence, audits, and scans. Build an "evidence pack" that can be produced quickly and confidently.

Article 20: management approval minutes, oversight cadence, training records, and governance RACI.
Article 21: control register mapping Article 21(a) to (j), risk assessments, supplier assurance evidence, restore tests, and vulnerability management records.
Article 23: significant incident decision log, 24h and 72h templates, final report template, submission records, and recipient communications playbook.
Transposition overlays: competent authority and CSIRT route map, portal details, and any national add-ons to scope or enforcement.

Recommended next step

Turn EU NIS2 Directive (EU) 2022/2555 Requirements into an operational assessment

Assessment Autopilot can take EU NIS2 Directive (EU) 2022/2555 Requirements from turning the requirements into assigned actions to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU NIS2 Directive (EU) 2022/2555 Requirements

Start from EU NIS2 Directive (EU) 2022/2555 Requirements and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU NIS2 Directive (EU) 2022/2555

Review your current process, evidence gaps, and next steps for EU NIS2 Directive (EU) 2022/2555 Requirements.

Explore next step

Section 4

Program architecture (a model that scales beyond "compliance sprint")

Build your NIS2 program like an operating system: recurring risk cycles, recurring control tests, recurring training, and recurring reporting drills.

Quarterly: risk assessment updates for critical services, supplier reviews, and management review of control KPIs.
Monthly: vulnerability management metrics, patch SLA performance, backup/restore checks, access review completion.
Per incident: post-incident review feeding into Article 21 improvements and management reporting.
Annually: security audit/certification posture review, crisis simulations, and evidence pack refresh.

Primary sources