A practical map of the NIS2 duties teams usually need to operationalize: scope classification, management-body accountability, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Use it to turn the directive text and implementing regulation into an owner-backed requirements register for security, legal, risk, procurement, incident-response, and country operations teams.
Structured answer sets in this page tree.
Cited legal and guidance references.
NIS2 requirements begin with a service-level scope decision. Identify the legal entity, exact Annex row, SME or size-independent basis, essential or important tier, Article 26 jurisdiction, and national implementing law. Covered entities then need management-body governance, under Article 21, and significant-incident reporting under Article 23. If a sector-specific Union act has equivalent risk-management or incident-notification requirements, Article 4 displaces only the corresponding NIS2 provisions and their supervision and enforcement rules for the covered entities.
Article 2 generally applies NIS2 to public or private entities of a type listed in Annex I or Annex II that qualify as medium-sized enterprises or exceed the medium-sized ceilings and provide services or carry out activities in the Union. Calculate size from annual work units, turnover or balance-sheet total, and the required partner and linked-enterprise aggregation. The Directive also includes specified entities regardless of size, including public electronic communications providers, trust service providers, TLD registries, DNS service providers, entities providing domain name registration services, certain sole providers and high-impact entities, public administration entities, and critical entities under Directive (EU) 2022/2557.
Article 3 then classifies in-scope entities as essential or important. Large Annex I entities, qualified trust service providers, TLD name registries, DNS service providers, certain public communications providers, public administration entities, and entities identified by Member States under Article 2(2) can be essential. Other in-scope Annex I or Annex II entities that are not essential are important.
Member States had to adopt and publish their transposition measures by 17 October 2024 and apply them from 18 October 2024. NIS2 is a directive, so the EU text sets the required result while national law supplies the local procedures, authority routes, and additional provisions. On 8 July 2026, the Commission said that Ireland, Spain, France, and the Netherlands had not notified full transposition; verify the current national position before assigning a country requirement.
Article 20 requires Member States to ensure that management bodies of essential and important entities approve the used to comply with Article 21, oversee implementation, and can be held liable for the entity's Article 21 infringements under the applicable national liability rules. Management-body members must follow training; regular employee training is encouraged.
Name both the executive approval owner and the operational control owner. The register should show how management reviews risk, approves measures, sees compliance-monitoring results, and receives incident or remediation updates.
Article 21 requires appropriate and proportionate technical, operational, and organisational measures to manage risks to network and information systems and to prevent or minimise incident impact on service recipients and other services. The measures must use an all-hazards approach and be proportionate to risk exposure, entity size, incident likelihood and severity, and societal and economic impact.
At minimum, the register should map Article 21(2)(a) through (j): risk analysis and information-system security policies; incident handling; business continuity, backup management, disaster recovery, and crisis management; supply-chain security for direct suppliers and service providers; secure acquisition, development, maintenance, vulnerability handling, and disclosure; effectiveness assessment; cyber hygiene and training; cryptography and encryption where appropriate; HR security, access control, and asset management; and multi-factor or continuous authentication plus secure communications where appropriate.
Article 23 requires essential and important entities to notify the CSIRT or competent authority, without undue delay, of significant incidents. A has caused or is capable of causing severe operational disruption of services or financial loss for the entity, or considerable material or non-material damage to other natural or legal persons.
The workflow should preserve the Directive's sequence: early warning without undue delay and within 24 hours of awareness, incident notification without undue delay and within 72 hours, intermediate reports if requested, and a final report not later than one month after the incident notification. For ongoing incidents, the entity provides a progress report at that time and a final report within one month after handling. Trust service providers must submit the incident notification within 24 hours for significant incidents affecting their trust services.
Commission Implementing Regulation (EU) 2024/2690 lays down technical and methodological requirements for Article 21(2) measures and further specifies significant-incident cases for DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking services platforms, and trust service providers.
For those provider types, the requirements register should not stop at Article 21's high-level categories. Use the Regulation's annex to detail the policies, risk framework, risk treatment, event detection, supply-chain policy, supplier register, secure acquisition, security testing, patch and vulnerability handling, cyber hygiene, cryptography, access control, asset classification, and physical or environmental security evidence. ENISA guidance is non-binding implementation support for that Regulation.
The requirements register should produce an evidence checklist rather than a generic compliance statement. Connect each requirement to a legal source, service boundary, owner, implementation artifact, review cadence, and Member State authority path.
Keep the requirements register current when the entity changes services, sectors, EU countries, suppliers, digital provider status, incident process, or management-body approval route.
Covered essential and important entities need scope and classification records, management-body governance under Article 20, under Article 21, significant-incident reporting under Article 23, and any additional national or sector-specific requirements that apply in the relevant Member State.
Keep the legal source, Member State basis, entity classification, Article 21 control mapping, management approval, training records, supplier and service-provider evidence, security-test and remediation records, incident-clock logs, authority notifications, recipient communications, and review triggers.
Sorena can turn the NIS2 requirements on this page into cited scope decisions, Article 21 control mappings, incident-reporting workflows, owner assignments, and evidence requests.
Ask questions tied to cited sources about NIS2 scope, Article 21 controls, Article 23 reporting, and implementation evidence using the cited sources on this page.
Review your NIS2 requirements register, source gaps, control evidence, and next implementation steps with Sorena.
"cybersecurity risk-management measures and reporting obligations"
"Technical Implementation Guidance"
"NIS2 Directive"
"relevant entities shall"