NIS2 applicability assessment
- Your role and market
- Sector and size
- National implementing law
- Applicable requirements and deadlines
NIS2 package for businesses
Assess whether NIS2 applies to you and prepare an incident routine, management instruction and supplier DPA with security annex.
For organisations in NIS2 sectors and suppliers receiving security requirements from their customers.
NIS2 applicability assessment
Your role and market · Sector and size · National implementing law · Applicable requirements and deadlines
Cybersecurity and management plan
Owner and reviewer · Risks and security measures · Continuity and recovery · Training and follow-up
Incident reporting procedure
Identification and assessment · Incidents and escalation · Authority and reporting channel · Applicable requirements and deadlines
Supplier security register
System and supplier · Risks and security measures · Contractual requirements and evidence of controls · Monitoring and change history
Supplier DPA and security annex
System and supplier · Data processed and purposes · Technical and organisational security measures · Sub-processors and incident notification
Board and management instruction on cybersecurity
Management responsibility and decisions · Reporting to the board · Training and follow-up · Monitoring and change history
Applicability depends on the sector, size, specific exemptions and national implementing law. Supplier requirements are not the same as direct legal obligations. Working draft, not a certificate of compliance. Add factual information and have the responsible person review current law and its application. External AI is not legal evidence.
Legal basis: Direktiv (EU) 2022/2555
EU rule packages
Working draft, not a certificate of compliance. Add factual information and have the responsible person review current law and its application. External AI is not legal evidence.
NIS2
Cybersecurity, management accountability, suppliers and incident procedures.
Applicability depends on the sector, size, specific exemptions and national implementing law. Supplier requirements are not the same as direct legal obligations.
Directive (EU) 2022/2555 · EUR-LexCybersecurity and management plan
- Owner and reviewer
- Risks and security measures
- Continuity and recovery
- Training and follow-up
Incident reporting procedure
- Identification and assessment
- Incidents and escalation
- Authority and reporting channel
- Applicable requirements and deadlines
Supplier security register
- System and supplier
- Risks and security measures
- Contractual requirements and evidence of controls
- Monitoring and change history
Supplier DPA and security annex
- System and supplier
- Data processed and purposes
- Technical and organisational security measures
- Sub-processors and incident notification
Board and management instruction on cybersecurity
- Management responsibility and decisions
- Reporting to the board
- Training and follow-up
- Monitoring and change history