Your 8-Step Path to NIS2 Compliance
Complete implementation roadmap for achieving NIS2 compliance. From sector assessment to incident response, this guide walks you through every requirement with practical timelines and expert guidance.
NIS2 Implementation Timeline
NIS2 is already in effect, but most organizations need 6-12 months to achieve full compliance. Start with the fundamentals and build systematically.
Weeks 1-2
Assessment & Scoping
Weeks 3-8
Governance & Risk Assessment
Weeks 9-20
Security Implementation
Week 21+
Training & Documentation
Proven Standards Framework for NIS2 Compliance
Choose your compliance path based on your organization's needs. Whether you want formal certification or practical implementation, these established frameworks provide a structured approach to NIS2 compliance.
Formal Certification Path
Best for organizations seeking third-party validation and systematic governance
ISO/IEC 27001 - Governance Backbone
Information Security Management System (ISMS) provides the governance foundation and systematic approach to cybersecurity
ISO/IEC 22301 - Business Continuity
Business Continuity Management System (BCMS) for resilience obligations and service continuity during incidents
ISO/IEC 27035 - Incident Management
Structured incident handling process aligned with NIS2's 24-hour reporting requirements
Best for: Large organizations, critical infrastructure, entities seeking formal validation and systematic governance approach
Practical Implementation Path
Best for technical teams needing actionable guidance and rapid implementation
NIST Cybersecurity Framework 2.0
Practical framework with clear functions: Govern, Identify, Protect, Detect, Respond, Recover
CIS Controls v8
Prioritized set of 18 security controls that demonstrate "state of the art" security measures
Technical Implementation Guides
Step-by-step technical implementation guides for security controls and monitoring
Best for: Technical teams, medium-sized organizations, entities needing rapid deployment of security controls
ENISA Guidance: Your EU Interpretation Layer
Regardless of which framework you choose, always reference ENISA publications for EU-specific interpretation of NIS2 requirements. ENISA guidance will be treated as the authoritative interpretation for compliance audits and enforcement.
Key ENISA Resources:
- • Supply chain security guidelines
- • Incident reporting templates
- • Sector-specific implementation guidance
Recommended Approach:
- • ISO 27001 for governance + NIST/CIS for implementation
- • Always cross-reference with ENISA guidance
- • Maintain documentation showing compliance mapping
Complete NIS2 Implementation Roadmap
Follow these 8 proven steps to achieve full NIS2 compliance. Each step builds on the previous one, ensuring you create a comprehensive cybersecurity program that protects your organization and meets regulatory requirements.
1. Check If NIS2 Applies to You
Determine if your organization qualifies as an essential or important entity under NIS2
Key Actions
- Check if you're in a covered sector (energy, transport, banking, health, digital, etc.)
- Count your employees and annual turnover
- Determine if you're "essential" or "important" entity
- Identify which member state(s) you operate in
Available Tools
Real Examples
2. Implement ISO 27001 ISMS Backbone
Establish ISO/IEC 27001 Information Security Management System as your governance foundation
Key Actions
- Implement ISO 27001 ISMS with management commitment
- Establish security governance per ISO 27001 requirements
- Define roles and responsibilities using ISO 27001 framework
- Set up continuous improvement processes
Available Tools
Real Examples
3. Perform Risk Assessment
Identify and evaluate cybersecurity risks to your networks and information systems
Key Actions
- Map all critical systems and data flows
- Identify potential threats and vulnerabilities
- Assess impact and likelihood of incidents
- Prioritize risks and create treatment plans
Available Tools
Real Examples
4. Implement Security Measures
Put in place technical and organizational measures to manage identified risks
Key Actions
- Deploy security controls (firewalls, antivirus, encryption)
- Set up access controls and authentication
- Implement network segmentation
- Establish backup and recovery procedures
Available Tools
Real Examples
5. Implement ISO 27035 Incident Management
Deploy ISO/IEC 27035 incident management processes for NIS2 compliance
Key Actions
- Implement ISO 27035 incident management framework
- Create structured incident response procedures
- Set up 24-hour NIS2 incident reporting to authorities
- Establish ISO 22301 business continuity integration
Available Tools
Real Examples
6. Secure Your Supply Chain
Manage cybersecurity risks from suppliers and service providers
Key Actions
- List all critical suppliers and dependencies
- Assess supplier security practices
- Add security requirements to contracts
- Monitor third-party risks continuously
Available Tools
Real Examples
7. Train Your Staff
Ensure all employees understand cybersecurity risks and their responsibilities
Key Actions
- Create cybersecurity awareness program
- Train staff on phishing and social engineering
- Conduct regular security exercises
- Test employee readiness with simulations
Available Tools
Real Examples
8. Demonstrate Compliance
Document and prove your compliance with NIS2 requirements to authorities
Key Actions
- Document all security policies and procedures
- Keep evidence of security measures implementation
- Prepare for potential audits or inspections
- Register with national authorities if required
Available Tools
Real Examples
NIS2 Quick Reference
Key deadlines, requirements, and penalties at a glance
Critical Deadlines
- • 24 hours: Early warning to authorities
- • 72 hours: Detailed incident report
- • 1 month: Final incident report
- • Ongoing: Continuous compliance required
Core Requirements
- • Risk management and policies
- • Incident handling and reporting
- • Business continuity planning
- • Supply chain security
- • Management liability compliance
Maximum Penalties
- • Essential: €10M or 2% revenue
- • Important: €7M or 1.4% revenue
- • Personal management liability
- • Temporary management bans
Supporting Tools and Resources
Everything you need to implement and maintain NIS2 compliance
ISO 27001 Compliance Mapper
Map your existing ISMS to NIS2 requirements
Standards-Based Gap Analysis
Assess compliance using ISO/NIST/ENISA frameworks
Compliance Checklist
Track all requirements in one place
ISO 27035 Incident Framework
ISO 27035 incident management with NIS2 reporting
Risk Assessment Guide
Identify and evaluate your cyber risks
Sector Checker
Check if your industry is covered
NIST CSF 2.0 / CIS Implementation
Practical implementation guides for technical teams
ENISA Guidance Toolkit
EU interpretation layer for compliance