NIS2 Compliance Services: Readiness Assessment, Article 21 Controls, and Incident Reporting
NIS2 compliance readiness for essential and important entities, and for the suppliers that serve them. We confirm whether and how the Directive applies to you, test your controls against the ten Article 21 measures, and drill your incident reporting. You get a risk-ranked roadmap your management body can approve. Most programs take 6–12 weeks.
What Is NIS2 Compliance?
NIS2 compliance means meeting the NIS2 Directive, Directive (EU) 2022/2555, as your Member State has written it into national law. In-scope organizations must manage cybersecurity risk and report significant incidents. They must also secure their supply chain and make senior management accountable.
The NIS2 Directive replaced the first NIS Directive and widened it a great deal. It now reaches medium and large organizations in 18 sectors, from energy and health to manufacturing, food, and digital services. It also reaches their suppliers, because every in-scope entity must manage security risk in its supply chain.
Accredify Global confirms how the Directive and your national law apply to you. We then test your controls on real events, not only policies. You get a risk-ranked roadmap and the evidence your regulator or customers will ask for.
NIS2 in 2026: National Laws Are Live, and Targeted Amendments Are Proposed
Member States had to transpose NIS2 by 17 October 2024. Most were late. The Commission opened infringement procedures against 23 Member States in November 2024. By September 2026, the ECSO transposition tracker showed 24 of 27 Member States with NIS2 in national law.
On 20 January 2026, the Commission proposed targeted amendments to NIS2. They add a small mid-cap category for firms with fewer than 750 employees and under 150 million euros in turnover. They also streamline ransomware reporting and let certification help demonstrate compliance. The proposal must still pass the EU legislative process, so today's national laws remain the rules to meet.
Sources: Directive (EU) 2022/2555 (EUR-Lex) · ECSO NIS2 transposition tracker · European Commission cybersecurity package Q&A
Who Needs NIS2 Compliance?
Two questions decide it: is your sector listed, and are you medium-sized or larger? Some entities are in scope whatever their size.
| Group | Sectors | Usual classification |
|---|---|---|
| Sectors of high criticality (Annex I) | Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, and space | Large entities are usually essential; medium entities are usually important |
| Other critical sectors (Annex II) | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research | Usually important entities |
| In scope regardless of size | DNS providers, top-level domain registries, qualified trust service providers, and public electronic communications providers, among others | Set by the Directive and national law |
Electricity, gas, oil, hydrogen, district heating, and water operators with national or regional reach.
Hospitals, laboratories, pharmaceutical makers, and manufacturers of critical medical devices. See our healthcare certification pathway.
Makers of electronics, electrical equipment, machinery, vehicles, and medical devices within the size thresholds.
Digital infrastructure and managed service providers, which also face detailed technical rules. See our IT industry pathway.
Food producers, processors, and distributors, and chemical manufacturers in Annex II. See our food industry pathway.
Companies outside the EU whose EU customers must secure their supply chain under NIS2.
NIS2 Compliance Requirements: The Ten Article 21 Measures, and What We Assess
Article 21 sets the minimum. Your national law and, for digital providers, an EU implementing regulation add the detail.
| Measure | What NIS2 asks | What we assess |
|---|---|---|
| Risk analysis & policies | Policies on risk analysis and information system security | Risk method, asset scope, and whether policies are approved and used |
| Incident handling | Detect, respond to, and recover from incidents | Detection coverage, playbooks, and a live incident drill |
| Business continuity | Backups, disaster recovery, and crisis management | Recovery objectives, restore tests, and crisis roles |
| Supply chain security | Security in relationships with direct suppliers and service providers | Supplier inventory, risk tiers, contract clauses, and monitoring |
| Secure development & vulnerabilities | Security in acquisition, development, and maintenance, including vulnerability handling | Patch timelines, vulnerability disclosure, and change control |
| Effectiveness | Policies to assess whether security measures work | Metrics, internal audits, and management review |
| Cyber hygiene & training | Basic cyber hygiene practices and cybersecurity training | Training records, phishing results, and baseline configurations |
| Cryptography | Policies on cryptography and, where appropriate, encryption | Encryption at rest and in transit, and key management |
| People, access & assets | Human resources security, access control, and asset management | Joiner and leaver checks, privileged access, and asset records |
| Authentication & communications | Multi-factor authentication and secured communications, including emergency channels | MFA coverage, secure messaging, and out-of-band emergency contact |
For DNS, cloud, data centre, managed service, and similar providers, Commission Implementing Regulation (EU) 2024/2690 sets the technical detail. We assess against it where it applies to you.
NIS2 Incident Reporting and Management Accountability
Both depend on fast, documented decisions, so we test them in detail.
Significant incident reporting deadlines
| Early warning | Within 24 hours of becoming aware of a significant incident |
|---|---|
| Incident notification | Within 72 hours, with an initial assessment of severity and impact |
| Final report | Within one month of the incident notification |
We run a realistic scenario to check whether your team can classify an incident and meet each deadline.
What NIS2 asks of management
- Approve the cybersecurity risk-management measures
- Oversee how those measures are implemented
- Take cybersecurity training, as members of the management body
- Accept liability for breaches, under national law
- Understand the maximum fines: at least €10 million or 2% of turnover for essential entities
- For important entities: at least €7 million or 1.4% of turnover
NIS2 Compliance for US and UK Companies Serving the EU
The NIS2 Directive is EU law, but it reaches non-EU companies through group structures, digital services, and supplier contracts.
Each EU entity is assessed under its own country's law. A US or UK parent often runs one program across several national authorities, so we map one control set to each country's rules.
Some digital providers without an EU establishment must appoint an EU representative. This covers DNS, cloud, data centre, content delivery, and managed security providers, among others.
Your customers must manage supplier risk under Article 21. Expect security questionnaires, audit rights, and incident notice clauses. ISO 27001 certification or a SOC 2 report often answers much of it.
A single breach can trigger NIS2 and GDPR reporting at once. ISO 27701 certification helps show privacy controls sit alongside your security controls.
The UK is outside NIS2 and has its own NIS Regulations. UK firms with EU operations or EU customers can still fall in scope, or in a customer's supply chain.
NIS2 Compliance Checklist: Ten Questions to Answer First
If you cannot answer one of these with evidence, it belongs on your roadmap.
Scope and governance
- Have you confirmed your sector, size, and entity type in each country?
- Have you registered with each national authority where required?
- Has your management body approved the security measures?
- Have board members completed cybersecurity training?
- Is there a named owner for NIS2 compliance and reporting?
Controls and evidence
- Can you send an early warning within 24 hours, day or night?
- Have you restored critical systems from backup in the last year?
- Do you know which suppliers support your critical services?
- Is multi-factor authentication in place for all remote and privileged access?
- Do you measure whether your controls work, and report it to management?
How Our NIS2 Readiness Assessment Works
Six stages from scoping call to a roadmap your management body can approve.
Not sure whether NIS2 applies to you, or which country's rules you follow? A free scoping review answers that first.
Book a free scoping reviewWhat Our NIS2 Compliance Services Improve
The outcomes security, risk, and leadership teams care about most.
Your entity type confirmed for each country you operate in, so effort goes where the law actually applies.
An escalation path and reporting templates tested on a realistic scenario, not left on paper.
A briefing and training plan that lets your board approve the measures with confidence.
NIS2 Compliance Cost and Timeline
There is no list price. The cost follows your sector, entity type, countries, and how mature your controls are. A free scoping review gives you a tailored proposal.
What moves the cost
- Entity type — essential, important, or a supplier to either
- Countries — each national law, authority, and registration route
- Sites and systems — how many services and locations are in scope
- Supply chain — the number of critical suppliers to review
- Reuse — ISO 27001, ISO 22301, or SOC 2 evidence already in place
How long it takes
| Assessment and roadmap | 6–12 weeks, depending on scope |
|---|---|
| Closing gaps | Set by your roadmap and team capacity |
| Ongoing | Measures reviewed as risks, suppliers, and national rules change |
NIS2 vs DORA, ISO 27001, ISO 22301, NIST CSF, and GDPR
NIS2 overlaps with frameworks many organizations already hold. The gaps are usually reporting, registration, and management duties.
| Framework | What it is | How it relates to NIS2 |
|---|---|---|
| DORA | The EU digital resilience law for financial entities | For financial entities, DORA applies instead of NIS2 where it covers the same ground. |
| ISO 27001 | A certifiable information security standard | Covers much of Article 21, but not national registration or NIS2 reporting deadlines. |
| ISO 22301 | A certifiable business continuity standard | Supports the continuity, backup, and crisis management measure. |
| NIST CSF 2.0 | A US voluntary cybersecurity framework | Its functions map well to Article 21, which helps US groups with EU operations. |
| GDPR | The EU data protection regulation | A separate law. One incident can trigger both GDPR and NIS2 reporting. |
| SOC 2 | A CPA attestation report for service organizations | Useful evidence for suppliers answering customers' NIS2 questions. |
How to Choose NIS2 Compliance Services
The questions worth asking before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you certify us for NIS2? | No one can today. There is no NIS2 certification; we assess readiness and help you build evidence. |
| Do you work from the national law, or only the Directive? | Both. We check the law in each country where you are in scope. |
| Do you test controls or only review policies? | We test on real events: incidents, backup restores, and supplier reviews. |
| Can you help suppliers as well as regulated entities? | Yes. We assess both sides of the supply chain relationship. |
| Do you give legal advice? | No. Where legal interpretation is needed, we coordinate it within the same plan. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From NIS2 Compliance Services
Your entity type and obligations in each country.
Where you stand against each of the ten measures.
Remediation actions in priority order, with owners.
How your team performed against the 24-hour and 72-hour deadlines.
Critical suppliers, risk tiers, and contract gaps.
A summary your management body can approve, with a training plan.
Frequently Asked Questions About NIS2 Compliance
Straight answers on scope, requirements, reporting, fines, amendments, cost, and timeline.
What is NIS2 compliance?
NIS2 compliance means meeting the EU NIS2 Directive, Directive (EU) 2022/2555, as each Member State has written it into national law. In-scope organizations must manage cybersecurity risk, report significant incidents, secure their supply chain, and hold management accountable.
Who does NIS2 apply to?
NIS2 applies to medium and large organizations in 18 sectors, split into sectors of high criticality and other critical sectors. Some entities are in scope regardless of size, such as DNS providers, top-level domain registries, trust service providers, and public electronic communications providers.
What is the difference between essential and important entities?
Both must meet the same security and reporting duties. Essential entities face proactive supervision and higher maximum fines. Important entities are supervised mainly after an incident or complaint, known as ex post supervision.
Does NIS2 apply to companies outside the EU?
Yes, in some cases. Certain digital providers that serve the EU without an EU establishment must appoint an EU representative. Suppliers outside the EU are also pulled in through their customers' supply chain security requirements.
What are the NIS2 compliance requirements?
Article 21 sets ten minimum measures. They cover risk analysis and security policies, incident handling, business continuity, supply chain security, and secure development. They also cover effectiveness testing, cyber hygiene and training, cryptography, access control, and multi-factor authentication.
What are the NIS2 incident reporting deadlines?
For a significant incident, an early warning is due within 24 hours of becoming aware of it. An incident notification follows within 72 hours. A final report is due within one month of the notification.
What are the fines for NIS2 non-compliance?
Essential entities face maximum fines of at least 10 million euros or 2% of worldwide annual turnover, whichever is higher. For important entities, the figures are at least 7 million euros or 1.4% of turnover. Member States set the exact rules.
Are senior managers personally responsible under NIS2?
Yes. Management bodies must approve the cybersecurity risk-management measures and oversee how they are implemented. They can be held liable for breaches, and members must take cybersecurity training.
Is there a NIS2 certification?
Not today. NIS2 compliance is shown through evidence and supervision under national law. A January 2026 Commission proposal would let certification under an EU scheme support compliance. Until then, ISO 27001 certification is useful supporting evidence.
Do we need to register under NIS2?
In many countries, yes. Member States had to list essential and important entities by 17 April 2025, and many ask entities to self-register with the national authority. Portals and deadlines differ, so we confirm them during scoping.
What is Implementing Regulation (EU) 2024/2690?
It is a Commission regulation that sets the technical security requirements for DNS, cloud, data centre, managed service, and similar digital providers. It also defines when their incidents count as significant. It applies alongside national law.
Has every EU country transposed NIS2?
Not yet. The deadline was 17 October 2024. According to the ECSO tracker, 24 of 27 Member States had transposed NIS2 by September 2026. National details, such as registration steps and authorities, differ by country.
Is NIS2 being amended?
The Commission proposed targeted amendments on 20 January 2026. They include a new small mid-cap category, clearer scope rules, streamlined ransomware reporting, and a role for certification. The proposal still has to pass the EU legislative process.
How does NIS2 relate to ISO 27001?
ISO 27001 covers much of what Article 21 asks, including risk assessment, policies, access control, and supplier security. It does not cover national registration, NIS2 reporting deadlines, or management training duties, so a gap assessment is still needed.
What is the difference between NIS2 and DORA?
Both are EU laws on digital resilience. NIS2 covers essential and important entities across many sectors. DORA is the sector-specific law for financial entities, and it applies instead of NIS2 where it covers the same ground.
Does Accredify Global give legal advice on NIS2?
No. We assess readiness and test controls against the Directive and the national law that applies to you. Where legal interpretation is needed, we coordinate it within the same plan.
How much does NIS2 compliance cost?
The cost depends on your sector, entity type, and number of countries and sites. Supply chain size and existing controls also matter. Accredify Global reviews your scope for free and sends a tailored proposal.
How long does a NIS2 readiness assessment take?
Most Accredify Global NIS2 readiness assessments and roadmaps take 6 to 12 weeks, depending on scope. Closing the gaps then follows your roadmap.
Find Out Where You Stand on NIS2, Before Your Regulator or Customer Asks
Tell us about your sector, countries, and critical services. We'll confirm how NIS2 applies, recommend a timeline, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.