NIS2 Compliance: The Complete Guide for Organizations
NIS2 compliance is not optional. StartComply automates the entire NIS2 compliance programme, from risk assessments to audit-ready evidence, so your team spends time on decisions, not data entry.
Trusted by 100+ organisations across Europe
NIS2 
Article 21 
24h reporting 
Audit-ready evidence What you need to know about NIS2 compliance
- NIS2 applies to essential and important entities across 18 sectors in the EU, with fines up to €10 million or 2% of global annual turnover for essential entities.
- Article 21 sets out mandatory cybersecurity risk-management measures including supply chain security, access control, incident handling, and cryptography.
- Incident reporting requires a 24-hour early warning, a 72-hour detailed notification, and a one-month final report to national CSIRTs or competent authorities.
- Senior management face personal liability under Article 20 if they fail to approve and oversee cybersecurity measures.
- NIS2 compliance must be continuously evidenced, not just implemented. Regulators audit controls in operation, not policies on paper.
- Organisations subject to both NIS2 and ISO 27001 or DORA should use a unified control framework to avoid duplicating compliance effort.
- National transposition deadlines were October 2024. Organisations that have not yet started their NIS2 programme are already behind.
Source: NIS2 compliance content brief. Last updated January 2025.
NIS2 compliance is mandatory. Regulators will ask for evidence.
A documented, evidenced, continuous cybersecurity programme
- Policies on risk analysis and information system security
- Incident handling, business continuity, and crisis management
- Supply chain security for direct suppliers and service providers
- Network security, access control, asset management, and cryptography
- Multi-factor authentication, cyber hygiene, and regular cybersecurity training
Audit reality: each measure must be evidenced, not just implemented. A policy document sitting in a shared drive does not count as evidence of an operational control.
Annual spreadsheets, shared drives, and manual chasing
- Static risk registers reviewed once a year
- No clear proof that controls operated on a specific date
- Vendor assessments stuck in email threads
- Incident reporting decisions debated during live incidents
- Board training and approvals tracked outside the evidence pack
- No unified control framework across NIS2, ISO 27001, and DORA
The risk: regulators audit controls in operation, not policies on paper.
How StartComply Automates NIS2 Compliance
Scope Confirmation
Map the entity against all 18 NIS2 sectors, apply size thresholds, and document the rationale as an auditable artefact.
- Confirm whether your organisation is essential or important
- Document subsidiaries, service lines, and sector mapping
- Keep scope decisions version-controlled and audit-ready
Article 21 Control Mapping
Every NIS2 Article 21 measure is pre-mapped in the platform. Control owners are automatically assigned, evidence requests are generated, and gaps are flagged in real time.
- Risk analysis and information system security
- Incident handling and business continuity
- Access control, asset management, cryptography, and cyber hygiene
Incident Reporting Workflows
When a significant incident occurs, StartComply triggers the 24-hour early warning checklist, tracks the 72-hour notification deadline, and generates the one-month final report template.
- Pre-defined incident response playbooks
- Clear escalation paths and notification templates
- Deadline tracking before anything falls through the gaps
Audit-Ready Evidence Collection
Logs, policies, training records, vendor assessments, penetration test reports, and incident records must be organised, version-controlled, and instantly retrievable.
- Evidence requests generated automatically
- Control status visible in real time
- One evidence trail across NIS2, ISO 27001, and DORA where requirements overlap
StartComply vs. The Alternatives
Not all NIS2 compliance approaches produce the evidence regulators expect.
StartComply was built for European organisations that need NIS2 compliance to be operational, evidenced, and continuously maintained.
What Is NIS2 and Who Does It Affect?
NIS2 replaces the original NIS Directive from 2016. It dramatically expands scope, tightens obligations, and introduces direct liability for senior management. If you thought NIS1 did not apply to your organisation, check again. NIS2 covers 18 sectors, ranging from energy, transport, and banking through to digital infrastructure, managed services, and public administration.
Entities fall into two categories: essential and important. Essential entities face stricter supervision, including proactive audits. Important entities face lighter-touch, reactive oversight. But both categories carry the same core obligations under NIS2 Article 21. The line between them is drawn by size, revenue, and criticality to national infrastructure. Most medium and large enterprises will find themselves in scope.
For a full breakdown of the directive’s origins, scope, and legal status, use the dedicated NIS2 guide links later on this page.
NIS2 is a board-level governance obligation. Under Article 20, management bodies must approve cybersecurity risk-management measures and oversee their implementation.
NIS2 Incident Reporting: Timelines That Matter
Within 24 hours 24h
Submit an early warning within 24 hours of becoming aware of the incident.
Within 72 hours 72h
Submit a more detailed incident notification within 72 hours, including an initial assessment of severity and impact.
Within one month 1 month
Submit a final report covering a full description of the incident, its root cause, and the measures taken.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About NIS2 Compliance
Who is in scope for NIS2 compliance in the EU?
NIS2 applies to medium and large entities operating in 18 designated sectors, including energy, transport, banking, digital infrastructure, healthcare, and managed services. Entities are classified as either essential or important based on their size, revenue, and criticality. Essential entities face proactive supervision; important entities face reactive oversight. Both carry the same core obligations under NIS2 Article 21. Small enterprises are generally out of scope unless they are sole providers of a critical service in a member state.
What are the NIS2 incident reporting deadlines?
NIS2 sets a three-stage reporting process for significant incidents. Organisations must submit an early warning to their national CSIRT or competent authority within 24 hours of becoming aware of the incident. A more detailed incident notification follows within 72 hours. A final report covering root cause, impact, and remediation measures must be submitted within one month. Missing any of these deadlines is a separate compliance failure from the incident itself and can attract independent penalties.
What is the difference between essential and important entities under NIS2?
Essential entities are subject to proactive, ongoing supervision by national authorities, including regular audits. Important entities are subject to reactive supervision, meaning authorities investigate only when there is evidence of non-compliance or following an incident. However, both categories must meet the same cybersecurity obligations under Article 21 and face substantial fines for non-compliance. The key difference is the intensity of regulatory scrutiny, not the content of the obligations.
Can senior managers be personally liable under NIS2?
Yes. NIS2 Article 20 requires management bodies to approve cybersecurity risk-management measures and personally oversee their implementation. If a management body fails in this duty and a significant incident or compliance failure occurs, national authorities can hold individual managers personally liable. Temporary bans from management positions are a specific enforcement tool available to regulators. This makes NIS2 a board-level governance obligation, not just a technical or operational one.
How does NIS2 relate to ISO 27001 and DORA?
There is significant overlap between NIS2 Article 21 requirements and the controls in ISO 27001:2022. Many organisations subject to NIS2 are also subject to DORA if they operate in the financial sector. A unified control framework maps all three sets of requirements to a single control library, so evidence collected for one framework satisfies the others where requirements overlap. This approach avoids duplicating effort across separate compliance programmes and makes audit responses faster and more consistent.
What happens if a member state has not yet transposed NIS2 into national law?
Several EU member states missed the October 2024 transposition deadline. However, the NIS2 Directive itself has direct effect in many legal interpretations, meaning in-scope organisations cannot rely on delayed transposition as a reason to defer their compliance programmes. National authorities in countries that have transposed are already conducting oversight activity. Organisations with cross-border operations must also track variations in national implementing legislation, as some member states have introduced additional requirements beyond the directive’s minimum standards.
Stop Managing NIS2 Compliance with Spreadsheets.
Essential and Important Entities Under NIS2
Entities fall into two categories: essential and important. Essential entities face stricter supervision, including proactive audits. Important entities face lighter-touch, reactive oversight. But both categories carry the same core obligations under NIS2 Article 21.
The line between them is drawn by size, revenue, and criticality to national infrastructure. Most medium and large enterprises will find themselves in scope.
Personal liability is real. Management bodies must approve cybersecurity risk-management measures and oversee their implementation. This is no longer just an IT department problem.
NIS2 Compliance Timeline and National Transposition
The EU’s Network and Information Security Directive 2 came into force.
EU member states were required to transpose NIS2 into national law.
National authorities across EU member states are building dedicated NIS2 inspection teams and beginning oversight activity.
Do not wait for your national authority to send you a letter. Organisations that have not yet started their NIS2 programme are already behind.
Operating across multiple EU member states? National implementing legislation may introduce variations in how obligations are applied, which authority to notify, and what the registration requirements are.
Building an Audit-Ready NIS2 Compliance Programme
An audit-ready NIS2 compliance programme has five operational components. None of these steps are one-time activities. All five must run continuously.
Scope confirmation
Map the entity against all 18 NIS2 sectors, apply the size thresholds, and document the rationale.
Risk assessment
Maintain ongoing risk analysis as threats evolve and your environment changes.
Control implementation
Map every control directly to Article 21 measures, with an owner, operational status, and evidence of operation.
Evidence collection
Keep logs, policies, training records, vendor assessments, penetration test reports, and incident records organised and retrievable.
Incident response readiness
Prepare playbooks, escalation paths, classification logic, and notification templates before an incident occurs.
