To implement NIS2 yourself, confirm whether you are an essential or important entity under your country's law, get management to approve the measures, cover the ten risk-management areas in Article 21(2), and build an incident process that can send an early warning within 24 hours. National transposition laws decide the details, so read yours.
NIS2 is Directive (EU) 2022/2555. We fetched the EUR-Lex text on 18 October 2026. A directive binds member states, so your obligations arrive through national law. This guide follows the directive and is not legal advice.
Step 1: Work out if and how you are covered
Coverage depends on sector, size and national law. Check your member state's transposition and your competent authority's registration process. If you serve customers in several states, check each.
Step 2: Get management to own it
Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee their implementation, and be answerable for infringements. Management members must complete training. Put approval and training on the board agenda and minute both.
Step 3: Cover the ten measure areas
Article 21(2) says measures must be all-hazards and include at least these areas:
- (a) risk analysis and information system security policies
- (b) incident handling
- (c) business continuity, including backup management, disaster recovery and crisis management
- (d) supply chain security, including direct suppliers and service providers
- (e) security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
- (f) policies and procedures to assess whether the measures work
- (g) basic cyber hygiene and cybersecurity training
- (h) cryptography and, where appropriate, encryption
- (i) human resources security, access control and asset management
- (j) where appropriate, multi-factor or continuous authentication, secured communications and emergency communications
Build a table with one row per letter: owner, current state, gap, evidence.
Step 4: Proportionality
Document why each measure fits your size, exposure and risk. Proportionate does not mean skipped, so every area needs an answer, even if the answer is a short one.
Step 5: Supplier security
Assess your direct suppliers, set security terms in contracts, and keep a register with the services each one provides. Recital 85 mentions assessing suppliers' cybersecurity practices.
Step 6: Incident reporting
Article 23(4) sets the timeline for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, a final report within one month of the notification, and an intermediate report if the authority asks. Write a decision tree for what counts as significant under your national rules, name who files, and save templates.
Step 7: Rehearse
Run a tabletop where the clock starts when someone says "we think this is an incident". Time how long it takes to produce the 24 hour message.
Step 8: Test effectiveness
Item (f) means you need your own checks: internal audits, control tests, vulnerability scans. Keep the results.
Step 9: Register and report as required
Follow your authority's registration and contact process.
Step 10: Keep evidence and review
Review the table at least yearly and after major changes.
What to do
- Find your national law and authority this week.
- Brief and train management, and minute it.
- Fill the ten-row table.
- Write an incident reporting procedure with the three deadlines.
- Add a supplier register and contract clauses.
- Rehearse, fix the gaps, and set the review date.
Quick check
What are the NIS2 incident reporting deadlines?
For significant incidents, Article 23(4) sets an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report no later than one month after the notification.
Is NIS2 a certification?
No. It is a directive implemented through national law. Supervision is by national authorities, and you do not receive a certificate from the directive itself.
How Safeguard helps automate this
NIS2 covers vulnerability handling, supply chain security and effectiveness checks, and those need recurring proof. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, leaving time for other work. Technical evidence comes from real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Your competent authority and any independent assessor decide compliance. Book a call to see it.
Sources
- EUR-Lex: Directive (EU) 2022/2555 (NIS2), fetched 18 October 2026 (Articles 20, 21, 23 and recitals)
Last reviewed: 18 October 2026.
