A 12 week NIS2 plan can cover scope and legal status in weeks one to two, risk and gap analysis in three to four, policies and controls in five to eight, suppliers and incident drills in nine to ten, and management approval in eleven to twelve. It is a template, not a promise.
How should you read this calendar?
No source sets a standard duration for NIS2 readiness. The calendar below is a way to order the work that Articles 20, 21 and 23 of the directive require. Stretch it if you have many systems, and compress it if you already hold ISO 27001 style controls. Assign an owner to every week.
Weeks 1 to 2: scope and status
Work out whether you are in scope: sector, entity type and size. Identify the country of main establishment and every country where you operate. Find the national transposition law and the competent authority. Decide whether you are an essential or important entity, because supervision is heavier for essential ones. Record the answer, with the legal reasoning, in one page that management signs. Owner: legal or compliance lead.
Weeks 3 to 4: risk and gap analysis
List network and information systems, data and critical services. Run a risk assessment using an all hazards view, because Article 21(2) says measures should cover the systems and their physical environment. Compare current practice against the ten areas in Article 21(2). Mark each as in place, partial or missing. Owner: security lead.
Weeks 5 to 6: policies and core controls
Write or update the policies the gap review demands: risk and system security, incident handling, business continuity and backups, access control and asset management, cryptography, vulnerability handling, secure development and acquisition. Turn on multi-factor authentication where it is missing. Keep policies short and tied to controls someone actually runs. Owner: security lead with engineering.
Weeks 7 to 8: operational controls
Set up logging and alerting, patching and vulnerability handling with defined timelines, backup restore tests, and basic hygiene training for all staff. Plan management level training, since Article 20 expects it. Owner: IT operations.
Weeks 9 to 10: suppliers and incident reporting
Build a supplier register, tier it by criticality, and review the top tier: contract security terms, evidence of their practices, secure development. Write the incident reporting procedure for the three stages: 24 hour early warning, 72 hour notification, final report within one month of the notification. Run a tabletop drill, record the timings and fix what fails. Owner: procurement with security.
Week 11: effectiveness checks
Article 21(2)(f) asks for ways to assess whether measures work. Run an internal review of a sample of controls, log findings, and open corrective actions as Article 21(4) expects. Owner: someone independent of the control owners where possible.
Week 12: approval and evidence review
Present risk results, measures and gaps to management for approval and record the decision, since Article 20 makes management responsible for approving and overseeing the measures. Check the evidence folder is complete and dated. Register with the national authority if the law requires it. Owner: executive sponsor.
What usually goes wrong with the calendar?
The first slip is week one. Scope questions turn out to involve a parent company, a subsidiary in another country and a shared service centre, and each may sit under a different national regime. Give legal a full two weeks and accept a partial answer to move on.
The second slip is policy writing that runs ahead of reality. A policy that promises quarterly access reviews creates a control you must then run. Write what you will do, then do it, then keep the dated proof.
The third is the supplier review, because vendors answer slowly. Send the first questionnaires in week five so replies arrive by week nine. For vendors that cannot answer, record a risk decision with an owner and a date to revisit.
The fourth is the incident drill. Pick a realistic scenario, such as a ransomware infection of one business system, and walk it through. Note when the team would have known the incident was significant, who would have drafted the early warning, and which contact details were missing. Fix those and repeat the drill within the year.
What to do
- Confirm scope, status and national law in two weeks.
- Complete risk assessment and gap review by week four.
- Finish policies and core controls by week eight.
- Tier suppliers and run an incident drill by week ten.
- Review effectiveness in week eleven.
- Get management approval and keep the evidence trail in week twelve.
- Schedule a repeat of the cycle every year or when systems change.
Quick check
Is 12 weeks a legal deadline?
No. It is a planning template. The legal obligations apply under your national law already.
Who signs off the measures?
Article 20 says the management bodies approve the measures and oversee their implementation.
How Safeguard helps automate this
The calendar's heavy middle is steady evidence gathering. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring continues after week twelve. That saves time for the work that needs judgement, like supplier decisions. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready, while regulators and assessors make their own judgement.
Try the framework mapping demo full screen.
Sources
Last reviewed: 18 October 2026.
