NIS2 has no certificate to pass, so continuous monitoring is the whole job. After your first compliance push, keep the Article 21 risk measures operating, keep incident reporting ready to meet the 24 hour and 72 hour deadlines, and keep management approving and overseeing the work.
Why is there nothing to "pass"?
NIS2 is an EU directive (2022/2555). Member States turn it into national law and their authorities supervise. National rules differ, so check your own country's transposition and which authority or CSIRT you report to. We could read the directive text on EUR-Lex, but not every national law, so this guide sticks to what the directive itself says.
What must keep running?
Article 21(2) lists the minimum measures, under an all hazards approach:
- policies on risk analysis and information system security
- incident handling
- business continuity (backups, disaster recovery) and crisis management
- supply chain security
- security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
- policies to assess whether the measures work
- basic cyber hygiene and training
- cryptography and encryption policies
- human resources security, access control and asset management
- multi-factor or continuous authentication where appropriate
Item six is the monitoring clause. You need a repeatable way to test your own controls, and records that you did.
What does the reporting clock look like?
Article 23(4) sets three steps for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. If the incident is still running, a progress report is due and the final report follows within a month of handling it.
You cannot build that process during an incident. Write it, name who decides what counts as significant, and rehearse it.
How do you test that the measures work?
Pick one check per Article 21(2) item and make it produce a dated record. For incident handling, run a tabletop and keep the notes. For continuity, restore a backup into a clean environment and record the time it took. For access control, export users and compare against HR. For supply chain security, track which suppliers hold data and when you last reviewed them. For vulnerability handling, keep scan history and the time from finding to fix. Small, regular, recorded checks beat one large annual exercise.
What does management have to do?
Article 20 says management bodies approve the risk measures, oversee their implementation and can be held liable for infringements. They must also follow training. Put a quarterly review on the board calendar, with a short dashboard of control test results, open incidents and supplier issues. Keep the minutes.
A monitoring rhythm that works
Continuous or daily: configuration and access checks, vulnerability findings, backup job status, alert triage.
Monthly: supplier changes, patch compliance, open risk items, incident log review.
Quarterly: access reviews, a reporting drill, management review of results.
Yearly: risk analysis refresh, business continuity test, policy approval, management training.
Mistakes to avoid
- Treating the first gap assessment as the finish line.
- Counting a policy as a control. A policy that nobody tests is not evidence.
- Forgetting suppliers after onboarding them.
- Having no named person who can file the 24 hour early warning on a weekend.
What to do
- Confirm your national authority, reporting channel and whether you are essential or important.
- Map each Article 21(2) item to an owner and a test.
- Schedule the daily, monthly, quarterly and yearly checks above.
- Write and rehearse the 24 hour, 72 hour and one month reporting process.
- Put management approval and training on the calendar, with minutes.
- Keep a register of control test results and fixes.
- Review the register for trends before each management meeting.
Quick check
Is there a NIS2 certification?
The directive does not create a certificate. National authorities supervise compliance. Customers may still ask for evidence or an independent report, but that is a commercial request, not a NIS2 pass.
What are the NIS2 incident reporting deadlines?
For significant incidents: an early warning within 24 hours, a notification within 72 hours, and a final report within one month of the notification (Article 23(4)).
How Safeguard helps automate this
Continuous monitoring is where a spreadsheet stops scaling. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and checks keep running between reviews. That gives your team time to focus on incidents and suppliers.
For the vulnerability handling and secure development items, technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you pick which categories run automatically and the approval level. Safeguard helps you keep evidence ready. Your national authority supervises NIS2, and Safeguard does not make you compliant.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
