If you are a first security hire and your employer may fall under NIS2, start with scope, not controls. Find out whether the company is an essential or important entity, which national law applies, who in management is accountable, and who can file an incident report within 24 hours.
Why scope comes first
NIS2 is an EU directive, which means each Member State wrote it into national law. The European Commission describes it as a unified framework for 18 critical sectors, with medium and large entities in those sectors as the rule. Member States were to apply their measures from 18 October 2024. A company with offices in three countries may face three slightly different texts.
So your first week is a conversation with legal, not a gap assessment. Ask which sector the company is in, its size, and where it provides services.
What does the directive ask for?
Three families of duties come up again and again.
Risk management measures. The text calls for appropriate and proportionate technical, operational and organisational measures, built on an all hazards approach. Supply chain security is named explicitly.
Reporting. A significant incident needs an early warning within 24 hours of awareness, a notification within 72 hours and a final report within one month of the notification.
Accountability. Management bodies must approve and oversee the measures, and the Commission highlights top management accountability as new compared with the earlier directive.
A constructed first month
Constructed example: you join a 300 person software company that offers services to energy utilities. Here is how a reasonable first month could go.
Week 1: Meet legal and the CEO. Record the scope answer in a short memo, even if the answer is "probably, pending counsel".
Week 2: List who currently knows what. Who runs production, who talks to customers during an outage, who would decide an event is significant. If these are different people, put their numbers in one document.
Week 3: Draft a one page incident procedure and walk through it with a fake event. Time how long each step takes.
Week 4: Present three findings to management with an owner each. Keep it to three. A long list will not get decisions.
Which controls first?
You will be tempted to buy tools. Resist for a month. The cheapest early gains are usually:
- Multi-factor authentication on email, source control, CI and cloud consoles.
- A current asset and software inventory.
- Offline or immutable backups, and one tested restore.
- A patching routine with owners.
- A supplier list that records who has access to what.
For the software you ship or run, a dependency inventory is a quick way to answer supply chain questions. Safeguard can generate SBOMs and scan dependencies, and its free browser scan at gold.safeguard.sh/scan covers up to 100 dependencies if you want a first look.
What about penalties?
For essential entities, the directive sets a maximum fine of at least 10 million euros or 2 percent of total worldwide annual turnover, whichever is higher. National laws set the actual levels and enforcement approach. Use this fact to get attention, not to frighten people.
What to do
- Get a written scope answer from legal, naming the national law.
- Identify the management owner for NIS2 decisions.
- Draft and drill a one page incident procedure with named filers.
- Put basic controls (MFA, backups, inventory, patching) on a dated plan.
- List suppliers with access to your systems or data.
- Review progress with management every quarter.
Quick check
Is NIS2 a regulation or a directive?
It is a directive, Directive 2022/2555, so national laws implement it. That is why you must read your country's version.
Who is accountable under NIS2?
The Commission says the directive introduces accountability of top management for non-compliance with risk management measures, so a senior owner should be named.
Sources
Last reviewed: 18 October 2026.
