The common first time NIS2 mistakes are assuming you are out of scope, relying on EU wide rules instead of national law, keeping the board out of it, never rehearsing the 24 and 72 hour reporting clocks, and treating suppliers as someone else's problem. The directive text is plain on each.
Mistake 1: assuming you are out of scope
The Commission describes NIS2 as covering 18 critical sectors, with medium sized and large entities in those sectors as the general rule, plus some smaller ones that play a key role. Cloud computing providers, managed service providers and manufacturers of critical products are among the named types. Check your sector and size against the annexes, and check how your member state applied them. Vendors that sell to in scope customers also feel the effect through contracts.
Mistake 2: reading only the directive
A directive becomes enforceable through national law. Member states had until 17 October 2024 to transpose it, and the Commission has since proposed amendments to simplify some rules. Registration duties, supervisory bodies and penalties differ by country. Read the law and guidance of each country where you operate, and note the entity category, essential or important, because supervision differs.
Mistake 3: leaving management out
Article 20 says management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. Members must also follow training. A security team that writes policy alone is missing a legal step. Put an approval record and a training record in the evidence folder.
Mistake 4: a policy pile instead of the ten measures
Article 21(2) lists the minimum areas: risk analysis and system security policies, incident handling, business continuity, supply chain security, secure acquisition, development and maintenance including vulnerability handling, ways to assess whether the measures work, basic hygiene and training, cryptography, human resources security with access control and asset management, and multi-factor authentication where appropriate. Measures must be proportionate to risk and size. Map each area to a named control and owner.
Mistake 5: untested reporting clocks
For a significant incident, Article 23 requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month after that notification. An incident is significant if it caused or can cause severe operational disruption or financial loss, or considerable damage to others. First timers write the procedure and never run it. Hold a tabletop drill and time how long it takes to decide that something is significant, who files, and where.
Mistake 6: nothing on suppliers
Article 21(3) asks you to consider the vulnerabilities specific to each direct supplier and the overall quality of their products and cybersecurity practices, including secure development. Build a supplier list, rank by criticality, add security terms to contracts, and collect evidence from the top tier. Dependencies in your own software count here too.
Mistake 7: nobody measures effectiveness
Article 21(2)(f) calls for policies and procedures to assess how well the measures work. That means testing, internal review, metrics and corrective action under Article 21(4), which expects non compliance to be corrected without undue delay. Schedule reviews and keep the results.
Mistake 8: assuming ISO 27001 settles it
Recitals encourage the use of European and international standards, which makes ISO 27001 a good base. It is not a legal safe harbour. You still need the reporting process, management accountability and national registration.
What to do
- Determine sector, size and essential or important status per country.
- Read the national transposition law.
- Get management approval and training on record.
- Map Article 21(2) areas to controls and owners.
- Draft and rehearse the 24 hour, 72 hour and one month reports.
- Build and tier the supplier list.
- Schedule effectiveness reviews.
Quick check
What are the NIS2 fine ceilings?
The directive sets maximums of at least EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4 percent for important entities, whichever is higher. Member states set the exact national rules.
Does an early warning need full details?
No. The recitals say it should contain only what the authority needs to be aware of the incident and let you seek help. Detail follows in the 72 hour notification.
How Safeguard helps automate this
Several of these fixes need evidence that keeps flowing. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews. For the supplier and secure development duties, technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, so you can answer which third party components are exposed. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Supervisors and independent assessors judge compliance, not Safeguard.
Sources
Last reviewed: 18 October 2026.
