NIS2 Readiness

NIS2 Readiness

NIS2 regulates the organisation, not the product. That is why it gets missed by teams who scope their software carefully: the duty attaches to the entity, it brings personal accountability for management, and a large number of ordinary SaaS companies are "cloud computing service providers" or "managed service providers" under Annex I without ever having thought of themselves that way.

It is also a Directive. The binding text is your Member State's transposition, transpositions differ, and several were late. Anyone quoting the Directive at you as if it were directly applicable has skipped a step.

Not legal advice. Whether an entity is in scope, and as essential or important, is decided by national law. This skill produces the scoping questions, the measure-by-measure gaps and the reporting machinery.

  sector (Annex I / II) × size cap ──► in scope? ──no──► exclusion + expires_if
        │ yes                                             (the 50th hire)
        ▼
  essential or important ──► supervision regime, penalty ceiling
        │
        ▼
  Art. 20  management approval + training   ──► personal liability
  Art. 21  the ten measures                 ──► policies + evidence
  Art. 23  24h / 72h / one month            ──► runbook, tested

Use this when

• The entity is in an Annex I or II sector, or might be: cloud, data centres, CDNs, DNS, managed IT or security services, digital infrastructure, health, energy, transport, banking, water, public administration, postal, waste, chemicals, food, manufacturing, online marketplaces, search, social platforms, research.
• Headcount or turnover has crossed, or is about to cross, the medium-enterprise cap.
• An enterprise customer's security questionnaire has started asking about NIS2, which is how most companies find out they are in someone's supply chain and therefore in their Art. 21(2)(d) assessment.

Do not use this when the entity is below the size cap in every Member State of establishment and in no Annex I or II sector — but record that exclusion with a machine-evaluable expires_if, because it is the single most likely exclusion in this repo to expire silently.

Note two things that override the size cap: Member States may designate specific entities regardless of size, and certain entity types (DNS service providers, TLD registries, trust service providers, some public administration) are in scope irrespective of size. Check the national law, not the Directive.

Ask first

1. "Headcount, annual turnover, and balance sheet total — at group level?" The medium-enterprise cap is OR: 50 or more staff, or turnover above €10M, or balance sheet above €10M. A subsidiary under the cap inside a group above it is usually not exempt.
2. "Does any part of the business provide cloud computing, data centre services, managed IT or security services, a CDN, DNS, or an online marketplace, search engine or social network?" Read it as a list. "We're a SaaS company" is often a cloud computing service provider under Annex I and the founders do not know it.
3. "Which Member States are you established in?" Decides which transposition binds and which authority supervises. For some digital providers, jurisdiction follows the main establishment.
4. "Has your board or management body formally approved the cybersecurity risk management measures, and have they been trained?" Art. 20. Personal accountability, and usually the first thing a supervisor asks for. "The CTO looked at it" is not board approval.
5. "Who are your critical suppliers, and when did you last assess their security?" Art. 21(2)(d) supply chain security, which is also what your own customers are now asking you about.
6. "If you detected a significant incident at 02:00 on a Saturday, who decides whether to report, and how long would it take to reach them?" The 24-hour clock is the part of NIS2 most likely to be missed in practice.

What the law requires

Directive (EU) 2022/2555. Transposition was due 17 October 2024; several Member States were late and the national texts differ. Verify against the national law for each Member State of establishment, and say so where you could not read it.

Essential vs important does not change the measures. It changes supervision (proactive for essential, reactive for important) and the penalty ceiling (€10M/2% versus €7M/1.4%).

Art. 20 — governance

Management bodies must approve the risk-management measures, oversee their implementation, and can be held liable for infringements. They must follow training, and are required to offer similar training to staff. This is not delegable to the security team, and evidence of it — a dated board minute — is the artifact.

Art. 21(2) — the ten measures

Work them as a checklist with an owner and evidence for each. "All-hazards" is the stated standard, so this is broader than cyber.

Two that get skipped: (c) requires the restore to have been tested — an untested backup is not business continuity — and (j) requires emergency communications that work when your primary systems are down, which means not the Slack that the ransomware encrypted.

Art. 23 — reporting

To the CSIRT or competent authority, for a significant incident:

An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss, or considerable material or non-material damage to others. Recipients of your services may also have to be told where the incident could adversely affect them.

What to produce

1. The scoping decision, with the arithmetic shown:

nis2:
  in_scope: true
  sector: "Annex I - digital infrastructure / cloud computing service provider"
  sector_reasoning: "multi-tenant hosted platform with self-service provisioning"
  size: {headcount: 74, turnover_eur: 11200000, balance_sheet_eur: 8400000}
  size_rule: "headcount >= 50 OR turnover > 10M OR balance sheet > 10M"
  classification: "important"          # essential vs important: national criteria
  member_states: [FI, DE]
  national_law_checked: {FI: "2026-09-12", DE: null}   # be honest about the gap
  source: {kind: answered, question: E-02}

2. A measure register, one row per Art. 21(2) point, with an owner, an evidence path and a status. deferred is an allowed status only with an owner and a date — a measure with no owner is not deferred, it is absent.

3. The reporting runbook, with the clocks pre-computed and the decision authority named:

from datetime import datetime, timedelta

def nis2_clocks(aware_at: datetime) -> dict[str, datetime]:
    """From awareness, not from triage, not from confirmation."""
    return {
        "early_warning": aware_at + timedelta(hours=24),
        "notification": aware_at + timedelta(hours=72),
        "final_report": aware_at + timedelta(hours=72) + timedelta(days=30),
    }

Put the decision authority and their deputy in the runbook by name, with phone numbers, and put the runbook somewhere reachable when the network is down. See skills/incident-response for how this clock interacts with GDPR's 72 hours and the CRA's 24 — they run concurrently, from different trigger events, to different regulators.

4. Board evidence. A dated minute recording approval of the measures and the training completed. One paragraph, and it is the first thing asked for.

5. A supplier register with the last assessment date per critical supplier. This doubles as the answer to your own customers' questionnaires, which is the easiest internal justification for doing it.

Every assessment carries a certainty. Each finding, each applicable or ruled-out regime, and the headline of the brief carry certainty (0–100) — the honest percent of the assessment that rests on verified sources and confirmed facts rather than inference, open unknowns and interpretation. Wherever you state an applicability, a classification, a citation-backed obligation or a finding, show the percentage and the single largest reason it is not higher: "ruled out NIS2 — certainty 66%: the national transposition was not read". references/certainty.md holds the anchors; the rules that matter here: an answer graded UNKNOWN caps anything resting on it at 70, an unread Directive transposition caps at 60, a classification pending counsel caps at 50, and a 100 requires every deciding fact SPECIFIC, every citation verified on EUR-Lex, every transposition read and every regime screened. Certainty is visibility, not a free pass — VAGUE stays rejected, an open blocker stays blocked.

Failure modes

• "We're a SaaS company, not critical infrastructure." Cloud computing service providers are Annex I. So are managed service providers, data centres, CDNs and DNS providers. The sector list decides, not self-image.

• Reading the Directive instead of the national law. Transpositions differ on registration deadlines, on which entities are designated regardless of size, and on penalties. Name the Member State and say when you could not read its law.

• Size cap as AND. It is OR. Fifty staff alone puts you over, whatever the turnover.

• Group-level figures ignored. A 20-person subsidiary of a 2,000-person group is usually not exempt.

• No board approval. Art. 20 is not delegable and carries personal liability. A security team that has done all ten measures without a board minute has missed the article the supervisor will ask about first.

• Untested backups counted as continuity. Measure (c) needs a dated, successful restore test.

• Emergency comms that depend on the compromised system. Measure (j) specifically contemplates communications that survive the incident.

• Discovering the 24-hour clock during the incident. It starts at awareness. Name the decision-maker in advance and drill it.

• Confusing NIS2 with the CRA. NIS2 is the organisation and its services; the CRA is the product you ship. Many companies owe both, to different regulators.

Verify

Follow references/verification.md. For this skill specifically:

1. Tier 0 — install, --help, scope a fixture entity and emit the measure register.

2. Tier 1 — pytest -q, offline:

def test_size_cap_is_or_not_and():
    assert in_scope_size(50, 0, 0) is True
    assert in_scope_size(10, 10_000_001, 0) is True
    assert in_scope_size(49, 9_999_999, 9_999_999) is False


def test_group_figures_are_used_when_present(entity_in_group):
    assert scope(entity_in_group).in_scope is True


def test_saas_is_classified_as_cloud_computing(brief_multitenant_saas):
    result = scope(brief_multitenant_saas)
    assert "Annex I" in result.sector
    assert "cloud" in result.sector.lower()


def test_exclusion_records_a_machine_evaluable_expiry(brief_small):
    exclusion = scope(brief_small).exclusion
    assert "headcount >= 50" in exclusion["expires_if"]
    assert evaluate(exclusion["expires_if"], {"headcount": 50}) is True


def test_all_ten_measures_are_present(register):
    assert len(register) == 10
    assert {row.point for row in register} == set("abcdefghij")


def test_a_measure_without_an_owner_is_not_deferred(register):
    row = register.by_point("d")
    row.status, row.owner = "deferred", None
    assert validate(row)[0].severity == "condition"
    assert "owner" in validate(row)[0].needs


def test_untested_backup_fails_continuity(register):
    row = register.by_point("c")
    row.evidence = {"backups_configured": True, "last_restore_test": None}
    assert validate(row)[0].statement.startswith("No successful restore test")


def test_clocks_are_computed_from_awareness():
    clocks = nis2_clocks(datetime(2026, 9, 15, 2, 0))
    assert clocks["early_warning"] == datetime(2026, 9, 16, 2, 0)
    assert clocks["notification"] == datetime(2026, 9, 18, 2, 0)
    assert clocks["final_report"] == datetime(2026, 10, 18, 2, 0)


def test_missing_board_approval_is_a_condition(brief_no_board_minute):
    finding = assess(brief_no_board_minute).finding_for("Art. 20")
    assert finding.severity == "condition"
    assert "management body" in finding.statement


def test_national_law_gap_is_reported_not_assumed(brief_two_states):
    report = render(scope(brief_two_states))
    assert "could not verify the national transposition for DE" in report


def test_no_legal_conclusion_about_scope(brief):
    text = render(scope(brief)).lower()
    assert "you are not in scope" not in text
    assert "candidate" in text or "must be confirmed" in text

3. Tier 2 — report: sector and size arithmetic, essential/important, the ten measures by status, suppliers assessed versus total, and whether a reporting drill has ever been run. The measure count at deferred with no owner is the number that predicts trouble.

4. Tier 3 — run a reporting drill. Pick a scenario, start the clock at 02:00, and measure how long it actually takes to reach the named decision-maker and produce a submittable early warning. Twenty-four hours is less time than it sounds like when it starts on a Friday night.

Then tell the user which national transpositions you could not read, and that scope and classification need confirming under national law rather than from the Directive.