What NIS2 requires and who it affects
NIS2 requires companies in certain sectors to take appropriate cybersecurity measures, usually organised in ten areas: from risk analysis and incident handling through business continuity and supply chain to access control and encryption.
The instant check on the homepage helps you estimate your classification. If you want a binding answer, you can use the BSI scope check (open the check) or ask your own legal advisor.
Incidents: speed counts
The part most often underestimated in practice is speed after a significant security incident. A staged procedure is usually provided for: an early report within 24 hours, a report with a first assessment within 72 hours and a final report after about one month. The legal text is authoritative.
These deadlines are hard to rehearse for the first time under stress. The question is therefore not only whether a reporting duty exists, but whether you can meet it in practice. You will find an incident-reporting card to fill in within the instant check.
The role of management
NIS2 puts management at the centre: it is responsible for ensuring that security measures are implemented and overseen, and is expected to be trained regularly. That does not mean it has to master technical detail. It must understand and prioritise risk and document decisions in a traceable way.
Relationship to ISO 27001
Companies certified to ISO 27001 or running an ISMS have a solid basis. An ISMS does not automatically cover everything NIS2 adds, though. Typical gaps fall into four areas:
Reporting processes
Incident management is part of ISO 27001. The staged reporting deadlines and a rehearsed reporting path often are not.
Supply chain
Both address suppliers. Whether the scope and depth of your assessment suffice should be checked.
Management
ISO 27001 requires leadership accountability. NIS2 additionally stresses oversight and training of management.
Registration and evidence
Registration with the supervisory authority and evidence handling are among the NIS2-specific topics.
How a gap analysis works
At its core, five steps: inventory of relevant systems and processes, comparison against the requirements, identification of concrete gaps, criticality assessment and a prioritised action plan for management. Scope depends heavily on size, sector and number of locations. That is quicker to gauge in a short conversation than from a generic description.
Where most gaps sit
A few patterns repeat across practical work with mid-sized companies:
- Reporting processes exist on paper but have never been tested under real time pressure.
- Supply-chain risks are recorded once but not updated regularly.
- Responsibilities are handled informally and not documented. In an actual incident it is unclear who decides.
- Management training happens, but without traceable documentation.
Which of these gaps weighs most for you depends on sector, size and existing maturity.
Instant check: a briefing for your management
Instead of counting yourself: the instant check on the homepage gives a classification with reasoning, shows the usual duties, orders your gaps by urgency and delivers an incident-reporting card to fill in. Free, print-ready, and your answers never leave the browser.
Go to the instant checkFrequently asked questions
Is this legal advice?
No. We are auditors and consultants, not lawyers. We review evidence and maturity and place where you stand. Legally binding questions are for your legal advisor or the competent supervisory authority.
Is ISO 27001 alone enough?
It is a good starting point but does not automatically cover everything. The remaining gaps can usually be closed in a targeted way, without a complete rebuild.
We have not done anything yet. Where do we start?
Get an overview: in scope or not, where the biggest gaps are, who in management is responsible. The instant check gives a first structure for that.
Do we need an external advisor right away?
Not necessarily for a first overview: the instant check gives a free initial read. For the full gap analysis and documentation, external experience is usually the faster route.
Clarity instead of assumptions
A free, no-obligation conversation is enough to place your specific situation.
Go to the instant check View servicesPrefer to write? n.riveros@natalia-riveros.com
As of October 2026. This page is general orientation and not legal advice. We are auditors and consultants, not lawyers. The legal text and the statements of the supervisory authority are binding (legal text).