Map in 5 min · NIS2 Directive
    Insights / NIS2 exposure

    NIS2 exposureAre you in scope?

    The NIS2 Directive (EU) 2022/2555 is being enforced across the Union from 2024-2026. National supervisory authorities have started their reviews. This assessment takes five minutes and answers two questions: are you in scope, and how many of your customers are now placing requirements on you as a supplier.

    Time to final report24:00:00
    10 M€
    Max fine - essential entity
    24 h
    Initial incident report to CSIRT
    7
    Core requirements (Art. 21)
    80 %
    Nordic MSPs with NIS2 customers
    LIVE
    NIS2 Directive (EU) 2022/2555 in force across the EU24 h initial report to CSIRT72 h updated incident report1 month for the final reportManagement's personal liability appliesArticle 21 - 7 core requirementsSupervisory authorities have started reviewsSuppliers are reviewed under Article 21(2)(d)NIS2 Directive (EU) 2022/2555 in force across the EU24 h initial report to CSIRT72 h updated incident report1 month for the final reportManagement's personal liability appliesArticle 21 - 7 core requirementsSupervisory authorities have started reviewsSuppliers are reviewed under Article 21(2)(d)
    Methodology · Article 21

    The 7 core requirements

    The NIS2 Directive sets seven overarching requirements for risk management. Supervisory authorities read them not as checklists but as a management system. Here is what each requirement actually means, where it fails in practice and how it is addressed.

    What the law requires

    Systematic, documented risk analysis decided and followed up by management. Risk appetite, action plan and follow-up must be demonstrable during supervision.

    Where it fails in practice

    Often there is a technical risk assessment in IT, but no management-approved process. Supervision requires the board to be able to explain its risk appetite.

    How this is addressed

    Established NIS2-based risk methodology, management workshops, board minute templates, quarterly follow-up.