_1762866128417-DS2_OO1j.png)
What NIS2 is
The NIS2 directive (EU) 2022/2555 raises the level of cybersecurity across the EU. It significantly widens the range of regulated organisations: instead of a few operators of critical infrastructure, many mid-sized companies from 18 sectors are now in scope – from energy, transport and health to digital services, manufacturing of certain products, food and waste management.
As a directive, NIS2 must be transposed into national law. Each member state has its own implementing act, competent authority and registration process – in Germany, for example, the revised BSI Act in force since late 2025. Companies outside the EU that offer services in the EU can also be affected. The national rules of each country where you operate are always decisive.
Am I in scope?
In principle, NIS2 covers companies that operate in one of the sectors listed in Annexes I or II and qualify at least as a medium-sized enterprise. For some entities NIS2 applies regardless of size, such as certain providers of digital infrastructure.
| Category | Typical threshold | Examples |
|---|---|---|
| Essential entities | Large enterprises with 250+ employees or more than €50m turnover and €43m balance sheet in highly critical sectors | Energy, transport, banking, health, drinking water, digital infrastructure |
| Important entities | Medium-sized enterprises with 50+ employees or more than €10m turnover and balance sheet | Manufacturing of machinery, vehicles, medical devices, electronics; food; chemicals; postal; digital services |
The "NIS2 applicability & registration" template in docxpert guides you through the check and documents the result – even if you are not in scope. That record helps when customers or authorities ask.
Risk management measures under Article 21
Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. At a minimum they include:
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, backup management, disaster recovery and crisis management
- Supply chain security
- Security in acquisition, development and maintenance of systems, including vulnerability handling
- Assessing the effectiveness of measures
- Basic cyber hygiene and training
- Cryptography and encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communications
Reporting obligations for significant incidents
| Report | Deadline | Content |
|---|---|---|
| Early warning | 24 hours after becoming aware | Suspected unlawful or malicious act, possible cross-border impact |
| Incident notification | 72 hours after becoming aware | Initial assessment with severity, impact and indicators of compromise |
| Intermediate report | On request | Current status |
| Final report | One month after the incident notification | Detailed description, root cause, mitigation, cross-border impact |
With NIS2 incident reporting in docxpert you record incidents, assess their significance and see the deadlines for each report. The report itself is submitted through the competent authority's portal.
Management accountability
Article 20 requires management bodies to approve the risk management measures, oversee their implementation and attend training regularly. Infringements can lead to personal liability and fines for the company – up to €10m or 2% of worldwide annual turnover for essential entities, and up to €7m or 1.4% for important entities.
In docxpert you document the approval through an approval workflow and record management training with a certificate.
How docxpert supports NIS2 compliance
Practical tips to get started
- Document the scoping: even a negative result should be justified traceably.
- Define the reporting process in advance: who decides on significance, who reports, who communicates? There is no time for this during an incident.
- Assess the supply chain: critical IT service providers and software suppliers belong in the risk assessment.
- Involve management early: approval and training are mandatory and build support for the project.
The NIS2 checklist and the guide NIS2 incident reporting help with the next steps.
Frequently asked questions
When does NIS2 apply?
Member states had to transpose the directive by 17 October 2024; many did so later. The obligations apply from the date the national law enters into force – often without a transition period. Check the status in each country where you operate.
Is ISO 27001 certification enough for NIS2?
It covers a large part of the measures, but not everything. Reporting obligations, registration, management approval and training, and the scope must be checked separately.
Can docxpert submit incidents directly to the authority?
No. docxpert documents incidents, assessments and deadlines. The report is submitted through the competent authority's portal.
Does NIS2 apply to suppliers?
Directly only if they operate in one of the sectors themselves and reach the size thresholds. Indirectly many suppliers are affected, because customers in scope must assess the security of their supply chain and ask for evidence.
What does non-compliance cost?
Besides fines of up to €10m or 2% of annual turnover, supervisory orders and personal liability of management are possible. Add reputational damage and disadvantages in tenders.
How long does NIS2 implementation take?
That depends on your starting point. If you already run an ISMS, you can often close the gaps in a few months. Without existing structures, plan six to twelve months and start with the most critical measures.
How should an organisation prepare its NIS2 reporting capability in practice?
Before an incident, decide who receives it, who assesses significance and who approves notifications. Maintain a contact list with deputies and make sure the people on it can be reached outside office hours. Define assessment criteria and information sources so teams do not wait for a complete root cause analysis before checking deadlines. Rehearse a realistic escalation with IT, management, privacy and communications; this exposes missing data, unclear ownership and parallel reporting duties. Record decisions, timestamps and rationale in a traceable incident log. After an exercise or real event, review which steps stalled and update contacts and templates. This improves readiness but does not replace legal advice on scope or submission through the competent authority's channel.