> Approach NIS2 compliance in a structured way: check whether you are in scope, document Article 21 risk management, meet reporting deadlines and train management.

Source: [https://docxpert.io/en/standards/nis2](https://docxpert.io/en/standards/nis2)

# NIS2 Compliance Software | docxpert

## What NIS2 is

The NIS2 directive (EU) 2022/2555 raises the level of cybersecurity across the EU. It significantly widens the range of regulated organisations: instead of a few operators of critical infrastructure, many mid-sized companies from 18 sectors are now in scope – from energy, transport and health to digital services, manufacturing of certain products, food and waste management.

As a directive, NIS2 must be transposed into national law. Each member state has its own implementing act, competent authority and registration process – in Germany, for example, the revised BSI Act in force since late 2025. Companies outside the EU that offer services in the EU can also be affected. The national rules of each country where you operate are always decisive.

Act now

Many national laws provide no transition period for most obligations. Entities in scope typically have to register with the competent authority within a short deadline and implement the risk management measures straight away. If you have not yet checked whether you are in scope, do it now.

## Am I in scope?

In principle, NIS2 covers companies that operate in one of the sectors listed in Annexes I or II and qualify at least as a medium-sized enterprise. For some entities NIS2 applies regardless of size, such as certain providers of digital infrastructure.

| Category | Typical threshold | Examples |
| --- | --- | --- |
| Essential entities | Large enterprises with 250+ employees or more than €50m turnover and €43m balance sheet in highly critical sectors | Energy, transport, banking, health, drinking water, digital infrastructure |
| Important entities | Medium-sized enterprises with 50+ employees or more than €10m turnover and balance sheet | Manufacturing of machinery, vehicles, medical devices, electronics; food; chemicals; postal; digital services |

The "NIS2 applicability & registration" template in docxpert guides you through the check and documents the result – even if you are not in scope. That record helps when customers or authorities ask.

## Risk management measures under Article 21

Article 21 requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. At a minimum they include:

1.  Policies on risk analysis and information system security
2.  Incident handling
3.  Business continuity, backup management, disaster recovery and crisis management
4.  Supply chain security
5.  Security in acquisition, development and maintenance of systems, including vulnerability handling
6.  Assessing the effectiveness of measures
7.  Basic cyber hygiene and training
8.  Cryptography and encryption
9.  Human resources security, access control and asset management
10.  Multi-factor authentication and secured communications

## Reporting obligations for significant incidents

| Report | Deadline | Content |
| --- | --- | --- |
| Early warning | 24 hours after becoming aware | Suspected unlawful or malicious act, possible cross-border impact |
| Incident notification | 72 hours after becoming aware | Initial assessment with severity, impact and indicators of compromise |
| Intermediate report | On request | Current status |
| Final report | One month after the incident notification | Detailed description, root cause, mitigation, cross-border impact |

With [NIS2 incident reporting](https://docxpert.io/en/features/nis2-incident-reporting) in docxpert you record incidents, assess their significance and see the deadlines for each report. The report itself is submitted through the competent authority's portal.

## Management accountability

Article 20 requires management bodies to approve the risk management measures, oversee their implementation and attend training regularly. Infringements can lead to personal liability and fines for the company – up to €10m or 2% of worldwide annual turnover for essential entities, and up to €7m or 1.4% for important entities.

In docxpert you document the approval through an [approval workflow](https://docxpert.io/en/features/approval-workflows) and record management training with a certificate.

## How docxpert supports NIS2 compliance

16 templatesFrom scoping and registration through risk assessment, security rules and technical controls to security incidents, suppliers and business continuity – mapped to Articles 20, 21 and 23.

Gap analysisA requirement catalogue for NIS2 is built in. The [gap analysis](https://docxpert.io/en/features/gap-analysis) shows which measures are not yet documented.

Incidents with deadlines[Incident recording](https://docxpert.io/en/features/nis2-incident-reporting) shows severity, status and reporting deadlines.

TrainingCyber hygiene for all employees and management training with records through [training management](https://docxpert.io/en/features/training-certification).

Bridge to ISO 27001Many templates are also mapped to [ISO 27001](https://docxpert.io/en/standards/iso-27001) – ideal if you are building or already running an ISMS.

Regulatory radarThe [radar](https://docxpert.io/en/features/regulatory-radar) flags changes from official sources, such as new implementing acts or authority guidance.

## Practical tips to get started

-   **Document the scoping:** even a negative result should be justified traceably.
-   **Define the reporting process in advance:** who decides on significance, who reports, who communicates? There is no time for this during an incident.
-   **Assess the supply chain:** critical IT service providers and software suppliers belong in the risk assessment.
-   **Involve management early:** approval and training are mandatory and build support for the project.

The [NIS2 checklist](https://docxpert.io/en/checklists/nis2) and the guide [NIS2 incident reporting](https://docxpert.io/en/guides/nis2-incident-reporting) help with the next steps.

## Frequently asked questions

When does NIS2 apply?

Member states had to transpose the directive by 17 October 2024; many did so later. The obligations apply from the date the national law enters into force – often without a transition period. Check the status in each country where you operate.

Is ISO 27001 certification enough for NIS2?

It covers a large part of the measures, but not everything. Reporting obligations, registration, management approval and training, and the scope must be checked separately.

Can docxpert submit incidents directly to the authority?

No. docxpert documents incidents, assessments and deadlines. The report is submitted through the competent authority's portal.

Does NIS2 apply to suppliers?

Directly only if they operate in one of the sectors themselves and reach the size thresholds. Indirectly many suppliers are affected, because customers in scope must assess the security of their supply chain and ask for evidence.

What does non-compliance cost?

Besides fines of up to €10m or 2% of annual turnover, supervisory orders and personal liability of management are possible. Add reputational damage and disadvantages in tenders.

How long does NIS2 implementation take?

That depends on your starting point. If you already run an ISMS, you can often close the gaps in a few months. Without existing structures, plan six to twelve months and start with the most critical measures.

How should an organisation prepare its NIS2 reporting capability in practice?

Before an incident, decide who receives it, who assesses significance and who approves notifications. Maintain a contact list with deputies and make sure the people on it can be reached outside office hours. Define assessment criteria and information sources so teams do not wait for a complete root cause analysis before checking deadlines. Rehearse a realistic escalation with IT, management, privacy and communications; this exposes missing data, unclear ownership and parallel reporting duties. Record decisions, timestamps and rationale in a traceable incident log. After an exercise or real event, review which steps stalled and update contacts and templates. This improves readiness but does not replace legal advice on scope or submission through the competent authority's channel.

## Read next

[NIS2 incident reportingReport security incidents within 24 hours, 72 hours and one month – on time, with evidence.Learn more](https://docxpert.io/en/features/nis2-incident-reporting) [NIS2 incident reportingWhen an incident is significant and what to report in 24 hours, 72 hours and one month.Learn more](https://docxpert.io/en/guides/nis2-incident-reporting) [NIS2 checklistScope, registration, risk measures, reporting channels and management training.Learn more](https://docxpert.io/en/checklists/nis2) [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) [ISO 22301Business continuity: document impact analysis, continuity plans and exercises.Learn more](https://docxpert.io/en/standards/iso-22301)

## Try docxpert free for 14 days

Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards.

[Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)