Governance Docs

Browse Toolkits

No products in the cart.

Category: NIS2

The NIS2 Directive is EU cybersecurity legislation covering essential and important entities across eighteen sectors. As a Directive it is transposed into national law by each member state, so the detail — and the penalties — vary by country. The transposition deadline was 17 October 2024.
It widened the original NIS Directive substantially, both in the sectors covered and in what is required. Article 21 sets out risk-management measures spanning risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and more.
Two features distinguish NIS2 from what came before. Management bodies must approve and oversee cybersecurity measures and can be held personally liable, which moves the conversation into the boardroom. And reporting is fast: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within one month.
An ISO 27001 ISMS covers a large share of the Article 21 measures and is the most efficient way to build the evidence — but NIS2 compliance is a legal determination made by your national authority, not something a certificate confers.
The guides below cover what NIS2 requires, who is in scope, the penalties and deadlines, and how it compares with ISO 27001 and DORA.

CRA vs NIS2 explained

CRA vs NIS2: 7 Clear Differences Explained for 2026

Governance Docs 19th September 2026

CRA vs NIS2: products vs entities, Article 14 vs Article 23 clocks, EUR 15m/2.5% vs EUR 10m/2% fines,…

Read More

NIS2 incident reporting explained

NIS2 Incident Reporting: A Clear Guide to the 3 Deadlines

Governance Docs 17th September 2026

NIS2 incident reporting under Article 23: 24-hour early warning, 72-hour notification, one-month final report, and the thresholds in…

Read More

NIS2 penalties for essential and important entities plus management liability and deadlines

NIS2 Penalties & Deadlines Explained

Governance Docs 17th July 2026

NIS2 penalties are among the toughest in EU cyber law, with personal liability for management. Here are the…

Read More

NIS2 vs ISO 27001 - how the cybersecurity law and the information security standard align

NIS2 vs ISO 27001: Use Your ISMS to Comply

Governance Docs 17th July 2026

NIS2 vs ISO 27001: one is a mandatory law, the other a certifiable standard. Here is how they…

Read More

Who does NIS2 apply to - essential and important entities and the sectors NIS2 covers

Who Does NIS2 Apply To? Essential vs. Important Entities

Governance Docs 17th July 2026

NIS2 widened EU cybersecurity rules to thousands of new organizations. Learn who is covered, the essential vs important…

Read More

NIS2 requirements checklist covering security measures, incident reporting and documentation

NIS2 Requirements & Documentation Checklist

Governance Docs 17th July 2026

What does NIS2 actually require? A practical checklist of the security measures, incident-reporting timelines, and documentation your organization…

Read More

DORA vs NIS2 comparison of the financial-sector regulation and the cross-sector cybersecurity directive

DORA vs NIS2: How They Overlap for Financial Firms

Governance Docs 17th July 2026

DORA vs NIS2: one is a financial-sector regulation, the other a cross-sector directive. Here are the key differences…

Read More

NIS2 directive explained - scope, security requirements, incident reporting and penalties

NIS2 Directive Explained: A Complete Compliance Guide

Governance Docs 20th May 2026

The NIS2 Directive is the EU's most far-reaching cybersecurity law. A complete guide to its scope, security requirements,…

Read More