NIS 2 Compliance Guide for Management

What a manager needs to know about NIS 2

NIS 2 is NOT an IT project. It is a governance, risk and business continuity project, with a direct impact on:

• management accountability;
• operational functioning;
• the relationship with suppliers;
• the ability to handle major incidents.

Management is explicitly responsible for:

• approving security measures;
• allocating resources;
• overseeing implementation;
• reporting incidents.

Lack of compliance = fines + corrective measures + reputational risk + real operational risk.

The steps to compliance

Step 1 – Confirming legal scope

Key questions for management:

• Are we an entity within the scope of NIS 2? YES/NO – if YES, the next steps follow.
• Are we an essential or an important entity?
• What critical services do we deliver?
• What impact would a major incident have?

Outcome: a formal NIS 2 applicability decision, owned at leadership level.

Step 2 – Registration and initial assessment

• registering the entity in line with DNSC requirements;
• assessing the risk level (using the tools provided by the authority);
• taking inventory of critical systems, services and suppliers.

Outcome: a clear picture of real exposure, not assumptions.

Step 3 – Gap analysis (where we are vs. what the law requires)

The following are analysed, in documented form:

• security governance;
• policies and procedures;
• existing technical measures;
• incident management;
• the relationship with suppliers;
• operational continuity.

Note: a purely IT audit is insufficient. The analysis must include processes, decisions and responsibilities.

Outcome: a gap analysis report with clear priorities. This makes it possible to identify what is critical to implement and what can be planned for later phases — predictability for investments and for the necessary resources (financial, human, etc.).

Step 4 – Implementing technical and organisational measures

Organisational (mandatory):

• security policies approved by management;
• clear roles and responsibilities;
• an incident management procedure;
• a procedure for reporting to DNSC;
• training for management and key personnel (annual training plan, attendance records, tests to gauge how well employees have taken on the new information);
• supplier control (periodic assessments, NDA, SLA, DPA).

Technical (adapted to the risk):

• access and identity control;
• network and endpoint security;
• backup and recovery;
• monitoring and logging;
• protection against common attacks;
• testing of the implemented measures: penetration tests, vulnerability scans, continuity plans, disaster recovery plans — tested and proven to work (reports, evidence).

Outcome: a functional system, not decorative documentation.

Step 5 – Testing, exercises, validation

• incident tests (simulations, table-top exercises);
• crisis simulations;
• verifying the reporting flow;
• corrections where bottlenecks appear.

Outcome: the organisation knows what to do in a real incident.

Step 6 – Continuous monitoring

• periodic reviews of security measures;
• monitoring and detection of security incidents, including through SIEM solutions and in-house or outsourced SOC services (where the risk analysis justifies it);
• updates following operational and technological changes;
• oversight of suppliers and outsourced services;
• periodic reporting to management / the board.

Outcome: sustainable compliance, not a "one-off" project.

How management chooses the right provider for NIS 2

This is where most money is lost.

What a good NIS 2 provider is NOT:

• "We'll get you ISO / NIS done fast";
• an exclusive focus on IT;
• does not talk to management;
• only delivers standard documents;
• avoids the subject of management accountability.

Clear selection criteria (a managerial checklist):

• Understands the legislation, not just the technology. A direct question: "How do you help us meet our legal responsibilities as management?" If the answer is technical → red flag.
• An integrated approach (legal – organisational – technical). Look for providers that translate legal requirements into business decisions, adapt the measures to the size and risk of the organisation, and work with management, not just with IT.
• A clear, phased methodology. The provider must be able to explain what it does in the first 30 / 60 / 90 days, what it delivers concretely at each stage, and what remains your responsibility.
• Real experience, not promises. Ask for examples of similar projects, real (anonymised) deliverables and who will actually do the work, not who does the selling.
• Transfer of control to the organisation. A good provider makes you autonomous, explains the risks and does not create artificial dependence.

What management should receive as final deliverables

• a formal compliance decision;
• a clear risk map;
• policies and procedures that are owned;
• proportionate technical measures;
• a tested incident response plan;
• a functional reporting mechanism;
• control over suppliers;
• continuous visibility at board level.

Keep in mind

NIS 2 is not about "whether". It is about "how well". Organisations that treat NIS 2 as a strategic exercise:

• reduce real risks;
• protect their continuity;
• gain trust (partners, customers, authorities).

Those that treat it as a formality will discover the costs at exactly the wrong moment.

Frequently asked questions