NIS2 Directive
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, covering essential and important entities.
NIS2 Directive is a compliance framework from European Union with 8 domains and 28 controls that map to 20 other frameworks. The largest domains are NIS2 Chapter IV: Cybersecurity Risk-Management Measures (Article 21) (13 controls), NIS2 Chapter IV: Incident Reporting (Article 23) (6 controls), NIS2 Chapter V: Jurisdiction and Registration (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
NIS2 Chapter I: General Provisions
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.3.4 | Submit and maintain entity registration information with the competent authority |
NIS2 Chapter IV: Cybersecurity Risk-Management Measures (Article 21)
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.21.1 | Take proportionate all-hazards measures calibrated to the entity's own risk exposure |
| nis2-directive::Art.21.2.a | Policies on risk analysis and on information system security |
| nis2-directive::Art.21.2.b | Incident handling |
| nis2-directive::Art.21.2.c | Business continuity, backup management, disaster recovery and crisis management |
| nis2-directive::Art.21.2.d | Supply chain security, covering the relationship with each direct supplier and service provider |
| nis2-directive::Art.21.2.e | Security in acquisition, development and maintenance, including vulnerability handling and disclosure |
| nis2-directive::Art.21.2.f | Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures |
| nis2-directive::Art.21.2.g | Basic cyber hygiene practices and cybersecurity training |
| nis2-directive::Art.21.2.h | Policies and procedures on the use of cryptography and, where appropriate, encryption |
| nis2-directive::Art.21.2.i | Human resources security, access control policies and asset management |
| nis2-directive::Art.21.2.j | Multi-factor or continuous authentication, secured communications and secured emergency communications |
| nis2-directive::Art.21.3 | Take account of supplier-specific vulnerabilities and of Union coordinated supply chain risk assessments |
| nis2-directive::Art.21.4 | Take corrective measures without undue delay on finding that the measures are not met |
NIS2 Chapter IV: Governance (Article 20)
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.20.1 | Management body approves the cybersecurity risk-management measures and oversees their implementation |
| nis2-directive::Art.20.2 | Train the management body, and offer equivalent training to staff on a regular basis |
NIS2 Chapter IV: Incident Reporting (Article 23)
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.23.1 | Notify significant incidents to the CSIRT or competent authority, and warn affected service recipients |
| nis2-directive::Art.23.2 | Tell affected service recipients about significant cyber threats and the remedies open to them |
| nis2-directive::Art.23.4.a | Submit an early warning within 24 hours of becoming aware of a significant incident |
| nis2-directive::Art.23.4.b | Submit an incident notification within 72 hours, with an initial assessment and indicators of compromise |
| nis2-directive::Art.23.4.c | Provide an intermediate report on status when the CSIRT or competent authority requests one |
| nis2-directive::Art.23.4.d | Submit a final report within one month, and a progress report where the incident is still running |
NIS2 Chapter IV: Supply Chain Assessment, Certification and Standardisation (Articles 22, 24, 25)
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.24 | Use certified ICT products, services and processes where the Member State requires it |
NIS2 Chapter V: Jurisdiction and Registration
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.26 | Establish which Member State has jurisdiction, and designate a Union representative if not established in the Union |
| nis2-directive::Art.27.2 | Submit the ENISA registry information required of digital infrastructure and digital service providers |
| nis2-directive::Art.28 | Maintain accurate domain name registration data and answer lawful access requests within 72 hours |
NIS2 Chapter VI: Information Sharing
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.29.4 | Notify the competent authority of entry into and withdrawal from information-sharing arrangements |
NIS2 Chapter VII: Supervision and Enforcement
Chapter grouping of Directive (EU) 2022/2555 as modelled 2026-08-20.
| Code | Title |
|---|---|
| nis2-directive::Art.32 | Cooperate with supervision: inspections, security audits, scans and requests for information and evidence |
Your Compliance Coverage
If you comply with NIS2 Directive, you already cover:
Maps to 20 other frameworks
Coverage is not the same as your position
This page shows what NIS2 Directive overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is NIS2 Directive and who does it apply to?
NIS2 Directive is a compliance framework from European Union with 8 domains and 28 controls. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, covering essential and important entities. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIS2 Directive actually require?
NIS2 Directive has 28 controls organised across 8 domains. The largest domains are NIS2 Chapter IV: Cybersecurity Risk-Management Measures (Article 21) (13 controls), NIS2 Chapter IV: Incident Reporting (Article 23) (6 controls), NIS2 Chapter V: Jurisdiction and Registration (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIS2 Directive do I already cover?
NIS2 Directive maps to 20 other compliance frameworks. The top mapping partners are ISO 27002:2022 (96% coverage), NIST Cybersecurity Framework 2.0 (93% coverage), C5 (Germany) (93% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement NIS2 Directive?
Start your NIS2 Directive compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIS2 Directive requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required