What does NIS2 require from a mid-sized company in scope?

Four things, broadly. First, governance: the management body approves the cybersecurity measures, oversees them and follows training (Article 20). Second, risk management: appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach, covering at least the ten areas in Article 21(2), from risk analysis and incident handling to backups, supply chain, cryptography, access control and multi-factor authentication. Third, reporting: significant incidents go to the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or competent authority in stages, an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23). Fourth, registration and supervision as national law sets out. Proportionate means scaled to your size and exposure. NetSenX helps with detection, incident evidence and deadline tracking; the rest is your programme.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics