# What does NIS2 require from a mid-sized company in scope?

Four things, broadly. First, governance: the management body approves the cybersecurity measures, oversees them and follows training (Article 20). Second, risk management: appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach, covering at least the ten areas in Article 21(2), from risk analysis and incident handling to backups, supply chain, cryptography, access control and multi-factor authentication. Third, reporting: significant incidents go to the CSIRT or competent authority in stages, an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23). Fourth, registration and supervision as national law sets out. Proportionate means scaled to your size and exposure. NetSenX helps with detection, incident evidence and deadline tracking; the rest is your programme.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/what-does-nis2-require-from-a-mid-sized-company

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What are the ten risk-management measures in NIS2 Article 21?](https://netsenx.com/en/faq/what-are-the-ten-nis2-article-21-measures)
- [What is the difference between essential and important entities under NIS2?](https://netsenx.com/en/faq/what-is-the-difference-between-essential-and-important-entities)
- [Which sectors does NIS2 cover?](https://netsenx.com/en/faq/which-sectors-does-nis2-cover)
- [Are managers personally liable under NIS2?](https://netsenx.com/en/faq/are-managers-personally-liable-under-nis2)
- [Is cyber security training mandatory for management under NIS2?](https://netsenx.com/en/faq/is-management-training-mandatory-under-nis2)