Article 20
Governance & management accountability
Management bodies must approve cybersecurity risk management measures, oversee their implementation, and complete regular cybersecurity training. Personal liability is explicit.
EU Directive · Mandatory · Oct 2024
NIS2
Readiness Assessment
Mandatory for essential and important entities across 18 sectors. Enforced EU-wide since October 2024 with significant administrative penalties for non-compliance — up to €10M or 2% of global turnover.
- 18 QuestionsAssessment
- ~10 minDuration
- Essential & Important EntitiesScope
Who it applies to
- Essential and important entities under the EU NIS2 Directive (Annex I & II sectors)
- Energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management
- Postal and courier services, waste management, manufacturing of chemicals, food, medical devices, public administration, space, research
- Medium and large entities (50+ staff or €10M+ turnover) in scope sectors — and any size for certain critical sub-sectors
Generally out of scope
- Most micro-enterprises outside the explicitly critical sub-sectors
- Defence, national security, law enforcement, judiciary (handled by separate regimes)
Key articles & clauses, in plain English
The five points auditors and supervisors actually verify first.
Article 21
Cybersecurity risk management measures
Ten minimum measures spanning risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control, asset management, training, and MFA.
Article 23
Incident reporting timelines
24-hour early warning, 72-hour incident notification, and a 1-month final report to the national CSIRT for any significant incident.
Article 24
Use of European cybersecurity certification schemes
Member States may require entities to use specific EU-certified ICT products, services and processes to demonstrate compliance with Article 21.
Article 32 / 34
Supervision and penalties
Competent authorities can audit, issue binding instructions, and impose administrative fines up to €10M or 2% of global turnover for essential entities.
What this assessment covers
5 topics · 18 self-assessment questions.
- Domain 01
Governance & Management
NIS2 Article 20 requires management bodies to approve cybersecurity risk-management measures and oversee their implementation. Management liability is explicit.
- Domain 02
Risk Management
Article 21(2) requires a systematic, proportionate approach to identifying and treating cybersecurity risks across all relevant assets and processes.
- Domain 03
Incident Response
NIS2 Article 23 introduces strict notification timelines: 24-hour early warning, 72-hour incident notification, and a 1-month final report. Operational readiness is mandatory.
- Domain 04
Supply Chain Security
Article 21(2)(d) requires organisations to address cybersecurity risks in supply chains — including direct supplier relationships and third-party service providers.
- Domain 05
Technical Controls
Article 21(2) specifies a range of technical measures including access control, cryptography, network security, and business continuity that must be implemented proportionately.
Top audit pitfalls
- Treating NIS2 as an IT-only project — Article 20 makes the management body personally accountable.
- Underestimating the 24-hour early warning window — most organisations cannot meet it without a tested process.
- No documented supply-chain security requirements in supplier contracts (Art. 21(2)(d)).
Frequently asked questions
The directive entered into force in January 2023 and Member States were required to transpose it into national law by 17 October 2024. National competent authorities are now actively supervising essential and important entities.
NIS2 expands the sector list dramatically, introduces a size-cap rule (medium and large entities are in by default), tightens incident reporting to a 24-hour early warning, and adds explicit management accountability with personal liability.
Essential entities (Annex I) face stricter supervision, ex-ante audits, and higher fine ceilings (€10M or 2% turnover). Important entities (Annex II) are supervised ex-post and capped at €7M or 1.4% turnover.
No. ISO 27001 is one credible way to evidence Article 21 measures, but NIS2 is a directive — it specifies outcomes, not certifications. A documented ISMS that maps to Article 21 is sufficient.
For a mid-sized entity starting from a baseline of basic IT hygiene, six to twelve months to reach a defensible position. Critical gaps (incident response, supply chain) can be closed in 60–90 days.
Yes. Several Member States issued enforcement actions in 2025 covering missing incident reports, lack of management training records, and undocumented risk management programmes.
Start your NIS2 assessment
18 questions · ~~10 min · Scorecard based on your answers. No sign-up to begin.