1What is NIS2?
La directive NIS2 (Network and Information Security 2) significantly expands the previous NIS Directive to many sectors (energy, healthcare, transport, digital services, industry, waste management, etc.) and imposes cybersecurity obligations proportionate to the entity's status— essential or important —determined by its sector and size.
Rather than being a standalone risk-analysis method, NIS2 has two practical components: a compliance framework (controls organised into security objectives that can be assessed requirement by requirement like an ISO 27001 audit) and operational obligations —incident management with strict notification deadlines, supplier-risk management, and business continuity.
2The process, step by step
1. Classify the entity
Determine whether the organisation is an essential entity or important based on its sector and size. This status determines which objectives apply; essential entities have a broader scope.
2. Assess the 20 security objectives (4 pillars)
Review the objectives grouped into four pillars—governance, protection, defence, and resilience—and rate each one as compliant, partially compliant, non-compliant, or not applicable under the entity's regime.
3. Maintain the incident register
Record and track every significant incident and its regulatory milestones, calculated from the detection date (not the reporting date): early warning within 24 hours, incident notification within 72 hours, and final report within one month.
4. Maintain the critical-supplier register
Map service providers and suppliers whose compromise would affect the entity. This is the operational counterpart of the EBIOS RM ecosystem.
5. Maintain the business-continuity plan
Document continuity and recovery arrangements for major incidents.
3Example completed in Polyodos
4Common mistakes
| Mistake | Why it is a problem |
|---|---|
| Calculating deadlines from the report date | NIS2 milestones (24 hours, 72 hours, and one month) run from incident detection , not from when the team decides to report it. |
| Duplicating requirement-by-requirement tracking | Detailed requirement compliance belongs in the Audit module. Rebuilding it in parallel in the NIS2 module would cause the records to diverge. |
| Marking out-of-scope objectives as non-compliant | An objective outside the entity's regime (e.g. OS16–OS20 for an important entity) must be marked not applicable, not recorded as a gap. |
| Attaching registers to a project | Incident, supplier, and continuity registers belong to the account or organisational group, not to an analysis project. Opening or closing a project must not change their content. |