Directive (EU) 2022/2555, enforced by EU Member State national competent authorities from October 17, 2024, imposes binding Article 21 cybersecurity measures and 24-hour incident reporting on essential and important entities — with management body personal liability and fines up to €10M or 2% of global revenue for non-compliance.
The NIS2 Directive — formally Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — is the European Commission's binding legal framework establishing minimum cybersecurity obligations for organisations operating critical and important services across the EU. It replaces the original NIS Directive (EU) 2016/1148, which the Commission determined had produced uneven implementation across Member States and inadequate protection for an expanded threat landscape. The directive's primary obligation is straightforward: entities in scope must implement the ten cybersecurity risk-management measures defined in Article 21 and must report significant incidents to their national Computer Security Incident Response Team (CSIRT) within prescribed timelines. Cybersecurity compliance automation platforms purpose-built for NIS2 reduce the operational burden of meeting these obligations without building a manual evidence programme from scratch.
NIS2 applies to two categories of entity. Essential entities under Annex I include operators across seven sectors: energy (electricity, gas, oil, district heating, hydrogen), transport (air, rail, road, maritime), banking, financial market infrastructure, health, drinking water, and wastewater. Digital infrastructure — covering DNS service providers, top-level domain registries, cloud computing services, data centre services, content delivery networks, trust service providers, and public electronic communications networks — is also classified as essential. Important entities under Annex II cover eleven additional sectors: ICT service management (B2B), public administration, space, postal and courier services, waste management, manufacture of critical products (including pharmaceuticals, medical devices, chemicals, and electronics), food production and distribution, manufacturing, digital providers (including online marketplaces and search engines), and research organisations. The size threshold is generally medium or large enterprises — 50+ employees or €10M+ annual turnover — though Member State authorities may designate smaller entities in critical subsectors.
The consequences of NIS2 non-compliance are the most severe in the directive's history. Essential entities face administrative fines of up to €10,000,000 or 2% of total global annual turnover — whichever figure is higher. Important entities face fines up to €7,000,000 or 1.4% of global annual turnover. National competent authorities are empowered to issue binding instructions, order temporary suspensions of service provision, and — in a provision unprecedented in EU cybersecurity law — impose temporary bans on named individuals in management roles who bear personal liability for infringements under Article 20. In 2024, national authorities across Germany, the Netherlands, and Belgium initiated supervisory reviews of critical infrastructure operators, with formal compliance orders issued to energy and transport operators failing to demonstrate Article 21 measure implementation. Compliance Standards Automation (CSA) from CyberSilo maps every Article 21 control to automated evidence collection workflows, so management bodies have auditable proof of programme effectiveness at any point during a supervisory review.
Beyond avoiding penalties, organisations in NIS2 sectors pursue proactive compliance for several commercially significant reasons. Enterprise procurement contracts — particularly across EU public sector, defence supply chains, and financial services — increasingly require NIS2 attestation as a vendor prerequisite. Cyber insurance underwriters in Europe have begun issuing premium reductions for organisations demonstrating NIS2-aligned controls, given the documented correlation between Article 21 measures and lower breach frequency. M&A due diligence in EU regulated sectors now routinely includes NIS2 compliance status as a material disclosure item, with continuous security monitoring evidence requested alongside financial records. And for organisations already operating under leading compliance automation platforms, the control crosswalk between NIS2 and ISO 27001:2022 or GDPR means incremental compliance cost is substantially lower than building a standalone programme.
Article 21 of Directive (EU) 2022/2555 defines ten mandatory cybersecurity risk-management measures that all essential and important entities must implement, proportionate to their risk exposure and sector. These measures are not optional guidance — national competent authorities assess compliance against each one during supervisory reviews.
Entities must maintain documented risk analysis procedures and comprehensive information security policies that reflect the organisation's threat exposure. Policies must be approved by the management body and reviewed following significant incidents or material changes to the operating environment. CyberSilo's Compliance Standards Automation platform maintains a live policy register with automated review scheduling and version control aligned to this requirement.
Essential and important entities must implement structured incident handling procedures covering detection, triage, response, and recovery. Significant incidents trigger a mandatory 24-hour early warning to the national CSIRT, a 72-hour incident notification with initial assessment, and a final report within one month. ThreatHawk SIEM automates detection and generates pre-populated CSIRT notification drafts, eliminating the manual bottleneck that causes organisations to miss the 24-hour early warning window under AI-powered SIEM monitoring.
Organisations must maintain documented business continuity plans, backup management procedures, and disaster recovery capabilities that address cybersecurity-related disruptions specifically. Crisis management procedures must account for scenarios where critical services are unavailable for extended periods. Plans must be tested at documented intervals, with test evidence retained for supervisory review.
Entities must assess the cybersecurity posture of direct suppliers and service providers — including software vendors, managed service providers, and cloud infrastructure providers. Supply chain security agreements must contain minimum cybersecurity requirements, and vendor risk assessments must be documented and reviewed periodically. This measure directly responds to the EU's documented concern about software supply chain attacks targeting critical infrastructure operators.
The directive requires security to be embedded in the acquisition, development, and maintenance of network and information systems — including policies on handling and disclosing vulnerabilities. Patch management procedures, secure development lifecycle requirements for internally developed software, and vulnerability disclosure policies must all be documented and evidence of their operation retained.
Entities must implement procedures to evaluate whether their cybersecurity risk-management programme is functioning effectively — including internal audits, penetration testing schedules, and management review mechanisms. Evidence of effectiveness assessments must be retained and presented to national competent authorities on request. Automated compliance dashboards from CyberSilo provide real-time posture scoring that satisfies this assessment obligation continuously rather than at point-in-time review cycles.
All staff must receive regular cybersecurity hygiene training proportionate to their role. Management bodies — including board members and C-suite executives — must receive specific training on cybersecurity risk governance under Article 20's management oversight obligations. Training completion records must be maintained as compliance evidence. This extends beyond technical staff to every employee who interacts with the organisation's network and information systems.
Entities must document and implement cryptography and encryption policies covering data in transit, data at rest, and communications between internal systems and third parties. Key management procedures, approved cipher suites, and certificate lifecycle management must all be governed by documented policy with evidence of compliance retained for audit. This measure is particularly relevant for health, banking, and digital infrastructure operators handling sensitive personal and financial data.
NIS2 requires formal asset management programmes that identify all network and information systems in scope, combined with role-based access controls that enforce least-privilege principles. Human resources security procedures — including background check policies for staff in sensitive roles, role change procedures, and offboarding processes — must be documented and consistently applied. Access log records constitute primary evidence for this control during supervisory reviews. This is one of the areas where common SIEM gaps that affect compliance evidence quality are most likely to create audit exposure.
The directive explicitly requires multi-factor authentication (MFA) or continuous authentication solutions wherever technically feasible — covering remote access, privileged account access, and all administrative interfaces for critical systems. Secure communications — including encrypted voice, video, and text communications for cybersecurity-sensitive functions — must also be implemented and documented. MFA deployment scope and authentication log records are routinely requested by national competent authorities during NIS2 supervisory reviews.
CyberSilo maps your existing technical and organisational controls against all ten Article 21 measures of Directive (EU) 2022/2555. Every gap — from missing MFA coverage on administrative interfaces to undocumented supply chain vendor assessments — is identified, prioritised by risk exposure, and assigned a remediation owner within the first 72 hours of deployment.
Remediation tasks are generated for each Article 21 gap — including policy templates for cryptography and human resources security controls, workflow automation for business continuity testing schedules, and supply chain vendor assessment questionnaires. Technical controls including log collection scope, MFA enforcement rules, and access control baselines are deployed and verified automatically across connected systems.
CyberSilo continuously collects the evidence artefacts NIS2 auditors require: authentication logs, access control records, patch management histories, encryption policy documentation, cybersecurity training completion records, incident response logs, and penetration test reports. For significant incidents, an automated 24-hour CSIRT early warning workflow is triggered, followed by the 72-hour notification package and one-month final report template.
CyberSilo produces a Management Body Compliance Report — the Article 20 governance artefact that demonstrates director-level oversight of the NIS2 cybersecurity programme — alongside a National Competent Authority submission package mapping every Article 21 control to its supporting evidence. Both documents are continuously maintained, eliminating the weeks of manual compilation that precede supervisory reviews.
Organisations deploying CyberSilo's NIS2 compliance automation module typically achieve full Article 21 control coverage within 6–10 weeks for cloud environments. The platform's AI-driven SOC automation ensures that incident detection and CSIRT notification workflows are active from day one — so the 24-hour early warning obligation is covered before any controls gap remediation is even complete. Organisations already holding ISO 27001 certification can leverage their existing ISMS documentation as a starting baseline, typically reducing NIS2 implementation timelines by 40%.
Supervisory reviews conducted by national competent authorities across Germany (BSI), the Netherlands (NCSC-NL), and France (ANSSI) in the six months following October 2024 enforcement have consistently identified four recurring gaps. First, inadequate supply chain security documentation under Article 21(d): organisations maintain vendor lists but lack formal cybersecurity assessments of critical ICT service providers and cloud infrastructure suppliers — a gap that regulators have specifically flagged given documented nation-state targeting of critical infrastructure supply chains. Second, missing management body accountability evidence under Article 20: boards approve cybersecurity budgets but cannot demonstrate they have received specific cybersecurity training or have formally approved the risk management framework, exposing individual directors to the personal liability provisions. Third, incomplete incident reporting procedures — particularly the 24-hour early warning workflow — where organisations detect significant incidents but lack documented escalation paths to the national CSIRT, missing the notification window. Fourth, MFA enforcement gaps on administrative interfaces to operational technology systems: IT environments typically have MFA deployed, but SCADA and industrial control system administrative access remains protected only by static credentials, failing the Article 21(j) requirement. Organisations reviewing leading compliance automation platforms should specifically assess whether the platform addresses these four documented failure modes, not just the full control catalogue in isolation. Similarly, reviewing CIS benchmarking tools for technical baseline validation can help identify the specific configuration gaps that make Article 21(j) MFA enforcement audit evidence difficult to produce.
Unlike ISO 27001 — which requires an IAF-accredited third-party certification body to issue a formal certificate — NIS2 has no single certification event. Compliance is demonstrated through ongoing conformity with Article 21 measures and verified through the supervisory authority framework established in Articles 31–38 of Directive (EU) 2022/2555. National competent authorities conduct ex-ante supervision of essential entities (proactive oversight, including on-site inspections and security audits) and ex-post supervision of important entities (reactive oversight, triggered by evidence of infringement or incident reports). An essential entity in the energy sector may be subject to regular scheduled supervisory reviews regardless of whether an incident has occurred. Assessments may include requests for documented evidence, technical audits, security scans, or physical site inspections. The timeline from initial supervisory contact to formal compliance order can be as short as 30 days, making the ability to produce comprehensive Article 21 evidence on short notice — rather than after months of manual compilation — a material operational requirement. Comparing NIS2 to DORA clarifies the assessment path differences for financial sector organisations subject to both frameworks, given DORA's more prescriptive third-party audit requirements for ICT critical service providers.
NIS2's continuous compliance obligations are more demanding than the directive's initial framing suggests. Article 21(f) specifically requires entities to implement policies and procedures to assess the ongoing effectiveness of their risk-management measures — meaning compliance evidence must be current and continuous, not produced at a single annual point. Post-implementation obligations include: annual penetration testing of network and information systems (required to maintain Article 21(e) evidence); quarterly review of supply chain security assessments when a critical supplier experiences a significant incident; incident reporting obligations triggered by any event meeting the "significant incident" threshold of Article 23, which covers incidents causing severe operational disruption or significant financial loss; and personnel change procedures ensuring that staff transitions in roles with administrative access to critical systems trigger access control reviews. Configuration drift represents the most common post-implementation compliance failure: new cloud services, shadow IT deployments, and third-party integrations added outside the formal asset management programme create undocumented gaps in MFA coverage and log collection scope. AI-powered SOC automation that continuously monitors asset inventory and access control baselines closes this gap by detecting new systems before they create a compliance exposure. Understanding the common SIEM gaps that affect compliance evidence quality is essential for organisations relying on log management infrastructure to satisfy their NIS2 Article 21 monitoring and incident handling obligations.
EU organisations frequently need to understand how NIS2 relates to DORA and ISO 27001 when building a unified compliance programme. The distinctions below determine which controls can be shared and which obligations require separate programmes.
NIS2 is a directive covering 18 sectors broadly; DORA is a directly applicable regulation covering only financial services — banks, insurers, investment firms, and their critical ICT providers. DORA's ICT risk management, testing, and third-party oversight requirements are more prescriptive than NIS2's Article 21 measures. Financial sector organisations subject to both frameworks should note that DORA takes precedence under lex specialis for financial services entities, but NIS2 obligations remain for any non-financial services operations. Unified compliance management eliminates duplicate evidence collection across the two frameworks' overlapping controls.
Read Full ComparisonISO 27001:2022 is a voluntary international standard for information security management systems, certified by an IAF-accredited third-party certification body. NIS2 is a mandatory EU legal obligation with national enforcement and financial penalties. For energy, healthcare, and transport operators, ISO 27001 certification alone does not satisfy NIS2 obligations — but the control crosswalk is substantial. Annex A controls covering incident management (5.24–5.28), access management (5.15–5.18), and supplier security (5.19–5.22) directly satisfy corresponding Article 21 measures, making ISO 27001-certified organisations significantly better positioned for NIS2 compliance than those without any ISMS baseline.
Explore ISO 27001 CoverageEnergy operators, transport companies, digital infrastructure providers, and healthcare organisations may be subject to NIS2, GDPR, DORA, and sector-specific national regulations simultaneously. CyberSilo's Framework Finder identifies your full compliance stack and maps overlapping controls so you build one programme — not five separate ones.
Use the Framework FinderThe maximum €10,000,000 NIS2 penalty for essential entities — or 2% of global annual turnover for large organisations — dramatically outweighs the investment in automated compliance infrastructure. IBM Security's 2024 Cost of a Data Breach Report places the average breach cost for EU critical infrastructure at €4.9M, a figure that excludes NIS2 regulatory fines, management body personal liability exposure, and the contract value at risk when enterprise procurement frameworks require NIS2 attestation. Organisations using manual compliance programmes spend an estimated 600–900 staff hours annually on NIS2 evidence compilation and audit preparation — effort that CyberSilo eliminates through continuous automated evidence collection, reducing that burden by 70% and freeing security teams to focus on operational resilience rather than documentation.
Each module below addresses specific Article 21 obligations — not generic security capabilities. Together they form a complete NIS2 automation stack deployable within one unified platform.
CSA maintains a pre-mapped NIS2 control library covering all ten Article 21 measures. It automates the collection of policy documentation, access control records, training completion evidence, and supply chain assessment records — producing the Management Body Compliance Report required by Article 20 and the National Competent Authority submission package on demand. CSA's continuous control scoring gives management bodies real-time visibility of NIS2 posture, satisfying the Article 21(f) obligation to assess programme effectiveness without manual audit cycles.
Explore CSA PlatformThreatHawk directly addresses NIS2 Article 21(b) incident handling and Article 21(j) monitoring obligations. The platform ingests telemetry from network devices, endpoints, cloud environments, and OT/ICS assets — providing the unified visibility required to detect significant incidents within the Article 23 early warning timeline. When a significant incident is detected, ThreatHawk automatically triggers the 24-hour CSIRT notification workflow, generating a pre-populated Article 23 notification draft with incident classification, initial impact assessment, and affected system inventory. ThreatHawk's log retention and evidence export capabilities produce the audit-grade incident logs that national competent authorities request during supervisory reviews.
Explore ThreatHawk SIEMTEM directly satisfies NIS2 Article 21(e) — security in network and information systems acquisition, development, and maintenance — and Article 21(f)'s effectiveness assessment obligation. The platform conducts continuous vulnerability identification across IT, cloud, and OT environments, generating the patch management histories and vulnerability disclosure records that NIS2 auditors request as evidence of ongoing systems security. TEM's attack surface scoring provides the risk quantification basis for management body reporting, demonstrating that the organisation is actively assessing and remediating exposure — not simply documenting controls in static policy documents.
Explore Threat Exposure ManagementNIS2 Article 21(b) requires not only incident detection but structured response and recovery procedures — a continuous obligation that manual SOC processes struggle to sustain 24/7. Agentic SOC AI provides autonomous triage, investigation, and response orchestration that ensures every significant incident meeting the Article 23 threshold is escalated, documented, and reported within the 24-hour early warning window regardless of time of day, staff availability, or incident volume. The platform's AI-generated incident timelines produce the investigation documentation that forms the basis for the one-month final report required under Article 23(4) — eliminating the post-incident report compilation effort that typically consumes 40–60 hours of security team time per significant incident.
Explore Agentic SOC AICIS Controls v8.1 implementation groups map directly to NIS2 Article 21 technical measures — IG1 for cyber hygiene, IG2–3 for access management, monitoring, and incident response. This guide reviews the tools that operationalise CIS benchmarking as a practical NIS2 Article 21 implementation pathway.
Read GuideA structured comparison of leading GRC platforms evaluating NIS2 Article 21 control coverage, CSIRT notification workflow automation, supply chain assessment modules, and management body reporting capabilities — the four areas where NIS2 compliance programmes most frequently create operational gaps.
Read ComparisonNIS2 Article 21(b) and Article 23 impose specific log management and incident detection requirements. This review evaluates enterprise SIEM platforms against their ability to detect significant incidents within the 24-hour early warning window and produce audit-grade evidence for national competent authority supervisory reviews.
Read ReviewReal-world examples of how energy operators, healthcare providers, and digital infrastructure companies use SIEM to generate NIS2 Article 21 audit evidence — including OT/IT unified monitoring for energy SCADA environments and PHI access log collection for healthcare Article 21(b) incident detection requirements.
View Use CasesNIS2 Article 21 requires continuous monitoring capabilities for essential and important entities — a commitment with direct SIEM infrastructure cost implications. This guide covers licensing models, EPS-based pricing, managed SOC costs, and total cost of ownership for the monitoring infrastructure required to satisfy NIS2's ongoing detection obligations.
View Cost GuideNIS2's 24-hour CSIRT early warning requirement cannot be met by organisations relying on manual SOC processes for incident triage. This review evaluates agentic SOC AI platforms on their ability to autonomously detect, classify, and escalate significant incidents within the Article 23 notification window — the most operationally demanding NIS2 compliance requirement for large essential entities.
View Platform ReviewStay ahead of evolving cyber threats with our expert insights
SIEM
Explore cloud-native SIEM alternatives, SOAR platforms, and CSPM tools for scalable and automated cloud security solutions tailored to modern enterprises.
Read Article
SIEM
Explore the integration of SIEM tools with EDR and XDR platforms for enhanced cybersecurity, visibility, and incident response efficiency.
Read Article
SIEM
Explore how generative AI enhances SIEM and SOAR platforms, improving threat detection, automation, and security operations efficiency.
Read Article
SIEM
Explore effective integration of cloud security monitoring with SIEM for enhanced threat detection, compliance, and real-time visibility across environments.
Read Article
SIEM
Explore leading SIEM software brands enhancing compliance through automated reporting, real-time monitoring, and integration with key regulatory frameworks.
Read Article
SIEM
Explore how SIEM solutions with built-in compliance reporting enhance regulatory adherence, automate checks, and improve security governance for enterprises.
Read Article
We are committed to delivering cutting-edge cybersecurity solutions that empower organizations to stay ahead of threats
©Cybersilo 2026 - All Rights Reserved