the whole job

NIS2: the whole job, in order

NIS2 asks for a lot, in articles written for lawyers. Here is the same job as a plan: six phases, in the order that holds up, with who carries each step, what it produces and the proof it leaves.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, systems and settings that someone builds, and checks that someone keeps running. Advisers tend to write the first, your IT team or an integrator builds the second, and everyone owns the third. The order follows dependencies, so a step needs the ones before it. The deadlines come from your national law, which this plan does not replace. Under each step a small note names the legal basis, or says practice where no text sets it.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

know where you stand

Find out whether NIS2 covers you, in which category, and who answers for it.

  1. work out whether NIS2 covers you

    Check your activity against the sectors listed in the annexes and your size against the thresholds, counting staff and money of linked companies. Some types of entity are covered at any size.

    • owner legal or DPO
    • decide and document
    what it produces
    a one-page scope note with the date and the reasoning
    the proof it leaves
    the scope note, approved by management

    the work page

    basis NIS2 Art. 2(1), 2(2)

  2. name who answers for it

    Management approves the security measures, oversees them and can be held liable for failures. Decide who signs, and who reports to them on how the work is going.

    • owner board
    • decide and document
    what it produces
    a board decision naming an accountable owner and an operational lead
    the proof it leaves
    the minutes of that decision

    the work page

    basis NIS2 Art. 20(1)

  3. find your national act and its dates

    NIS2 reaches you through your member state's law. Find that act, any registration duty for entities like yours, and the dates it sets. Put them in the same note as the scope.

    • owner legal or DPO
    • decide and document
    what it produces
    a list of national duties and dates, with the source of each
    the proof it leaves
    the list, checked against the act on a stated date

    basis working practice. No legal text sets this.

you are done with this phase when you can say in one page whether NIS2 covers you, why, and who signs for it.
02

set the rules of the house

Agree who decides what, who is trained and how much risk the company accepts.

  1. give each measure an owner

    The law lists ten kinds of measure. Give each one a named owner and a place on the board's yearly agenda. An owner is one person with the time and the authority to act.

    • owner board
    • decide and document
    what it produces
    a table of the ten measures with an owner each
    the proof it leaves
    the table, approved by the board

    basis NIS2 Art. 21(1)

  2. train management

    Members of the management body have to follow training. Run one session on their duties: what they approve, what they oversee, what to ask. Keep the attendance record and the material.

    • owner board
    • build and configure
    what it produces
    a management session and an attendance record
    the proof it leaves
    the record and the slides as delivered

    the work pagethe control: awareness-training

    basis NIS2 Art. 20(2)

  3. decide how much risk you accept

    State in plain words what the company will not accept: for example a day without ordering, or customer data in the wrong hands. The risk assessment in the next phase will use this as its yardstick.

    • owner board
    • decide and document
    what it produces
    a short statement of risk limits
    the proof it leaves
    the statement, signed by management

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show a board decision, a named owner for each measure and a training record for management.
03

see what you have

List the systems, the data and the people who can reach them, then write down the risks.

  1. list systems, data, suppliers and admin accounts

    Start from what you can export today: the admin list from your identity provider, the SaaS list from finance, the supplier list from procurement. Give each system an owner and mark the ones that would stop the business.

    • owner head of IT
    • build and configure
    what it produces
    an inventory with an owner and a criticality mark per system
    the proof it leaves
    dated exports and the inventory

    the work pagethe control: asset-inventory

    basis NIS2 Art. 21(2)(i)

  2. write the risk assessment and the security policy

    Score the risks against the limits management set, pick the measures that bring them down and record what you accept. Write the policy last, as a description of what the company really does.

    • owner head of IT
    • decide and document
    what it produces
    a risk register with owners and dates, and a short policy
    the proof it leaves
    the register and the policy, approved by management

    the work page

    basis NIS2 Art. 21(2)(a)

you are done with this phase when you can show a current inventory and a dated risk assessment with owners.
04

put the measures in place

Make the choices real: sign-in, backups, patching, suppliers, encryption and everyday habits.

  1. close the sign-in gaps

    Turn on multi-factor authentication for every admin, then for everyone. Remove accounts nobody can explain. Give supplier and guest accounts an owner and an end date.

    • owner head of IT
    • build and configure
    what it produces
    an MFA coverage report and a cleaned admin list
    the proof it leaves
    the report, the exception list with owners and dates

    the work pagethe control: mfa

    basis NIS2 Art. 21(2)(i), 21(2)(j)

  2. make backups you have restored

    Keep backups the attacker cannot reach from a stolen admin account, and restore from them on a schedule. A backup you have never restored is a hope.

    • owner head of IT
    • build and configure
    what it produces
    a backup scope, a restore test and a recovery plan
    the proof it leaves
    restore test records with dates and results

    the work pagethe control: backup-recovery

    basis NIS2 Art. 21(2)(c)

  3. patch and buy with security in mind

    Know what is exposed to the internet, scan it, patch by priority and write down what you decided not to fix. Add security questions to how you buy and build software.

    • owner head of IT
    • build and configure
    what it produces
    a scan routine, a patch rule and a short list of accepted risks
    the proof it leaves
    scan results, patch records and the accepted-risk list

    the work pagethe control: vulnerability-management

    basis NIS2 Art. 21(2)(e)

  4. write down where you use encryption

    Record where data is encrypted at rest and in transit, who holds the keys and what happens when one is lost. Keep it short and keep it true.

    • owner head of IT
    • decide and document
    what it produces
    a one-page encryption and key note
    the proof it leaves
    the note, reviewed by the owner each year

    basis NIS2 Art. 21(2)(h)

  5. tier your suppliers and ask the right questions

    Sort suppliers by what they can reach, ask the critical ones about their security and put it in the contract. Look at the weak points of each direct supplier, as the law says.

    • owner procurement
    • build and configure
    what it produces
    a tiered supplier register and a standard set of contract terms
    the proof it leaves
    the register and the answers received

    the work pagethe control: supplier-management

    basis NIS2 Art. 21(2)(d), 21(3)

  6. train everyone in the basics

    Run a short yearly programme on spotting phishing, reporting something odd and who to call. Cover new joiners too. Keep the attendance list with the material.

    • owner HR
    • build and configure
    what it produces
    a yearly programme and an attendance record
    the proof it leaves
    attendance record and material with its version

    the work pagethe control: awareness-training

    basis NIS2 Art. 21(2)(g)

you are done with this phase when you can show each measure working, with an owner and the proof it leaves.
05

be ready for the bad day

Decide who handles an incident, how you tell the authority in time and how you practise.

  1. set up incident handling and roles

    Name who can declare an incident at any hour, who leads, who talks to customers and who talks to the authority. Decide how people report something odd, and where the log of events is kept.

    • owner head of IT
    • decide and document
    what it produces
    an incident procedure with named roles and a contact sheet
    the proof it leaves
    the procedure and the contact sheet, reviewed yearly

    the work pagethe control: incident-management

    basis NIS2 Art. 21(2)(b)

  2. prepare to report in 24 hours, 72 hours and a month

    Significant incidents go to your national contact in stages: an early warning, a fuller notification and a final report. Prepare a template for each and decide who may send it. The clock runs from when you become aware.

    • owner legal or DPO
    • build and configure
    what it produces
    three report templates and a rule for who sends them
    the proof it leaves
    the templates and a dry run

    the work page

    basis NIS2 Art. 23(4)

  3. practise once and fix what breaks

    Run a short exercise on a realistic scenario with the people who would be in the room. Write down what went wrong and who fixes it.

    • owner everyone
    • prove and operate
    what it produces
    an exercise report with actions and owners
    the proof it leaves
    the report and the action list, closed or dated

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show a named incident lead, a reporting procedure and a record of a practice run.
06

show it keeps working

Check that the measures work, keep the proof together and report to management.

  1. check whether the measures work

    Choose a few measurable checks: share of admins with MFA, last restore test, open critical patches, supplier answers received. Look at them on a rhythm and write down what you did about the bad ones.

    • owner head of IT
    • prove and operate
    what it produces
    a short list of measures with a rhythm and a result each
    the proof it leaves
    the results, dated

    the work page

    basis NIS2 Art. 21(2)(f)

  2. keep the proof in one place

    Collect the outputs of every step above in one folder, organised by measure. An evidence map helps: each row has an owner and a refresh rhythm.

    • owner head of IT
    • prove and operate
    what it produces
    an evidence folder organised by measure
    the proof it leaves
    the folder, with each item dated

    the work page

    basis working practice. No legal text sets this.

  3. fix gaps and report to management

    When you find a measure that falls short, correct it without undue delay. Once a year, show management the state of each measure and the open gaps, and record what they decided.

    • owner board
    • prove and operate
    what it produces
    a yearly report to the board
    the proof it leaves
    the report and the minutes

    the work page

    basis NIS2 Art. 21(4); NIS2 Art. 20(1)

you are done with this phase when you can hand an auditor or a regulator one folder that shows each measure working.

who carries what

The same steps, grouped by the person who has to act.

legal or DPO

board

head of IT

procurement

HR

everyone

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Write the one-page scope note this week, and put the board decision on the next agenda.

    run the finder first