NIS2 Guide: how to achieve compliance?

What is the NIS2 directive?

NIS2 (Network and Information Security 2) succeeds the 2016 NIS Directive with a broader scope and strengthened requirements. Its objective: to raise the level of cybersecurity across all actors whose failure could disrupt the economy and society.

As a directive, it is not directly applicable: each Member State transposes it into national law and designates its competent authorities. In France, ANSSI leads the framework and publishes the practical implementation details.

The text mandates a risk-based approach: proportionate technical and organisational measures, governance involving the management body, incident management, business continuity, supply chain security and cyber hygiene.

Essential or important entity: the key distinction

NIS2 classifies organisations into two categories, which determine the intensity of oversight and the level of sanctions. The classification depends on the sector and size.

The baseline security measures are broadly comparable between both categories; it is primarily the oversight regime and sanctions that differ.

Who is affected?

NIS2 covers 'highly critical' and 'critical' sectors. The size criterion (generally from medium-sized enterprises onwards: 50 employees or €10M in turnover) triggers applicability, with exceptions for entities deemed critical regardless of their size.

• Highly critical sectors: energy, transport, banking, health, water, digital infrastructure, public administration, space.
• Critical sectors: postal and courier services, waste management, chemicals, food and agriculture, manufacturing, digital providers, research.
• Suppliers and subcontractors: indirectly in scope through supply chain security requirements.
• Subsidiaries and establishments: to be included in the scope analysis.

Security and governance obligations

NIS2 imposes a baseline set of minimum measures, to be adapted to risk, and governance borne by senior management. These measures are not optional: their absence is in itself a breach.

• Risk analysis and information system security policies.
• Incident management: detection, response, notification.
• Business continuity, backup management and disaster recovery.
• Supply chain security and supplier relationship management.
• Security of system acquisition, development and maintenance, and vulnerability management.
• Encryption policies, access control, multi-factor authentication, and cyber hygiene.
• Cybersecurity training and effective involvement of the governing body.

What penalties apply in the event of non-compliance?

NIS2 provides differentiated sanctions based on entity category and introduces direct liability for executives — a game-changing development at board level.

How to achieve compliance: the 8-step roadmap

Step 1 — Determine your applicability

Verify whether your sector and size place you in the essential or important entity category, and document this analysis: it determines the intensity of your obligations and your registration requirements with the authority.

Remember to include your subsidiaries and establishments, and to check the special cases of critical operators subject to the directive regardless of their size.

• Cross-reference your sector of activity with size thresholds.
• Identify your subsidiaries and establishments in scope.
• Register with the competent authority if required.

Step 2 — Involve senior management

The governing body must approve security measures, receive training on cyber risks, and ensure ongoing oversight. Without top-level sponsorship, NIS2 compliance remains theoretical — and the personal liability of executives is now at stake.

Place cybersecurity on the agenda of management committees and formalise governance (roles, committee structures, reporting).

• Have the security policy approved by senior management.
• Train executives on cyber risks.
• Put cybersecurity on the agenda of governance bodies.

Step 3 — Conduct a risk analysis

Map your assets, threats, and vulnerabilities, then prioritise measures according to risk. This is the foundation of your information systems security policy and the starting point for the entire framework.

This analysis must remain a living document: reassessed regularly and following any significant change.

• Inventory your critical assets, systems, and functions.
• Assess threats and vulnerabilities, and prioritise remediation.
• Periodically reassess the analysis.

Step 4 — Deploy technical and organisational measures

Implement the expected baseline: access control, multi-factor authentication, encryption, logging, network segmentation, patch and vulnerability management, and tested backups. Formalise each policy to make it auditable.

The objective is not to stack tools, but to cover identified risks in a coherent and documented manner.

• Deploy MFA, encryption, and granular access control.
• Manage patches and vulnerabilities proactively.
• Regularly test your backups and recovery procedures.

Step 5 — Structure incident management

Establish detection capabilities, a response procedure, and a notification chain that enable you to meet the required deadlines. These deadlines are tight: they can only be met with a procedure prepared and tested in advance.

Define who raises the alert, who qualifies the incident, who decides to notify, and according to what template, so that nothing is improvised in a crisis situation.

• Early warning within 24 hours, notification within 72 hours, final report within 1 month.
• Designate roles within the crisis response team.
• Test the procedure through exercises.

Step 6 — Secure the supply chain

The supply chain is now a major attack vector: compromising a supplier to reach its customers. NIS2 requires you to assess the security of your critical suppliers and to embed security requirements in your contracts.

Monitor these commitments over time: a supplier's security posture is never permanently assured.

• Map and assess your critical suppliers.
• Include security clauses in your contracts.
• Monitor supplier commitments and incidents.

Step 7 — Train and raise awareness

The human factor remains the primary entry point for attacks. Deploy a regular awareness programme (phishing, passwords, reporting reflexes) and targeted training for exposed functions and executives.

A shared cyber culture turns every employee into a first line of defence.

• Raise awareness among all employees on a regular basis.
• Provide specific training for exposed functions and senior management.
• Measure effectiveness (phishing simulations, reporting rates).

Step 8 — Audit and continuously improve

Test your controls through audits, exercises, and, where appropriate, penetration tests; measure, remediate, and document. NIS2 requires demonstrable continuous improvement, not static compliance.

Leveraging a recognised framework such as ISO 27001 provides lasting structure to this approach and facilitates the burden of proof.

• Schedule regular audits and exercises.
• Document gaps and remediation plans.
• Consider ISO 27001 as a structuring framework.

Common mistakes to avoid

• Waiting for the final national transposition before acting: the core cyber requirements are already enforceable and take time to deploy.
• Believing that cybersecurity is an "IT matter": NIS2 places direct accountability on management.
• Overlooking the supply chain, a major attack vector.
• Not preparing the notification procedure, which cannot be improvised within 24 hours.
• Underestimating the scope: subsidiaries, establishments and critical actors are often forgotten.
• Stacking tools without a coherent risk analysis.
• Neglecting awareness, while the human factor remains the leading cause of incidents.

How Data Comply One supports you

Data Comply One structures your NIS2 compliance from end to end: risk analysis, security policies, incident management, supplier monitoring, and a progress dashboard. Everything is centralised and demonstrable in the event of an ANSSI audit.

Two modes are available to you: manage your compliance yourself using the software, or outsource it to our experts — a virtual CISO — who run the programme on your behalf directly on the platform, aligning NIS2 with your other obligations. This is a valuable asset for mid-sized and small businesses newly subject to the directive, which often lack in-house resources.

The cybersecurity training brings leaders and teams on board, and the approach naturally aligns with ISO 27001 for those targeting recognised certification. You turn a regulatory constraint into a foundation of trust with your customers and partners.

Where do you stand? ·