How to prepare for NIS2 and Cyber Essentials: a 90-day method

What are the steps to prepare for NIS2?

NIS2 is Directive (EU) 2022/2555. Member states were due to apply it through national laws from 18 October 2024, and those laws are what bind you. The steps below work whatever stage your country has reached, because national laws follow the Directive closely on scope, governance, the minimum measures and reporting.

• 1. Test each legal entity: Annex I or II activity, size at enterprise level, any size-independent case.
• 2. Register with your national authority as soon as its register opens; gather IP ranges, domains and contacts first.
• 3. Brief the management body, get its approval of the measures in a minute, and book its training.
• 4. Score your practices 0-4 against evidence and rank the gaps by gap x impact.
• 5. Close the biggest risk reducers first: MFA, tested backups, patch deadlines, endpoint protection, segmentation of operational technology.
• 6. Register, assess and control your critical suppliers and managed service providers.
• 7. Write your significance rules and rehearse the reporting clock in a tabletop exercise.
• 8. Keep an evidence register and report to the board every quarter.

Does NIS2 apply to my organisation?

Three tests decide it. First, activity: the Directive lists entity types in Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space) and Annex II (postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research). Read the entity type wording: under transport, for example, inland freight water transport companies are listed, ordinary road hauliers are not.

Second, size, measured at enterprise level under the EU SME definition, which counts linked and partner enterprises. Medium and large enterprises are in. Third, size-independent cases such as trust service providers, DNS providers, top-level domain registries, public electronic communications providers, public administration and entities a member state designates.

NIS2 classifies the legal entity as a whole. If one legal entity runs an Annex I activity and the enterprise is large, the entity is essential, even if most of its people do something else. Write down the reasoning and have counsel confirm it.

What is the difference between essential and important entities?

The duties are the same: the measures in Article 21 and the reporting in Article 23. Supervision and penalties differ. The table summarises the Directive; national law can go further.

What does NIS2 require of the board?

Article 20 requires the management body to approve the cybersecurity risk-management measures, oversee their implementation and follow training, and allows members to be held liable for failures under national law. National law decides who counts as the management body; many organisations with two-tier boards train the supervisory board too.

In practice: a minuted approval with a policy version and date, a cyber item on the agenda at least each quarter, and a training record for each member with a refresher date. Present a business case honestly, low-risk scenario first. In our worked example, a 400-person logistics company estimated the cost of doing nothing in year 1 at EUR 82,800, EUR 207,000 or EUR 425,400 depending on the scenario, against EUR 297,200 for doing it in year 1 and EUR 209,840 in year 2. Only the high case paid back in year 1, and the board approved anyway, because the law had already made the decision to act.

What are the NIS2 incident reporting deadlines?

For a significant incident, one that causes or can cause severe operational disruption or financial loss, or considerable damage to others, the Directive sets stages. The clock starts when you become aware.

• Write one page of significance rules from your own services before you need them.
• Decide early and record the reasons, names and time.
• If you are genuinely unsure near hour 24, send the early warning.
• Run the personal data breach decision with your DPO in parallel: GDPR notification is due without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk.

How does a gap assessment work, with a worked example?

Score each practice 0 to 4: not in place, ad hoc, defined, operating with evidence, measured. No evidence means 2 at most. Set a target and an impact from 1 to 3, then rank by priority, which is the gap multiplied by impact. A practice two levels short with high impact scores 6; one level short scores 3.

The worked example scored 28 practices in nine areas. Average maturity was 0.64 at baseline and 2.61 after 13 weeks, with 17 practices at target and 11 still below it, none High. Supply chain moved furthest, from 0 to 2.33; hygiene and training and access and assets reached the target of 3.

How should you handle suppliers and managed service providers?

Supply chain security is one of the ten Article 21 themes. The Directive asks you to take into account each direct supplier's vulnerabilities, the quality of its products and its cybersecurity practices, including secure development, and to correct shortfalls promptly. Managed service providers deserve the closest look, because they usually hold admin rights across everything they manage.

A workable method: list every supplier that can reach your systems or data; rate each as critical, high, medium or low; for critical and high suppliers, ask for real assurance (an ISO/IEC 27001 certificate with a scope that covers your service, a SOC 2 report you actually read, or Cyber Essentials Plus for UK suppliers) and record the gaps; control their access yourself with named accounts, MFA and a logged jump host; and add security, incident-notice and cooperation terms at renewal, drafted by counsel.

In the worked example, the root cause of a ransomware incident was a software vendor's remote-access account without MFA that sat outside the jump host. The fix had been approved eleven days earlier, on 30 September, but was not due until 23 October. Supplier access is often the shortest path in.

How does Cyber Essentials fit with NIS2?

Cyber Essentials is a UK government-backed certificate for five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds hands-on testing by the assessor. NIS2 does not require it, but it is good, independently tested evidence for four of the ten NIS2 measure themes, and UK buyers ask for it: IASME says it is required in many central government contracts.

Since 27 April 2026, for new assessment accounts, MFA is mandatory on every cloud service where it is available and cloud services cannot be excluded from scope. IASME lists fees from GBP 320 plus VAT for micro organisations to GBP 600 for 250 staff or more; certificates last 12 months. Critical and high-risk updates must be installed within 14 days. Check the current requirements with the NCSC and IASME before you apply.

What are the common mistakes?

• Calling yourself 'NIS2 compliant' or 'NIS2 certified'. Describe your entity type, registration, board approval and how you check the measures.
• Classifying a department instead of the legal entity.
• Waiting for the national law when the measures are already known.
• Treating the board as an audience rather than the body that approves and is trained.
• Backups that have never been restored.
• MFA on email only, not on every cloud service, remote access and admin account.
• Leaving supplier remote access to vessels, plants or servers uncontrolled.
• Waiting for the root cause before sending the early warning.
• Pasting incident detail into an unapproved AI tool to draft a report.

Where can I get help putting this into practice?

The NIS2 and Cyber Essentials Readiness Kit from Bodhih Training follows one logistics company through all of this, with the workbook, forms, policies, playbook and board memo to run it yourself. To check where your staff stand on security judgement, AssessAll's Workplace Cybersecurity Awareness Assessment is a measured starting point, and if you are setting personal goals for leading the programme, Jobulary's guide to the WOOP method helps you plan for the obstacles.

Whatever you use, start with the scope test and the board. Everything else follows from those two decisions.