# NIS2 Cybersecurity Risk-Management Measures: [Entity name]

> Design and evidence document for the cybersecurity risk-management
> measures that Article 21 of the NIS2 Directive (Directive (EU)
> 2022/2555) requires of essential and important entities, with
> management body accountability (Article 20) and the incident reporting
> path (Article 23). For digital infrastructure and digital providers it
> follows the technical and methodological requirements of Commission
> Implementing Regulation (EU) 2024/2690 and the ENISA Technical
> Implementation Guidance (version 1.0, June 2025). It records entity
> classification, the ten minimum measures one by one, the documented
> reasoning where a requirement is not applied, significant incident
> criteria, supply chain security, effectiveness metrics and the
> national transposition that applies. Replace every `[bracketed]` value
> and every row marked *Example*. Obligations reach entities through
> national law: check the transposing act of each Member State that has
> jurisdiction and the consolidated texts. This is a documentation
> format, not legal advice.

<!--
Guidance: How to use this template
- Fill section 2 first. Classification (essential or important), the
  Member State with jurisdiction and whether Implementing Regulation
  (EU) 2024/2690 applies decide the detail required everywhere else.
- Section 5 has one subsection per point (a) to (j) of Article 21(2).
  Keep the lettering so a supervisor can find each measure. For entities
  covered by the Implementing Regulation, each subsection lists the
  Annex sections that set the detailed requirements.
- Where the Implementing Regulation says a requirement applies "where
  appropriate", "where applicable" or "to the extent feasible" and you
  decide not to apply it, document the reasoning (Article 2(2) of that
  Regulation). Section 10 is that record.
- Financial entities under DORA: Article 4 of NIS2 lets equivalent
  sector rules apply instead, and DORA is such an act for its entities.
  Use the DORA Register of Information
  (`compliance/dora-ict-third-party-register`) and DORA processes, and
  keep this template only for NIS2 entities in the group that DORA does
  not cover.
- Related documents: Information Security Policy
  (`compliance/information-security-policy`), Risk Methodology
  (`compliance/risk-methodology`), Risk Register
  (`compliance/risk-register`), Statement of Applicability
  (`compliance/statement-of-applicability`), NIST CSF 2.0 Profile
  (`compliance/nist-csf`), Incident Response Plan
  (`compliance/incident-response-plan`), Business Continuity
  (`compliance/business-continuity`), Supplier Security Assessment
  (`compliance/supplier-security-assessment`), Security Architecture
  (`security/security-architecture`).
-->

## Document control

<!-- Guidance: Identify the entity, its classification and the authorities it reports to. A change in classification, sector or main establishment is a new major version. -->

| Field | Value |
|---|---|
| Document ID | [NIS2-MEAS-001] |
| Entity | [Legal name], [registration number] |
| Sector and subsector (Annex I or II) | [Sector, subsector, entity type] |
| Classification | [Essential / Important] |
| Member State with jurisdiction | [Member State], basis: [Article 26 rule] |
| Competent authority and CSIRT | [Names, contact points] |
| Implementing Regulation (EU) 2024/2690 applies | [Yes, entity type / No] |
| Registration with authority | [Reference, date] |
| Version | [0.1] |
| Status | [Draft / In review / Approved by management body / Superseded] |
| Owner | [@ciso] |
| Approvers/reviewers | [@ceo], [@management-body], [@legal], [@dpo], [@internal-audit] |
| Classification of this document | [Confidential] |
| Last updated | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Management body (Article 20(1) approval) | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| CISO | [@name] | [Decision] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
| Internal audit (independent review) | [@name] | [Opinion] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved by the management body after gap remediation wave 1 |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Updated for second Member State transposition after opening a branch |

## Contents

<!-- Guidance: Keep this list aligned with the headings below. -->

1. [Purpose, scope and basis](#1-purpose-scope-and-basis)
2. [Entity classification and jurisdiction](#2-entity-classification-and-jurisdiction)
3. [Governance and management body accountability](#3-governance-and-management-body-accountability)
4. [Risk assessment approach](#4-risk-assessment-approach)
5. [Measures by Article 21(2) point](#5-measures-by-article-212-point)
6. [Implementation status and gap plan](#6-implementation-status-and-gap-plan)
7. [Incident reporting design](#7-incident-reporting-design)
8. [Supply chain security](#8-supply-chain-security)
9. [Effectiveness assessment and metrics](#9-effectiveness-assessment-and-metrics)
10. [Documented reasoning for requirements not applied](#10-documented-reasoning-for-requirements-not-applied)
11. [Framework mapping](#11-framework-mapping)
12. [Supervision, enforcement and national transposition](#12-supervision-enforcement-and-national-transposition)
13. [Traceability matrix](#13-traceability-matrix)
14. [Glossary and references](#14-glossary-and-references)

## 1. Purpose, scope and basis

<!-- Guidance: State which network and information systems and services are covered, and the legal basis. NIS2 measures cover the systems the entity uses for its operations or to provide its services, not only the regulated service. -->

### 1.1 Purpose and scope

This document shows how [Entity] meets the cybersecurity
risk-management obligations of NIS2 as transposed in [Member State]. It
is the design record the management body approves, the plan the security
team executes and the evidence index a supervisor or auditor reviews.

| Item | Value |
|---|---|
| Services in scope | *Example:* Managed infrastructure operations, managed backup and 24x7 monitoring for business customers |
| Network and information systems in scope | *Example:* Customer-facing management platform, remote access gateways, internal IT, two data centre colocations, cloud tenant |
| Locations | *Example:* Head office DE, operations centre PL |
| Exclusions and reasons | [None / Systems with no link to services or operations, with reasoning] |

### 1.2 Basis

| Source | Use |
|---|---|
| Directive (EU) 2022/2555 (NIS2), Articles 3, 4, 20, 21, 23, 26, 27, 32 to 34 | Obligations, classification, jurisdiction, enforcement |
| Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 | Technical and methodological requirements and significant incident criteria for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers |
| ENISA, Technical implementation guidance on cybersecurity risk management measures, version 1.0 (26 June 2025), and its mapping table | Practical guidance, evidence examples and mappings to standards |
| [National transposing law and secondary rules] | Binding national obligations and reporting channels |

NIS2 Member States had to adopt transposing measures by 17 October 2024
and apply them from 18 October 2024. The Implementing Regulation was
published on 18 October 2024 and entered into force on the twentieth day
after publication. On 20 January 2026 the Commission proposed targeted
amendments to NIS2 (COM(2026) 13, procedure 2026/0012(COD)), and the
Digital Omnibus proposal of November 2025 would add a single entry point
for incident reports. Neither was adopted at the time of writing; check
their status and the consolidated texts before relying on this document.

## 2. Entity classification and jurisdiction

<!-- Guidance: Article 3 makes entities of Annex I types above the medium-sized enterprise ceilings essential, names some entity types essential regardless of size, and makes other Annex I and II entities in scope important. Member States can also identify entities. Pitfall: assessing size for the operating company alone; size follows the EU SME definition, including partner and linked enterprises. -->

### 2.1 Classification record

| Question | Answer | Evidence |
|---|---|---|
| Sector and entity type in Annex I or II | *Example:* Annex I, ICT service management (business-to-business), managed service provider | Service catalogue, customer contracts |
| Size under Recommendation 2003/361/EC, including partner and linked enterprises | *Example:* Large (420 staff, turnover above the medium ceiling) | Annual accounts |
| Size-independent rule in Article 2(2) or 3(1) applies | *Example:* No | Legal assessment |
| Identified by a Member State | *Example:* No | Authority correspondence |
| Classification | *Example:* Essential (Article 3(1)(a)) | Legal opinion, date |
| Sector-specific act with equivalent effect (Article 4) | *Example:* None | Legal assessment |

### 2.2 Jurisdiction

As a rule, the Member State where the entity is established has
jurisdiction. Article 26 places certain digital entity types, including
DNS service providers, TLD name registries, entities providing domain
name registration services, cloud computing, data centre, content delivery network, managed service and managed security service
providers, and online marketplaces, search engines and social networking
platforms, under the Member State of their main establishment in the
Union. Register with that authority (Article 27 for these entity types)
and record every other Member State where national rules still apply,
for example for public electronic communications.

| Member State | Basis | Competent authority | CSIRT or reporting portal | Registered |
|---|---|---|---|---|
| DE *(Example)* | Main establishment (Article 26(1)(b), (2)) | [Authority] | [Portal] | YYYY-MM-DD |
| PL *(Example)* | Operations centre; no separate jurisdiction for this entity type | Not applicable | Not applicable | Not applicable |

## 3. Governance and management body accountability

<!-- Guidance: Article 20 requires the management body to approve the measures, oversee implementation and be liable for infringements, and requires members to follow training. Record the decisions and the training, not just the policy. -->

| Item | Arrangement | Evidence |
|---|---|---|
| Approval of measures | *Example:* Management board approves this document and the risk treatment plan yearly and on major change | Board minutes YYYY-MM-DD |
| Oversight of implementation | *Example:* Quarterly security report to the board: status of section 6, incidents, metrics of section 9 | Board pack |
| Accountable member | *Example:* Chief operating officer | Board resolution |
| Person reporting directly to the management body on security | *Example:* CISO (Implementing Regulation Annex point 1.2.3) | Organisation chart |
| Training of members (Article 20(2)) | *Example:* Four-hour course at appointment, two-hour refresher yearly; covers risk identification and assessing practices | Training records |
| Staff training offered | *Example:* Yearly role-based training (see 5.7) | LMS report |
| Segregation of conflicting duties | *Example:* Security operations separated from IT operations; independent review by internal audit | RACI |

### 3.1 RACI

| Activity | Management body | CISO | IT operations | Legal | Internal audit | Procurement |
|---|---|---|---|---|---|---|
| Approve measures and residual risk | A | R | C | C | I | I |
| Operate measures | I | A | R | I | I | C |
| Notify significant incidents | I | A | R | C | I | I |
| Independent review | I | C | C | I | A | I |
| Supplier security requirements | I | C | C | C | I | A |

R responsible, A accountable, C consulted, I informed.

## 4. Risk assessment approach

<!-- Guidance: Article 21(1) asks for appropriate and proportionate measures based on the state of the art, relevant standards and cost, and Article 21(2) requires an all-hazards approach that protects systems and their physical environment. Annex point 2.1 of the Implementing Regulation adds a documented risk assessment, a risk treatment plan and management acceptance of residual risk. -->

| Element | Approach |
|---|---|
| Method | [Reference to Risk Methodology (`compliance/risk-methodology`)] |
| Hazards covered | *Example:* Cyber attacks, human error, system failure, supplier failure, power and cooling loss, fire, flood, theft, physical intrusion |
| Proportionality factors | Exposure to risk, entity size, likelihood and severity of incidents, societal and economic impact |
| Acceptance criteria | *Example:* Residual risk above 12 on a 25-point scale requires management body acceptance |
| Frequency | *Example:* Yearly, after significant incidents and after significant changes to operations or risk |
| Outputs | Risk register entries, risk treatment plan, residual risk acceptance |

Record risks in the Risk Register (`compliance/risk-register`) and their
treatment in the Risk Treatment Plan (`compliance/risk-treatment-plan`).

## 5. Measures by Article 21(2) point

<!-- Guidance: One subsection per point. For each: the objective in your words, the Implementing Regulation Annex sections where it applies, the design decisions, the evidence and the owner. Use measure IDs NIS-M-a-nn so section 13 can trace them. Pitfall: listing policies without the operating evidence that they work. -->

### 5.1 (a) Policies on risk analysis and information system security

Annex sections 1 (security policy) and 2 (risk management, compliance
monitoring, independent review).

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-a-01 *(Example)* | Network and information system security policy approved by the management body, with objectives and topic-specific policies | Policy, approval record | CISO | Implemented |
| NIS-M-a-02 *(Example)* | Risk management framework with yearly assessment and treatment plan | Risk register, treatment plan | Risk manager | Implemented |
| NIS-M-a-03 *(Example)* | Compliance monitoring with quarterly reporting to the management body | Compliance dashboard | CISO | Partial |
| NIS-M-a-04 *(Example)* | Independent review by internal audit outside the line of authority of the reviewed area | Audit report | Internal audit | Planned |

### 5.2 (b) Incident handling

Annex section 3 (policy, monitoring and logging, event reporting,
assessment and classification, response, post-incident review).

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-b-01 *(Example)* | Incident handling policy with roles, classification and escalation, linked to Article 23 reporting (section 7) | Incident Response Plan (`compliance/incident-response-plan`) | Security operations lead | Implemented |
| NIS-M-b-02 *(Example)* | Central logging of security events from management platform, remote access and identity, with retention and integrity protection | SIEM configuration | Security operations | Implemented |
| NIS-M-b-03 *(Example)* | Simple reporting channel for staff, suppliers and customers to report suspicious events | Portal and mailbox, awareness material | Service desk | Implemented |
| NIS-M-b-04 *(Example)* | Post-incident review for every significant incident with lessons tracked to closure | Review records | CISO | Partial |

### 5.3 (c) Business continuity, backup, disaster recovery and crisis management

Annex section 4 (continuity and recovery plan, backup and redundancy,
crisis management) and section 13 (supporting utilities).

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-c-01 *(Example)* | Business continuity and disaster recovery plan based on the risk assessment, with order of recovery and recovery objectives | Business Continuity (`compliance/business-continuity`), Disaster Recovery Plan (`ops/disaster-recovery-plan`) | Continuity manager | Implemented |
| NIS-M-c-02 *(Example)* | Immutable, offline-capable backups of customer management platform and configuration; restore tests quarterly | Backup and Restore Procedure (`ops/backup-restore-procedure`), test logs | IT operations | Implemented |
| NIS-M-c-03 *(Example)* | Crisis management process with roles, authority communication channel and security maintained in crisis | Crisis plan, exercise report | COO | Partial |
| NIS-M-c-04 *(Example)* | Redundant power and cooling at colocations, verified through provider evidence | Provider reports | Facilities | Implemented |

### 5.4 (d) Supply chain security

Annex section 5 (policy and directory of suppliers). Detailed in section 8.

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-d-01 *(Example)* | Supply chain security policy stating the entity's role in the supply chain and supplier selection criteria | Policy | Procurement | Implemented |
| NIS-M-d-02 *(Example)* | Security clauses in supplier contracts (requirements, staff skills, background checks, incident notification, audit, vulnerability handling) | Contract template | Legal | Partial |
| NIS-M-d-03 *(Example)* | Supplier register with criticality tiers and periodic reassessment | Supplier register | Procurement | Implemented |

### 5.5 (e) Security in acquisition, development and maintenance, including vulnerability handling and disclosure

Annex section 6 (acquisition, secure development, configuration,
change, security testing, patching, network security, segmentation,
malware protection, vulnerability handling) and section 13.

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-e-01 *(Example)* | Security requirements in acquisition of ICT products and services | Procurement checklist | Procurement | Implemented |
| NIS-M-e-02 *(Example)* | Secure development life cycle for in-house automation and portal | Secure Coding Standard (`security/secure-coding-standard`) | Engineering lead | Partial |
| NIS-M-e-03 *(Example)* | Configuration baselines and change management for customer-facing platforms | Baselines, change records | IT operations | Implemented |
| NIS-M-e-04 *(Example)* | Patch management with risk-based deadlines and documented exceptions | Patch reports | IT operations | Implemented |
| NIS-M-e-05 *(Example)* | Network architecture documented; zones segmented; customer environments isolated from each other and from internal IT | Network Architecture Design (`architecture/network-architecture-design`) | Network lead | Implemented |
| NIS-M-e-06 *(Example)* | Vulnerability handling and coordinated disclosure policy with a public reporting address | Security policy page, CVD process | CISO | Implemented |
| NIS-M-e-07 *(Example)* | Yearly penetration test of management platform and remote access | Penetration Test Report (`security/pentest-report`) | CISO | Implemented |

### 5.6 (f) Policies and procedures to assess effectiveness

Annex section 7. Detailed in section 9.

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-f-01 *(Example)* | Effectiveness policy defining what is measured, how, when, by whom and how results are evaluated | Policy, metric catalogue | CISO | Partial |

### 5.7 (g) Basic cyber hygiene practices and cybersecurity training

Annex section 8 (awareness and hygiene, security training).

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-g-01 *(Example)* | Awareness programme for all staff, including phishing simulations and hygiene rules (updates, passwords, removable media, reporting) | LMS, simulation results | HR and CISO | Implemented |
| NIS-M-g-02 *(Example)* | Role-based training for administrators and incident responders | Training plan | CISO | Partial |

### 5.8 (h) Cryptography and encryption

Annex section 9.

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-h-01 *(Example)* | Cryptography policy: approved algorithms and protocols by asset class, key management life cycle, review on new threats including post-quantum planning | Policy, key inventory | Security architect | Implemented |
| NIS-M-h-02 *(Example)* | Encryption of data in transit to customer environments and of backups at rest | Configuration evidence | IT operations | Implemented |

### 5.9 (i) Human resources security, access control and asset management

Annex sections 10 (human resources security), 11 (access control),
12 (asset management) and 13 (physical security).

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-i-01 *(Example)* | Background verification proportionate to role, joiner-mover-leaver process, disciplinary process | HR procedures | HR | Implemented |
| NIS-M-i-02 *(Example)* | Access control policy, least privilege, periodic access reviews | Access Review (`ops/access-review`) | IAM lead | Implemented |
| NIS-M-i-03 *(Example)* | Privileged access management with dedicated admin accounts and session recording for customer environments | PAM reports | IAM lead | Partial |
| NIS-M-i-04 *(Example)* | Asset inventory and classification covering hardware, software, data and services | Asset Inventory (`compliance/asset-inventory`) | IT operations | Implemented |
| NIS-M-i-05 *(Example)* | Physical access control and environmental protection at offices and colocations | Access logs, provider evidence | Facilities | Implemented |

### 5.10 (j) Multi-factor or continuous authentication and secured communications

Annex section 11 (including multi-factor authentication, 11.7). Secured
voice, video, text and emergency communications are designed here.

| ID | Measure | Evidence | Owner | Status |
|---|---|---|---|---|
| NIS-M-j-01 *(Example)* | Phishing-resistant MFA for all remote, privileged and customer-environment access; strength set by asset classification | IdP policy | IAM lead | Implemented |
| NIS-M-j-02 *(Example)* | Encrypted messaging and conferencing approved for internal and incident use | Tool standard | IT operations | Implemented |
| NIS-M-j-03 *(Example)* | Out-of-band emergency communication (separate tenant and phone tree) usable when primary systems are compromised | Crisis plan, exercise | COO | Planned |

## 6. Implementation status and gap plan

<!-- Guidance: Summarise status per point so the management body sees the whole picture. Article 21(4) requires corrective measures without undue delay when the entity finds it does not comply. -->

| Point | Measures | Implemented | Partial | Planned | Main gap | Target date | Owner |
|---|---|---|---|---|---|---|---|
| (a) *(Example)* | 4 | 2 | 1 | 1 | Independent review not yet performed | YYYY-MM-DD | Internal audit |
| (b) *(Example)* | 4 | 3 | 1 | 0 | Post-incident reviews not tracked to closure | YYYY-MM-DD | CISO |
| (c) *(Example)* | 4 | 3 | 1 | 0 | Crisis exercise with authority channel | YYYY-MM-DD | COO |
| (d) *(Example)* | 3 | 2 | 1 | 0 | Legacy contracts lack security clauses | YYYY-MM-DD | Legal |
| (e) *(Example)* | 7 | 6 | 1 | 0 | SDL coverage of automation scripts | YYYY-MM-DD | Engineering lead |
| (f) *(Example)* | 1 | 0 | 1 | 0 | Metric catalogue incomplete | YYYY-MM-DD | CISO |
| (g) *(Example)* | 2 | 1 | 1 | 0 | Role-based training | YYYY-MM-DD | CISO |
| (h) *(Example)* | 2 | 2 | 0 | 0 | None | Not applicable | Security architect |
| (i) *(Example)* | 5 | 4 | 1 | 0 | PAM rollout to all customer environments | YYYY-MM-DD | IAM lead |
| (j) *(Example)* | 3 | 2 | 0 | 1 | Emergency communication | YYYY-MM-DD | COO |
| Total *(Example)* | 35 | 25 | 8 | 2 | | | |

## 7. Incident reporting design

<!-- Guidance: Article 23 requires notification of significant incidents to the CSIRT or competent authority: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, intermediate reports on request and a final report within one month of the notification. Trust service providers notify within 24 hours. For entities covered by the Implementing Regulation, Articles 3 to 14 define when an incident is significant. -->

### 7.1 Reporting stages

| Stage | Deadline | Content (paraphrase) | Owner |
|---|---|---|---|
| Early warning | Without undue delay, within 24 hours of awareness | Whether unlawful or malicious action is suspected and whether cross-border impact is possible | Incident manager |
| Incident notification | Without undue delay, within 72 hours of awareness | Update of the early warning, initial assessment of severity and impact, indicators of compromise where available | Incident manager |
| Intermediate report | On request of CSIRT or authority | Status updates | Incident manager |
| Final report | Within one month of the incident notification | Detailed description, severity and impact, likely root cause or threat, mitigation applied and ongoing, cross-border impact | CISO |
| Progress report | When the incident is ongoing at the final report date; final report within one month of handling | Status | CISO |
| Recipient notice | Without undue delay, where appropriate | Significant incidents likely to affect service recipients; measures recipients can take against significant threats | Customer communications |

```mermaid
sequenceDiagram
  participant SOC as Security operations
  participant IM as Incident manager
  participant CSIRT as CSIRT or authority
  participant CUS as Affected customers
  SOC->>IM: Event classified as incident
  IM->>IM: Apply significance criteria (section 7.2)
  IM->>CSIRT: Early warning within 24 h
  CSIRT-->>IM: Initial feedback
  IM->>CSIRT: Incident notification within 72 h
  IM->>CUS: Notice and recommended measures
  IM->>CSIRT: Final report within one month of notification
```

### 7.2 Significance criteria

For entities covered by the Implementing Regulation, an incident is
significant when at least one general criterion in its Article 3 is met
(for example direct financial loss above EUR 500,000 or 5% of annual
turnover, whichever is lower; exfiltration of trade secrets; death or
considerable damage to health; successful suspected malicious
unauthorised access capable of causing severe operational disruption),
when recurring incidents meet the Article 4 test (at least twice in six
months, same apparent root cause, together meeting the financial loss
criterion), or when an entity-type criterion in Articles 5 to 14 is met.
Other entities apply Article 23(3) of NIS2 and any national thresholds.

| ID | Criterion (paraphrase) | Source | Detection data | Example threshold for this entity |
|---|---|---|---|---|
| SIG-01 *(Example)* | Managed service completely unavailable for more than 30 minutes | Implementing Regulation Article 10(a) | Service monitoring | Any customer platform outage over 30 minutes |
| SIG-02 *(Example)* | Limited availability for more than 5% of users in the Union or more than 1 million users, whichever is smaller, for more than one hour | Article 10(b) | Monitoring, ticket volume | 5% of 1,800 customer users is 90 users |
| SIG-03 *(Example)* | Integrity, confidentiality or authenticity of data compromised by a suspected malicious action | Article 10(c) | SIEM, forensics | Any confirmed case |
| SIG-04 *(Example)* | Direct financial loss above the general threshold | Article 3(1)(a) | Finance estimate | Lower of EUR 500,000 and 5% of turnover |

Scheduled maintenance and its planned consequences are not significant
incidents. If the pending Digital Omnibus proposal is adopted, reports may
move to a single entry point; check the reporting channel in section 2.2
each year. Personal data breaches may also need GDPR notification
within 72 hours; run both assessments in parallel and see the DPIA
(`compliance/dpia`) and Incident Response Plan.

## 8. Supply chain security

<!-- Guidance: Article 21(2)(d) and 21(3) require entities to consider supplier-specific vulnerabilities, the quality of products and practices, secure development, and the results of EU coordinated risk assessments of critical supply chains. Annex point 5.1 adds the policy, selection criteria, contract terms and supplier monitoring, and point 5.2 a directory of direct suppliers and service providers, for covered entities. -->

| Tier | Definition | Requirements | Reassessment |
|---|---|---|---|
| Tier 1 *(Example)* | Supplier with privileged access to customer environments or that hosts core platforms | Certification or audited report, contract security schedule, incident notice within 24 hours, right to audit, background checks for staff | Yearly |
| Tier 2 *(Example)* | Supplier processing confidential data without privileged access | Security questionnaire, contract clauses, incident notice within 72 hours | Every two years |
| Tier 3 *(Example)* | Other suppliers | Standard terms | On renewal |

| Supplier | Tier | Service | Selection criteria checked (practices, ability to meet specifications, product quality and resilience, diversification) | Last assessment | Issues |
|---|---|---|---|---|---|
| SUP-001 *(Example)* | 1 | Remote monitoring and management software | Yes | YYYY-MM-DD | Vendor vulnerability response time above target |
| SUP-002 *(Example)* | 1 | Colocation | Yes | YYYY-MM-DD | None |
| SUP-003 *(Example)* | 2 | Ticketing SaaS | Yes | YYYY-MM-DD | No data residency commitment |

Record the entity's own role in its customers' supply chains: as a
managed service provider it is a supplier to other NIS2 entities and
should expect their contract requirements. Use the Supplier Security
Assessment (`compliance/supplier-security-assessment`) for each
assessment and Supply Chain Security (`security/supply-chain-security`)
for software components.

## 9. Effectiveness assessment and metrics

<!-- Guidance: Point (f) and Annex section 7 ask what is measured, by which methods, when and by whom, and when results are analysed. Choose metrics that show whether measures work, not only whether they exist. -->

| ID | Metric | Measure | Target | Frequency | Source | Owner |
|---|---|---|---|---|---|---|
| MET-01 *(Example)* | Critical patches applied within deadline | NIS-M-e-04 | 95% | Monthly | Patch tool | IT operations |
| MET-02 *(Example)* | Privileged access with MFA | NIS-M-j-01 | 100% | Monthly | IdP | IAM lead |
| MET-03 *(Example)* | Successful restore tests | NIS-M-c-02 | 100% of quarterly tests | Quarterly | Test log | IT operations |
| MET-04 *(Example)* | Phishing simulation report rate | NIS-M-g-01 | Above 60% | Quarterly | Simulation tool | CISO |
| MET-05 *(Example)* | Tier 1 suppliers assessed on time | NIS-M-d-03 | 100% | Quarterly | Supplier register | Procurement |
| MET-06 *(Example)* | Early warnings sent within 24 hours | NIS-M-b-01 | 100% | Per incident | Incident records | Incident manager |
| MET-07 *(Example)* | Access reviews completed | NIS-M-i-02 | 100% of scheduled | Quarterly | Review records | IAM lead |

Report metrics to the management body quarterly. Treat a missed target
for two consecutive periods as a nonconformity with a corrective action.

## 10. Documented reasoning for requirements not applied

<!-- Guidance: Article 2(2) of the Implementing Regulation requires covered entities to document, in a comprehensible way, why a requirement qualified by "where appropriate", "where applicable" or "to the extent feasible" is not appropriate, applicable or feasible for them. Record only qualified requirements here: an unqualified requirement cannot be set aside by this record. Check the exact sub-point that carries the qualifier (for example 12.3.2(d), not all of 12.3). Keep the reasoning specific and review it with the risk assessment. -->

| ID | Annex point | Requirement qualifier | Decision | Reasoning | Compensating measure | Approved by | Review |
|---|---|---|---|---|---|---|---|
| NA-01 *(Example)* | 13.2 (physical and environmental threats) | Where appropriate | Applied by colocation provider only | Entity operates no own data centre; provider certified and contractually bound | Yearly provider evidence review | CISO | YYYY-MM-DD |
| NA-02 *(Example)* | 12.3.2(d) (cryptography on removable media) | Where appropriate | Not applied | Removable media are technically prohibited on all endpoints under 12.3.2(a) with no approved exceptions, so no data is held on such media | Device control policy and quarterly exception report | CISO | YYYY-MM-DD |

## 11. Framework mapping

<!-- Guidance: Reuse existing management system evidence. ENISA publishes a mapping table from the Implementing Regulation requirements to international and national standards; use it to check your own mapping. Mapping is not equivalence: NIS2 duties such as reporting deadlines and management liability are additional. -->

| Article 21(2) point | ISO/IEC 27001:2022 reference (number only) | NIST CSF 2.0 function | Internal document |
|---|---|---|---|
| (a) | Clauses 5.2, 6.1; A.5.1 | Govern, Identify | Information Security Policy |
| (b) | A.5.24 to A.5.28; A.8.15, A.8.16 | Detect, Respond | Incident Response Plan |
| (c) | A.5.29, A.5.30; A.8.13, A.8.14 | Recover | Business Continuity |
| (d) | A.5.19 to A.5.23 | Govern | Supplier Security Assessment |
| (e) | A.8.8, A.8.9, A.8.20 to A.8.22, A.8.25 to A.8.32 | Protect, Identify | Security Architecture |
| (f) | Clauses 9.1 to 9.3; A.5.35, A.5.36 | Govern, Identify | Internal Audit Program (`compliance/internal-audit-program`) |
| (g) | A.6.3; A.8.7 | Protect | Training plan |
| (h) | A.8.24 | Protect | Cryptography policy |
| (i) | A.5.9 to A.5.18; A.6.1 to A.6.6; A.7.1 to A.7.14 | Protect, Identify | Access Review, Asset Inventory |
| (j) | A.5.14; A.8.5 | Protect | IdP policy |

Keep the Statement of Applicability (`compliance/statement-of-applicability`)
and the NIST CSF 2.0 Profile (`compliance/nist-csf`) consistent with
this table.

## 12. Supervision, enforcement and national transposition

<!-- Guidance: Essential entities face proactive and reactive supervision (Article 32); important entities mainly ex post supervision (Article 33). Article 34 sets minimum maximum fines; national law can be stricter. Record each national act that applies and its specific rules. -->

### 12.1 Enforcement exposure

| Item | Essential entity | Important entity |
|---|---|---|
| Supervision | Ex ante and ex post, including on-site inspections, audits and security scans (Article 32) | Ex post, triggered by evidence or indication of non-compliance (Article 33) |
| Maximum administrative fine for breaching Article 21 or 23 set by national law at least | EUR 10,000,000 or 2% of total worldwide annual turnover of the undertaking, whichever is higher (Article 34(4)) | EUR 7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher (Article 34(5)) |
| Management accountability | Management body approves, oversees and can be held liable (Article 20(1)); additional measures for essential entities in Article 32 | Article 20(1) applies |

### 12.2 National transposition register

| Member State | Transposing act and date in force | Authority | National specifics (registration, reporting portal, thresholds, audit duties) | Checked |
|---|---|---|---|---|
| [Member State] *(Example)* | [Act name, number, date] | [Authority] | [Specifics] | YYYY-MM-DD |

Several Member States transposed after the October 2024 deadline, and
national acts continue to change. Check the Commission's NIS2
transposition page and the national official journal for each Member
State listed.

## 13. Traceability matrix

<!-- Guidance: Link each measure to the risks it treats, the evidence and the metric. Gaps in this matrix are usually gaps in the programme. -->

| Measure | Article 21(2) point | Annex section | Risk IDs | Evidence | Metric |
|---|---|---|---|---|---|
| NIS-M-a-02 *(Example)* | (a) | 2.1 | RISK-001 to RISK-030 | Risk register | Not applicable |
| NIS-M-b-01 *(Example)* | (b) | 3.1, 3.5 | RISK-004 | Incident Response Plan | MET-06 |
| NIS-M-c-02 *(Example)* | (c) | 4.2 | RISK-007 | Restore test logs | MET-03 |
| NIS-M-d-03 *(Example)* | (d) | 5.1.6, 5.2 | RISK-011 | Supplier register | MET-05 |
| NIS-M-e-04 *(Example)* | (e) | 6.6 | RISK-002 | Patch reports | MET-01 |
| NIS-M-g-01 *(Example)* | (g) | 8.1 | RISK-003 | LMS records | MET-04 |
| NIS-M-i-02 *(Example)* | (i) | 11.2 | RISK-005 | Access review records | MET-07 |
| NIS-M-j-01 *(Example)* | (j) | 11.7 | RISK-005 | IdP policy | MET-02 |

## 14. Glossary and references

<!-- Guidance: Define terms for readers outside security, and list the exact texts consulted. -->

### 14.1 Glossary

| Term | Meaning in this document |
|---|---|
| Essential entity | Entity classified under Article 3(1), subject to ex ante supervision |
| Important entity | Other in-scope entity of an Annex I or II type, subject mainly to ex post supervision |
| Significant incident | Incident that causes or can cause severe operational disruption or financial loss, or considerable damage to others (Article 23(3)), refined for covered entities by the Implementing Regulation |
| CSIRT | Computer security incident response team designated by a Member State |
| Management body | The body that directs the entity, such as a board of directors |
| Main establishment | For Article 26 entity types, the place in the Union where cybersecurity risk-management decisions are mainly taken, under the rules of Article 26(2) |
| All-hazards approach | Protecting systems and their physical environment against any event that can compromise them |

### 14.2 References

| Reference | Version or date | Use |
|---|---|---|
| Directive (EU) 2022/2555 (NIS2), OJ L 333, 27.12.2022 | Transposition by 17 October 2024, applied from 18 October 2024; check the consolidated text and pending amendments (COM(2026) 13) | Articles 3, 4, 20, 21, 23, 26, 27, 32 to 34, 41 |
| Commission Implementing Regulation (EU) 2024/2690 | Adopted 17 October 2024, published 18 October 2024 | Annex requirements, Articles 2 to 14 |
| ENISA Technical implementation guidance on cybersecurity risk management measures | Version 1.0, 26 June 2025, with mapping table | Guidance and evidence examples |
| European Commission NIS2 policy and transposition pages | Checked YYYY-MM-DD | Status of amendments and transposition |
| ISO/IEC 27001:2022 | Numbers only | Section 11 mapping |
| NIST Cybersecurity Framework 2.0 | February 2024 | Section 11 mapping |
| [National transposing act] | [Date] | Binding obligations |

## Standard and licence note

Based on Directive (EU) 2022/2555 (NIS2) and Commission Implementing
Regulation (EU) 2024/2690 as published in the Official Journal of the
European Union, with reference to ENISA's technical implementation
guidance (version 1.0, June 2025). EU legislative texts are free to
reuse. Article and Annex numbers are cited and obligations are
summarised in original wording; no legal text is reproduced. ISO/IEC
27001 is cited by clause and control number only, without control text.
Check the consolidated texts on EUR-Lex, any adopted amendments, the
national transposing law of each Member State with jurisdiction and the
current ENISA guidance before use. This is a documentation format, not
legal advice. Template licence: MIT.