# Nis2 compliance assessment
> Source: https://legalcode.md/skills/legalcode-nis2-compliance-assessment | [HTML version](https://legalcode.md/skills/legalcode-nis2-compliance-assessment)

NIS2 Directive (EU 2022/2555) compliance assessment for essential and important entities covering entity classification (essential vs. important), all ten…

NIS2 Directive (EU 2022/2555) compliance assessment for essential and important entities covering entity classification (essential vs. important), all ten Article 21 risk management measures, Article 23 incident reporting obligations (24-hour early warning, 72-hour notification, one-month final report), Article 32 board accountability and training mandates, supply chain security requirements, cross-border cooperation, and intersection with GDPR, DORA, and sector-specific regulations. Use when an organization needs to determine NIS2 applicability, assess compliance posture against the ten risk management measures, design incident reporting procedures, prepare for supervisory examination, or understand member state transposition variations. Covers entity classification gates, all ten Article 21 measures with implementation checklists and evidence requirements, incident significance thresholds and reporting timelines, supply chain risk methodology, board-level governance, and cross-directive alignment. Produces compliance assessments with COMPLIANT/PARTIAL/ NON-COMPLIANT/CRITICAL classifications, prioritized remediation roadmaps with timelines, incident reporting readiness checklists, and board-level governance recommendations. Jurisdiction-agnostic core (NIS2 Directive 2022/2555) with [JURISDICTION-SPECIFIC] markers for national implementations across EU member states and sector-specific variations.

This skill assesses an organization's compliance posture against the EU NIS2 Directive (Directive 2022/2555 on measures for a high common level of cybersecurity across the Union). It covers the full NIS2 obligation stack: entity classification, risk management measures, incident reporting, board accountability, supply chain security, cross-border cooperation, and cross-directive alignment. **Covers:** - Entity classification assessment (essential vs. important entity determination; size thresholds; sectoral criteria; self-identification obligations under Article 3) - Article 21 ten minimum security measures — all ten, with implementation checklists, evidence requirements, and proportionality guidance for important entities - Article 23 incident reporting: significant incident definition, financial loss thresholds, three-stage reporting timeline (24h early warning / 72h notification / one-month final report), and national CSIRT coordination - Article 32 board accountability: management liability, mandatory awareness training, personal liability under national transpositions, and audit obligations - Supply chain security: third-party and vendor risk management, contractual security clauses, and circular dependency analysis for critical service providers - Cross-border cooperation: information sharing, EU-CyCLONe, CSIRT network participation, and multi-member-state reporting obligations - Cross-directive alignment: GDPR Article 32 security measures overlap, DORA operational resilience intersection (financial sector), and sector-specific regulatory overlays (EECC for telecom, NIS2 + ACER for energy, EBA guidelines for finance, ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*