Implementing NIS2: from gap assessment to action plan

It starts with classification. Does your company belong to one of the 18 sectors, and does it exceed the thresholds? As a rule, the law applies from 50 employees or from 10 million euros in turnover and balance sheet total. From 250 employees, or from 50 million euros in turnover with a balance sheet above 43 million euros, you are usually an essential entity.

Record the result in writing, with reasons. Do this even if you conclude that you are not covered. If a customer or the supervisory authority asks later, a documented assessment is worth more than an assumption. If you are covered, you also have to register with the BSI.

NIS2 holds management to account. Under section 38 of the BSI Act, management must approve the measures, oversee their implementation and attend training regularly. It can delegate the work, but the responsibility stays with management.

In practice, every area needs a person who owns it, and management needs a fixed date on which it reviews progress. In smaller companies many areas end up with the same person. That is fine as long as it was a deliberate decision and is written down.

The gap assessment produces a long list. Tackling everything at once overwhelms any team. We rank by two questions: how big is the risk if the gap stays open? And is there a deadline pressing?

This almost always leads to the same order. Registration and the reporting chain come first, because deadlines and fines apply directly. Next come the measures that limit an attack most, such as multi-factor authentication, tested backups and a contingency plan. Policies and supplier assessment follow.

Each measure gets an owner, a deadline and a criterion that shows when it is done. Without that criterion, a measure stays in progress forever.

With NIS2, three things tend to get mixed up that are worth keeping apart: what the law requires, what makes sense and what a service provider delivers for it. The list below separates them.

• Classification. Obligation: check whether the law applies and register with the BSI if so. Recommendation: document the result with reasons, even if it is negative. Deliverable: written classification and support with registration.
• Risk management. Obligation: measures in the areas listed in section 30 of the BSI Act, appropriate to the risk. Recommendation: a risk register reviewed at least once a year. Deliverable: gap analysis and prioritised action plan.
• Reporting. Obligation: early warning within 24 hours, notification within 72 hours, final report after one month. Recommendation: run through the process once a year. Deliverable: reporting chain with templates and a test run.
• Management. Obligation: approval, oversight, regular training. Recommendation: a fixed report every quarter. Deliverable: draft resolutions and training.
• Supply chain. Obligation: take security risks at suppliers and service providers into account. Recommendation: assess the most important suppliers first rather than all at once. Deliverable: assessment scheme and supplier questionnaire.
• Effectiveness. Obligation: assess whether the measures work. Recommendation: technical checks such as a penetration test on a fixed schedule. Deliverable: test plan, test and retest.

Our NIS2 consulting takes you from classification to a finished plan and beyond. We also carry out technical checks such as a penetration test. Get in touch if you want to know where you stand.