NIS2 and GDPR readiness for mid-market companies
NIS2 put incident reporting deadlines and personal accountability on management boards across the EU. If you’re newly in scope, or a customer who is in scope has started sending you security questionnaires, I’ll tell you exactly where you stand and what’s missing, before an auditor, an insurer or that customer finds it first.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
Are you in scope?
NIS2 (Directive (EU) 2022/2555) widened the old NIS rules from a short list of critical operators to a long list of sectors, and it now catches a lot of mid-sized companies. Broadly, it applies to medium and large organisations, meaning 50 or more staff or more than €10 million in annual turnover, operating in sectors such as:
- energy, transport, banking, financial market infrastructure, health, water and digital infrastructure
- ICT service management, including managed service and managed security providers
- manufacturing of medical devices, electronics, electrical equipment, machinery and vehicles
- food production and distribution, chemicals, waste management, and postal and courier services
- online marketplaces, search engines, social networks and cloud providers
Some types of entity are in scope whatever their size. Member states have also written NIS2 into national law at different speeds and with different details, so the real answer depends on where you operate.
Then there’s the indirect route, which catches far more companies. NIS2 requires in-scope organisations to manage the security of their supply chain. If you sell to one of them, you’ll get the questionnaire, the contract clause or the audit request even if NIS2 never names you directly.
What NIS2 actually asks for
Risk-management measures (Article 21)
A baseline of security controls covering risk analysis and policies, incident handling, business continuity and backups, supply-chain security, secure development and vulnerability handling, testing whether your controls work, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication.
Incident reporting (Article 23)
For a significant incident: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. If personal data is involved, GDPR’s own 72-hour breach notification to the data protection authority runs at the same time, to a different regulator, with a different form.
Management accountability (Article 20)
Your management body has to approve the security measures, oversee how they’re carried out, and take training. Its members can be held personally liable for failures. That’s the part that tends to get board attention.
Fines can reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher.
What I deliver
Scope determination
A written answer to whether you’re in scope, as essential or important, under which national law, and what you owe your in-scope customers if you aren’t.
Gap assessment
Your current controls measured against Article 21 and the relevant national requirements, with a remediation roadmap ranked by risk, not by how impressive it looks.
Incident reporting playbook
One playbook covering the NIS2 24-hour and 72-hour clocks and the GDPR 72-hour clock: who decides, who reports, to which authority, with what.
Supplier risk
A third-party risk process for your own suppliers, and ready answers for the questionnaires your customers send you.
Board briefing and training
A plain briefing for your management body on what Article 20 means for them personally, and the sign-off and oversight process to meet it.
Remediation
If you want it, I deliver the fixes too: policies, technical controls, and the evidence pack an auditor or customer will ask for.
For UK companies
The UK isn’t covered by NIS2. It still runs the NIS Regulations 2018, and the Cyber Security and Resilience Bill now working through Parliament would bring managed service providers and some critical suppliers into scope, with stronger incident reporting. Meanwhile, if you have EU customers or EU operations, NIS2 reaches you through them anyway. I work across both, so you get one programme instead of two.
Australian clients can get the same treatment against the Essential Eight and the Privacy Act.
Using ISO 27001 to get there
NIS2 doesn’t require any particular certification, but an ISO 27001 management system covers a large share of Article 21 and gives you structured evidence that you’re doing it. If a certificate would also help you win business, it often makes sense to build both at once. If it wouldn’t, I won’t push it on you.
Common questions
How do I know if my company is in scope for NIS2?
Start with your sector and size: medium or large organisations (50 or more staff, or more than €10 million turnover) in the sectors listed in the directive’s annexes are generally in scope. Then check the national law where you operate, because member states have filled in the details differently. The first step of my diagnostic is a written scope determination.
We’re a UK company. Does NIS2 apply to us?
Not directly as UK law, but often in practice. If you provide services in the EU, you can be in scope there, and if your EU customers are in scope they’ll pass supply-chain security requirements on to you through contracts and questionnaires. The UK’s own Cyber Security and Resilience Bill is heading in the same direction.
Does ISO 27001 certification make us NIS2 compliant?
Not automatically. ISO 27001 covers much of the Article 21 risk-management measures and is a strong way to evidence them, but NIS2’s incident reporting deadlines, management accountability and national registration requirements need work of their own.
How do the NIS2 and GDPR reporting deadlines fit together?
For a significant incident, NIS2 needs an early warning within 24 hours and a notification within 72 hours, with a final report within a month. If personal data is affected, GDPR needs a breach notification to the data protection authority within 72 hours as well. They go to different authorities, so the playbook needs to handle both at once.
A customer sent us a NIS2 security questionnaire. Can you help with that?
Yes, and it’s often the fastest way in. I’ll help you answer it accurately, which matters because those answers often end up in the contract, and then fix the gaps it exposes so the next one is easier.