CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?

Are we an entity in scope of NIS2, or only a supplier to EU customers?

For legal calls on jurisdiction or applicability, consult a lawyer who knows the local transposition law.

We have establishments in several EU member states. Where do we register and report?

The principle in Article 26(1) of NIS2 is that an entity falls under the jurisdiction of the member state where it is established. The European Commission's NIS2 FAQs explain that an entity established in more than one member state falls under the jurisdiction of each of them, and those states should cooperate. There are two exceptions:

• Providers of public electronic communications networks or services: under the member state where they provide their services.
• Digital entities such as DNS, TLD registries, cloud, data centres and managed services: under the member state of their main establishment in the EU; those not established in the EU must designate a representative in the EU (Article 26(3)).

The CISO's job is to list the competent authority, CSIRT and registration procedure for each establishment and route reporting by that list.

Article 20 of NIS2 requires the management body to approve, oversee and be trained. How should the CISO report to the board?

Article 20 requires the management body to approve and oversee the Article 21 measures and its members to follow training; the Commission's FAQs also note that NIS2 introduces provisions on the liability of natural persons in senior management positions. Penalties are set in national law, up to €10M or 2% for essential entities.

Suggested content for the board:

• The company's status and the member states that apply
• Gaps against the ten Article 21 measures and the plan to close them
• Management approval records and training records
• Results of reporting drills

Listed companies can put this into the regular report under Article 37 of the Cybersecurity Control Guidelines and write NIS2 duties into the Article 3 promotion organisation; companies that are not public companies are not covered by the guidelines and can use them voluntarily.

How do we fit NIS2's three-step reporting (24 hours, 72 hours, one month) into our existing response procedure?

Article 23: significant incidents must be notified without undue delay to the CSIRT or competent authority, with an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification.

• Classify first: decide in advance who judges whether an incident is significant and who submits, and give them the authority.
• List all deadlines side by side: one incident can also trigger GDPR's 72 hours, DORA or the EU CRA, each with its own starting point and authority; decide which apply in one incident classification step.
• Drill: use tabletop exercises to confirm the process can be repeated, and keep records.

Listed companies can add this to the incident response and reporting procedure under Article 34 of the Cybersecurity Control Guidelines.

An EU customer has sent us NIS2 supply-chain security clauses. How should the CISO respond?

Customers in scope write obligations into contracts under the supply-chain security requirement in Article 21(2)(d). How to respond:

• Use existing evidence: if the customer only asks for a security questionnaire, the records of your ISO 27001 system are usually enough.
• Map clause by clause: where clauses require reporting, audits or specific controls, map each to an existing procedure and add gaps to the remediation list; have legal review the allocation of liability.
• Extend downstream: set up a risk assessment procedure and contract security clauses for your own suppliers, so what you require upstream matches what you commit downstream.

Indicator S-15 of the TWSE ESG evaluation also asks whether the supplier management policy requires suppliers to follow information and communication security rules; companies that are not public companies are not covered and can use it voluntarily.

We already have ISO 27001. What does NIS2 add, and how long does it take?

ISO 27001 shortens preparation considerably, but NIS2 adds reporting deadlines, registration with authorities, supply-chain security and management accountability, which need to be added on top of 27001.

Time listed on the service page: usually 4–6 months from gap analysis to an established system; 2–3 months with ISO 27001. Five steps: applicability, current-state gap analysis, system and documentation, technical controls, audit readiness and maintenance.

Typical outputs: a cybersecurity risk management policy, a 72-hour incident reporting SOP, a supply-chain security assessment procedure and an executive security responsibility matrix.

How does Winners Consulting help a CISO with NIS2?

• Status: based on sector, size and the transposition law of the relevant member states, determine whether you are an essential or important entity, or only need to answer customers' supply-chain requirements.
• Article 21 gaps: map each measure against your current security management, incident reporting, supplier management and technical measures, and produce a prioritised remediation list.
• Reporting: set up a three-stage 24-hour, 72-hour and one-month reporting procedure and confirm with tabletop exercises that it can be repeated.
• Management accountability: build an executive security responsibility matrix and approval records.
• One body of evidence: add the NIS2 differences on top of the existing ISO 27001; a combined DORA and NIS2 assessment is also available.
• Division of roles: VP- and director-level consultants lead the work end to end, never outsourced.

Read more: NIS2 consulting, choosing a NIS2 consultant, ISO 27001, what a CISO owns. Apply for a free mechanism diagnosis