Are we a regulated entity under NIS2, and how do we mark it on the risk map?
| Status | Basis | What to do |
|---|---|---|
| Essential or important entity with an EU establishment, above the threshold | Annex I/II sector, in principle medium-sized or larger | Register under the local transposition law, implement Article 21, report under Article 23 |
| No EU establishment, providing Article 26 digital services | Such as cloud, data centres, MSP, MSSP | Designate an EU representative and meet the obligations |
| Supplier to regulated EU customers | Neither of the above | Respond to customers' contract terms and audits under Article 21 |
Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, mark it as a compliance and information risk. The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
How should the CRO assess NIS2 fines and other impacts?
Maximum fines under Article 34 (whichever is higher):
- Essential entities: EUR 10 million or 2% of worldwide annual turnover
- Important entities: EUR 7 million or 1.4%
Fines are only part of the impact. Customer requirements, market access and reputational damage usually come earlier; for a Taiwanese company that is only a supplier, the impact comes mainly through customer contract terms and audits, and belongs in the same impact assessment.
The management body must approve and oversee security measures. What records should the committee and board reports keep?
Article 20 of NIS2 requires the management body to approve and oversee the Article 21 measures and to follow training. The CRO should make sure approval and oversight are on record:
- A senior management security responsibility matrix and approval records
- Implementation of the Article 21 measures, folded into the annual report under Article 15 of the principles
- Records of management body training
A consultant can help set up the record formats, but approval and oversight remain the management body's own responsibility.
We are only a supplier to EU customers. How does NIS2 risk reach us?
A supplier to regulated EU entities is usually not directly regulated as a result, but customers write obligations into contracts under the supply chain security requirement of Article 21(2)(d). The CRO can:
- List customers' security clauses and audit requirements as contract risks and track responses
- Check that requirements placed on your own suppliers match commitments made to customers
When you are sure you are not a regulated entity and customers only ask for a security questionnaire, answering from existing ISO 27001 records is usually enough. TWSE ESG indicator S-15 (A item) also asks whether the supplier management policy requires suppliers to comply on issues such as information and communications security and privacy; the evaluation covers listed companies, and companies that are not public companies are not covered and can use it voluntarily.
What are the reporting deadlines for a significant incident, and who should a scenario exercise test?
Article 23: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. An exercise should test the decision chain: who decides whether an incident is significant, who submits, and to which member states' authorities.
Winners sets up a three-stage procedure for 24 hours, 72 hours and one month, and confirms with tabletop exercises that it can be run repeatedly.
We have ISO 27001. What is missing for NIS2, and how long does it take?
ISO 27001 greatly shortens preparation, but NIS2 adds reporting deadlines, registration with authorities, supply chain security and management responsibility, which must be added on top of ISO 27001. NIS2 has no standalone certificate, and an ISO 27001 certificate is not NIS2 compliance.
Timeline as listed on the service page: from gap analysis to a working system, usually 4–6 months; 2–3 months with an ISO 27001 base. Five steps: applicability, gap analysis, system and documents, technical controls, audit readiness and maintenance.
How does Winners Consulting help CROs with NIS2?
- Status: decide whether you are an essential or important entity, or only need to respond to customers' supply chain requirements, based on sector, size and the transposition law of the member state
- Gap analysis: the ten Article 21 measures checked against the current system, with a priority list
- Reporting and accountability: a 72-hour incident reporting SOP, a supply chain security assessment procedure and a senior management responsibility matrix
- Integration: NIS2 gaps closed on top of the existing ISO 27001 system, with one set of evidence for NIS2 and customer requirements
- Who leads: vice-president and director-level consultants lead personally end to end, never outsourced
NIS2 consulting, Choosing a NIS2 consultant, ISO 27001 consulting. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports