What is the NIS 2 Directive?
NIS2 is EU Directive (EU) 2022/2555. Its objective is a high common level of cybersecurity across the Union, replacing the earlier NIS directive. Member states had to transpose it into national law by 17 October 2024.
Who is covered by NIS 2?
Entities in 18 sectors are covered — from energy, transport, health and water to digital infrastructure, IT services, postal, waste, chemicals, food and manufacturing. Annex I lists sectors of high criticality and Annex II other critical sectors; whether an entity counts as essential or important follows from Art. 3 together with size and the special cases. NIS2 primarily targets medium-sized and larger entities, but certain entities are covered regardless of size.
What does NIS 2 require?
Ten groups of risk-management measures (Art. 21): risk analysis, incident handling, business continuity, supply chain security, secure acquisition and development, testing effectiveness, training, cryptography, access control, and multi-factor authentication with secured communication. Registration and reporting duties come on top.
What are the incident reporting deadlines?
For a significant incident: early warning within 24 hours, notification within 72 hours, final report within one month (Art. 23). The clock starts when you become aware, not on the next working day.
Who is liable for compliance?
The management bodies. They must approve the measures, oversee implementation and undergo training (Art. 20) — cybersecurity is explicitly a board-level duty and cannot be delegated away to IT.
What penalties apply for non-compliance?
The directive requires member states to provide for maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important ones — whichever is higher (Art. 34). What is actually imposed follows national law and the competent national authority.
How it works
Answer
Eight short questions with ready-made answers — no drafting required.
Check
Review all your answers, with a direct way to change any of them.
Create an account or log in
Only to save your result and find it again later.
Get your result
An initial reading, open questions, and next steps — based on your answers.
What You Gain with NIS2Steps
An initial reading
Signals about possible NIS2 relevance, computed deterministically from your answers.
Open questions
Clearly flagged where answers are missing or expert review is needed — never silently skipped.
Next steps
Up to three concrete recommendations, each justified by your actual answers.
Example result
Example — demonstration data
Country: EU · Form version 1 · assessed on 11/09/2026
State of security information
- Multi-factor / continuous authentication — Gap identified
Next steps
No designated party responsible for IT and security was given.
MFA is active on only some of the accounts.
Backups exist, but a tested restore record is missing.
Initial assessment based on your declarations — not a certificate, not a full audit.
Methodology and limits
This short assessment distinguishes three levels: your own declarations (self-assessment), uploaded evidence, and a checked expert approval by an independent reviewer. Only the last counts as proven. This page does not replace legal advice or a full audit.
The basis is Directive (EU) 2022/2555, which applies in every EU member state. Sector and size criteria are uniform across the Union; national transposition governs details such as the competent authority, registration and deadlines.
European NIS2 context
NIS2Steps refers to EU Directive (EU) 2022/2555 and its transposition in the member states. Not an official, EU-funded, or EU-endorsed service.
Frequently asked questions
Do I need to upload documents?
Not for the short assessment. Documents and detailed evidence are optional, available later in the account.
What if I don't know an answer?
"I don't know" is a valid answer. It becomes an open question in the result, never a made-up rating.
Can I change my answers?
Yes, any time before or after the result. A change creates a new version; the previous one stays visible.
Why do I need an account?
Only to save your result and find it again securely. Without an account, the session is lost after 24 hours.
What does the result mean?
An initial reading based on your answers — not a certificate, not an official decision.
Dedicated Implementation Roadmap & NIS 2 Audit
Verify your entity classification (essential / important), the 10 risk management measures (Art. 21), and 24h incident reporting with SKOPION Intelligence auditors.
Your data is processed confidentially in accordance with our Privacy Policy.