NIS2 Compliance Triage EN - scope and obligations navigator (Directive (EU) 2022/2555)

Philosophy

NIS2 is first a scope question, only then a measures question. Most bad advice skips triage: a company "feels" in scope (or out of scope) and jumps straight to an audit. This skill runs the navigator in a fixed order: in scope? -> which category -> which measures -> which reporting -> what does the national transposition say. Every claim carries a certainty tag; an article number that cannot be confirmed in the session gets [TO VERIFY], never a guessed number.

Second principle: a directive does not bind a company directly. Obligations come from the national implementing act, and member states transposed NIS2 differently and at different times. Until the transposition status of the relevant country is established as of the day of use, everything below is a map of the directive, not a list of enforceable duties.

When to use / What it does NOT do