NIS2 Gap Analysis

Disclaimer: this skill is not legal advice. It helps with scoping and a technical gap analysis against the directive's text. Final legal qualification (entity classification, sanctions risk, contractual consequences) requires advice from a lawyer with NIS2 experience, possibly together with a compliance department or external counsel.

When to use

The NIS2 directive (EU 2022/2555) replaces NIS1 and entered into force on 17 October 2024. The Netherlands implements it through the Cyberbeveiligingswet ([verify current status — the legislative track has been in motion through 2024 and 2025]). This skill covers both: the EU directive text as the primary source, the NL implementation as the application.

Triggers on:

• A question like "is our organization in scope of NIS2", "what do we need to do for NIS2", "NIS2 gap analysis", "do we have an incident-reporting obligation", "what are the 10 measures".
• An organization considering whether it is an essential or important entity (sectors in Annex I and II), or whose suppliers have that status (contractual carry-through).
• A handoff from iso27001 or risk-register: NIS2 Art 21 maps onto ISO 27001 Annex A and onto NIST CSF.
• An incident where the question "must we report this to CSIRT-NL" comes up.

When NOT (handoff)