NIS 2
with ComplyEncrypt
The NIS 2 Directive (Directive (EU) 2022/2555) is the European Union's modernized cybersecurity legislation for critical infrastructure and digital service providers. It covers essential and important entities in sectors such as energy, transport, health, digital infrastructure and ICT service management, and applies through each Member State's national law.
Not available to buy yet. No launch date or price has been announced.
Who this is for
Medium and large organizations in critical and digital sectors across the EU, and their suppliers
NIS 2 makes cybersecurity a management responsibility. Article 20 requires management bodies to approve and oversee cybersecurity risk-management measures and to follow training; Article 21 sets out the minimum measures entities must take. Without structured documentation and training records, neither is easy to demonstrate.
The requirements
What NIS 2 asks of your organization
Governance and training (Article 20)
Management bodies approve and oversee risk-management measures, can be held liable for infringements and must follow cybersecurity training; entities are encouraged to offer similar training to employees regularly.
Risk-management measures (Article 21)
Apply proportionate measures including risk analysis, incident handling, business continuity, supply-chain security, cyber hygiene and training, cryptography, access control and multi-factor authentication.
Incident reporting (Article 23)
Notify significant incidents with an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
The planned ComplyEncrypt pathway
A structured approach to eu cybersecurity for essential and important entities
ComplyEncrypt envisions a NIS 2 pathway that empowers organizations with AI-assisted, automated documentation for Article 21 risk-management measures and mandatory corporate training templates for Article 20 governance obligations. It is on the roadmap and not available to buy yet.
Intended documentation scope
- Management-body approval and oversight records
- Article 21 cybersecurity risk-management policies
- Management and staff training records
- Incident-reporting procedures and timelines
Your team remains accountable
The roadmap describes intended functionality, not a currently available module. Documents must reflect your real processes. Your team implements controls, verifies evidence and manages ongoing obligations.
NIS 2 obligations apply through national law, which varies by Member State. Software does not establish legal compliance; seek qualified advice on your scope and registration duties.
On the roadmap
Interested in buying NIS 2?
Tell us about your organization and purchase interest. This is an enquiry, not an order, payment or reservation.
Related frameworks
See the product in action.
A 2-minute walkthrough of what you get the moment you buy a framework.