Directive (EU) 2022/2555
NIS2, for a software company
Since 18 October 2024 NIS2 reaches a company by its entity type and its size, 67 types across the two Annexes; the question is which one you are.
Answer above to read the determination for your case; the full tool takes your answers with it.
Continue in the free determinationThe full determination answers every question, and keeps the reading as a dated record for €29.
At a glance
Five tools, free, no account
- Free checkIs your company under NIS2, and is it essential or important?Five questions from Article 2, Article 3 and Article 26 against the 67 entity types of Annexes I and II, ending in a written determination with the state's law and what applies directly.
- GuideWhere you register, state by stateThe authority, the route and the act for each of the twenty-seven, with the day each was read.
- ClockThe incident clock: 24 hours, 72 hours, one monthThe moment of awareness in; the three deadlines of Article 23(4), the CSIRT of the state, and the early warning, the notification and the final report written with the Directive's contents.
- MappingNIS2 mapped to ISO 27001The 13 Annex sections of the Implementing Regulation against the ISO 27001 controls that satisfy them, and the two places it asks for more.
- GuideThe transposition register, state by stateEvery national measure communicated to the Commission, 305 from 25 of the 27 states, with the act each state calls its NIS2 law and the states with nothing on the register.
- GuideThe member states, one page eachWhat applies in each of the 27 states, from the registers: the NIS2 act, the CSIRT, the CRA coordinator and enforcer, the GDPR authority, the accreditation body, with both scope tools filled in for the state.
- GuideA free supplier profileFor a supplier to a NIS2 company: answer the customer's questions on the ten measures once, and share one link.
- GuideNIS2 for small companies: are you in scope?Usually not by size. A few services are in at any size, and customers who are in scope will ask about your security either way.
Every free template on one page
Two instruments and a registry
The Directive, applied from
18 October 2024
A directive binds through national law. 25 of the 27 member states had communicated at least one transposing measure to the Commission on 23 October 2026; the register names the act each calls its NIS2 law.
The Implementing Regulation
13 sections, direct effect
Implementing Regulation (EU) 2024/2690 fixes the technical measures and the incident thresholds for cloud and other digital providers, the same text in every state, no transposition needed. It was written from ISO 27001.
The registry, by
17 January 2025
Cloud computing, data centre, managed service, marketplace, search and social networking providers had to submit their name, addresses, member states served and IP ranges to their competent authority for ENISA's registry, under Article 27.
Austria's registration, from the authority's own pages
NIS2 registration, done in a week: €490
Scope decided and every field prepared, in 5 working days.
16 articles, from the primary sources
Which law, and what it adds to ISO 27001
- ArticleNIS2 for a SaaS company: you are a cloud computing service provider, and this is what followsRecital 33 of the Directive names Software as a Service as a cloud service model, so a SaaS company of medium size or larger is an entity of NIS2 as a cloud computing service provider: important below the medium ceilings, essential above them.
- ArticleNIS2 for managed service providers and MSSPs: an Annex I entity by definition, and the supplier every customer's due diligence lands onArticle 6(39) makes anyone who installs, manages, operates or maintains ICT for customers, on site or remotely, a managed service provider, and Article 6(40) makes the ones who help with cybersecurity risk management MSSPs.
- ArticleNIS2 for online marketplaces, search engines and social networks: the Annex II digital providers, and why they are never essential by sizeThree definitions borrowed from three other acts decide whether a platform is a digital provider under NIS2: a marketplace where consumers conclude distance contracts, a search engine that searches in principle all websites, a platform where end users connect and share.
- ArticleEssential or important under NIS2: the size rule, the size-blind rules and the seven ways to be essentialWhether NIS2 reaches a company is Article 2; whether it is essential or important is Article 3; and the difference is ex ante supervision, a higher fine ceiling and a stricter reading of everything else.
- ArticleNIS2 registration: the two lists you may be on, what you submit, by when, and to whom (Article 3(4) and Article 27)NIS2 has two registrations, not one. Every essential and important entity submits four items to its competent authority so that the member state can establish its list by 17 April 2025 (Article 3(3) and (4)), with changes notified within two weeks.
- ArticleThe ten measures of NIS2 Article 21(2), as a checklist: each point quoted, the Regulation sections behind it, and the ISO 27001 controls that already produce itArticle 21(2) lists ten measures every essential and important entity must take, from risk analysis policies to multi-factor authentication.
- ArticleNIS2 Article 20 for the board: what the management body must approve, oversee and learn, the twelve places the Implementing Regulation names it, and what liability meansArticle 20 of NIS2 makes the management body of an essential or important entity approve the cybersecurity risk-management measures, oversee their implementation, be liable for the entity's infringements of Article 21, and follow training.
- ArticleISO 27001 vs NIS2: what the certificate covers and what it does notNIS2 is law and ISO 27001 is a certifiable standard, so they are not alternatives.
- ArticleCRA or NIS2: which one applies to a software company, and can it be both?The Cyber Resilience Act regulates products placed on the market; NIS2 regulates entities that provide services.
- ArticleNIS2 transposition, state by state: what the Commission's own register showsNot a law firm's tracker: the national measures the member states have communicated to the Commission as transposing Directive (EU) 2022/2555, read from the Publications Office on 12 September 2026. 25 of the 27 states have communicated at least one, 303 measures in all; Spain and Ireland none; France 15 texts, none of them naming NIS2.
Reporting
- ArticleNIS2 or CRA: which incident clock runs for a software company, and what makes an incident 'significant'Both laws give you 24 hours, 72 hours and a month, and both start the clock when you 'become aware'.
- ArticleThe NIS2 incident clock for a software company: the 24-hour early warning, the 72-hour notification, the one-month final report, what makes an incident significant for a cloud provider, and a page that writes the three reportsArticle 23(4) of NIS2 runs three clocks from the moment an essential or important entity becomes aware of a significant incident: an early warning within 24 hours, an incident notification within 72, and a final report within one month of that notification, with an intermediate report on request and a progress report where the incident is still open.
- ArticleWhich CSIRT do you report to under the CRA? The coordinator for your main establishment, all 27 namedArticle 14 sends the notification to the CSIRT designated as coordinator by the member state of your main establishment; ENISA published all 27 on 10 September 2026.
What buyers ask for
- ArticleWhich EU countries name ISO 27001 in public tenders: 1,548 German notices, 829 Polish, and Greece has the highest shareOver 365 days, ISO 27001 appears in 3,415 TED notices.
- ArticleISO 27001 vs SOC 2 in Europe: which one buyers actually ask forSelling into Europe, get ISO 27001: EU public tenders named it 3,405 times in a year against 104 for SOC 2, and led in every one of the twelve months behind that number.
- ArticleDORA for a software vendor: the Article 30 contract clauses your bank customer will send, the register of information you will appear in, and what ISO 27001 already answersSince 17 January 2025 every bank, insurer, investment firm and payment institution in the Union manages its software vendors under Regulation (EU) 2022/2554, DORA.
What it asks of you
34 requirements in 5 groups
Obligations
5- 20(1) Management approves and oversees the security measures
- 20(2) Train the management body, and offer staff the same
- 21(1) Take proportionate measures against the risks to your systems
and 2 more
Duties
10- 21(4) Correct any measure you find non-compliant without delay
- 23(1) Notify significant incidents to the CSIRT or authority
- 23(2) Tell affected recipients about significant cyber threats
and 7 more
Controls
10- 21(2)(a) Have a risk analysis and security policy
- 21(2)(b) Handle incidents by a written procedure
- 21(2)(c) Keep backups, a recovery plan and crisis management
and 7 more
Clauses
1- 23(3) Judge an incident significant by disruption, loss or harm
Deadlines
8- 23(4)(a) Send the early warning within 24 hours
- 23(4)(b) Send the incident notification within 72 hours
- 23(4)(d) Send the final report within a month of notifying
and 5 more
Eleven of the thirteen Article 21 sections are an ISO 27001 system; the other two are records
StandardOS keeps the ISO 27001 records that answer eleven of the Implementing Regulation's thirteen sections, the incident record the Article 23 clocks run from, and the evidence a supervisor or an auditor asks for, in one workspace, in six languages.
Dates are read from the Directive's Articles 27 and 41 and never typed on this page. This is not legal advice, and the Directive is the text to read: Directive (EU) 2022/2555.
Related:NIS2 software for consultantsArticlesFree toolsOpen datasets