NIS2 Compliance Services — Directive (EU) 2022/2555 Readiness
NIS2 is the EU’s main cybersecurity law. It applies to medium and large organisations in 18 sectors — from energy, transport, health, water and digital infrastructure to manufacturing, food, postal services and managed service providers — and makes senior management personally accountable for cyber-risk management.
UK organisations are not directly bound by NIS2, but many are in scope through EU subsidiaries or because EU customers push NIS2 supply-chain requirements onto them. Mutex Systems scopes your obligations, closes the gaps against Article 21 and builds the incident-reporting process that the 24-hour deadline demands.
- Category
- Compliance Framework
- Jurisdiction
- European Union
- Issuing Body
- European Union — transposed into national law by each Member State
- Current Version
- Directive (EU) 2022/2555; Member States had to transpose it by 17 October 2024
- Who It's For
- Essential and important entities operating in the EU, their ICT and managed service providers, and UK or Pakistani suppliers whose EU customers require NIS2-aligned security.
Core Domains
A Practical Compliance Path
- 01
Scoping
Confirm whether you are an essential or important entity, in which Member States, and which services are in scope.
- 02
Article 21 gap analysis
Assess current controls against the ten minimum risk-management measures and national implementing rules.
- 03
Remediation & reporting process
Close priority gaps and build the incident classification and notification workflow for the national CSIRT.
- 04
Governance & evidence
Board training, approved policies and an evidence set ready for supervisory inspection.
Built on what you already have
Most organisations already hold ISO 27001 or Cyber Essentials. We map those controls to NIS2 first, so remediation focuses only on the genuine gaps — usually incident reporting, supply-chain security and management accountability.
- ISO 27001-to-NIS2 control mapping
- Incident reporting runbooks tested in a tabletop exercise
- Supplier security clauses and assessments
NIS2 obligations tracked alongside ISO 27001
grComply loads NIS2 Article 21 measures as a framework and cross-maps them to ISO 27001, so evidence you already hold counts twice. Incident records carry the 24-hour, 72-hour and one-month deadlines.
- Article 21 measures mapped to ISO 27001 Annex A
- Incident deadline tracking for early warning, notification and final report
- Supplier risk assessments with evidence expiry alerts
- Board-level reporting for management accountability
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About NIS2
Does NIS2 apply to UK companies?
Not directly, because the UK is outside the EU. It applies to UK companies that provide in-scope services inside the EU (for example through an EU subsidiary), and indirectly to UK suppliers whose EU customers must manage supply-chain risk under NIS2. The UK has its own NIS Regulations, which are being expanded by the Cyber Security and Resilience Bill.
What are the NIS2 incident reporting deadlines?
A significant incident needs an early warning to the national CSIRT or authority within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month.
What are the fines under NIS2?
Essential entities face fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher; important entities up to €7 million or 1.4%. Members of management bodies can also be held personally accountable.
What is the difference between NIS2 and DORA?
NIS2 is a directive covering 18 sectors. DORA is a regulation specifically for the EU financial sector and takes precedence for financial entities on ICT risk, incident reporting and testing.
Ready to Start Your NIS2 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.