NIS2 Compliance
EU NIS2 Directive Compliance - Essential & Important Entity Risk Management
Praxis-Q delivers NIS2 Directive compliance for EU essential and important entities. NIS2 has been mandatory since October 2024. ISO 27001 covers approximately 80% of NIS2 Article 21 requirements - Praxis-Q delivers both in an integrated programme addressing the full NIS2 obligation including 24-hour incident reporting to national CSIRTs.
At a Glance
Directive
EU 2022/2555
In Force
Oct 2024
Fines (EE)
€10M/2%
ISO Alignment
80% coverage
NIS2
NIS2 Compliance
EU NIS2 Directive Compliance - Essential & Important Entity Risk Management
The Problem
NIS2 widens who must comply and holds management personally liable. Many in-scope firms do not yet realise the directive applies to them.
What We Do
- NIS2 Scoping
- Gap Analysis
- ISO Alignment
- Incident Reporting
- Certification
What You Get
- NIS2 Article 21 security measures implementation
- ISO 27001 to NIS2 control mapping (80% overlap)
- Essential Entity and Important Entity classification
- Incident reporting procedures (24-hour notification to CSIRT)
- Supply chain risk management for NIS2
- Management-level accountability and governance
- Multi-member-state compliance for pan-EU organizations
- Integrated NIS2 + GDPR + DORA compliance programme
Why weeks, not months
AI-assisted evidence review, one client portal
Every NIS2 engagement runs on the Praxis-Q compliance platform. You upload evidence per control, AI scores it against the requirement, and your auditor reviews in the same workflow — from scoping through to the issued, publicly verifiable certificate.
AI evidence scoring
Every upload is scored against the control before an auditor sees it — gaps surface in minutes, not at the review meeting.
One client portal
Scoping, evidence, auditor queries and status live in one place. No email chains, no spreadsheet trackers.
Auditor sign-off
Praxis-Q auditors review inside the same workflow, so review rounds shrink and the certificate issues sooner.
Essential vs Important Entities - Why the Distinction Matters
NIS2 splits in-scope organisations into 'essential' entities (energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, and public administration, generally above certain size thresholds) and 'important' entities (postal services, waste management, chemicals, food, manufacturing, digital providers, and research, again generally above size thresholds) - essential entities face proactive supervision and can be audited without a prior incident, while important entities are typically supervised reactively, following a report or an indication of non-compliance. The maximum fines also differ: up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% of turnover for important entities. Praxis-Q determines which category applies before scoping the compliance programme, since the supervisory posture materially changes how urgently gaps need closing.
Transposition Status Varies by Member State
NIS2 is a directive, not a regulation, meaning each member state transposes it into national law with some latitude in specific requirements, and as of mid-2026 that transposition remains uneven - most member states have completed it, a handful (including Spain, at that point) had not, and the European Commission has opened infringement proceedings against states that missed the original October 2024 deadline. For an organisation operating across multiple EU countries, this means the specific incident-reporting timeline, the exact national competent authority, and some procedural details can differ by jurisdiction even though the underlying directive is the same. Praxis-Q tracks transposition status per member state relevant to a client's footprint, rather than assuming a single uniform EU-wide implementation.
Cybersecurity Risk-Management Measures
NIS2 requires in-scope entities to implement an 'all-hazards' approach to risk management, covering areas including risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in network and information systems acquisition and maintenance, policies on the use of cryptography, and human resources security and access control. Praxis-Q builds this as a structured control set mapped to an existing ISO 27001 ISMS where one exists - the overlap between NIS2's risk-management measures and ISO 27001 Annex A is substantial, so certified organisations are already most of the way there.
Incident Reporting Timelines
NIS2 sets a tight, multi-stage reporting clock for significant incidents: an early warning to the national CSIRT or competent authority within 24 hours of becoming aware, a more detailed incident notification within 72 hours, and a final report within one month of the incident notification (or a month after the incident is resolved, if still ongoing at that point). Praxis-Q builds the incident response plan around this specific timeline structure, including a pre-agreed decision process for who determines an incident is 'significant' under the criteria, since the 24-hour clock leaves no time to figure that out from scratch during an actual incident.
Engagement Model
Scoping to determine essential/important entity status and the specific member-state transposition rules that apply typically takes one to two weeks. Full control build-out follows, mapped against an existing ISO 27001 ISMS where one exists to reuse evidence rather than duplicate it. Praxis-Q also builds the specific incident-reporting playbook and tests it, since a plan that only exists on paper rarely survives contact with the 24-hour early-warning clock.