NIS2: scope, responsibilities and implementation

What does the NIS2 Directive change com­pared with NIS?

The NIS2 Directive broadens the scope of the previous NIS framework, covers more sectors and requires companies to manage cybersecurity risk as a business process. For organisations, this means determining whether the organisation is in scope, identifying critical services, implementing security measures, overseeing ICT suppliers, reporting incidents and retaining evidence that controls operate effectively. In Poland, the KSC amendment implementing NIS2 entered into force on 3 April 2026 (Journal of Laws2026,item252). The Ministry of Digital Affairs states that, for entities meeting the criteria on that date, registration was due by 3 October 2026 and adaptation and S46 duties by 3 April 2027. Organisational status, exceptions and the date of coverage need individual assessment. Compared with the official source on 14 November 2026.

What does NIS2 change in practice?

NIS focused mainly on operators of essential services and selected digital service providers. NIS2 extends the model to essential and important entities, covers more industries and requires cybersecurity to be managed as a business risk rather than a documentation project.

The most important differences between NIS and NIS2

NIS2 adds stricter management accountability, broader supply chain oversight, more specific risk management requirements, and an incident reporting framework. For companies, this means the need to assign owners, build a plan and maintain evidence that can be shown to a client, auditor or regulator. Under NIS2, an early warning of a significant incident is submitted without undue delay and no later than 24 hours after becoming aware of it. Determine subsequent reporting stages and the competent reporting channel under the rules applicable to the organisation. The 24-hour limit concerns the early warning, not completion of the reporting process. The organisation’s procedure must also define subsequent notifications and the final report under applicable law and the incident type.

• Determine whether the organisation qualifies as an essential or important entity under applicable law; separately assess contractual requirements on suppliers to such entities.
• Describe services that impact customer continuity, production, sales, or data operations.
• Assign owners to risks, incidents, backup, ICT providers and privileged access.
• Build evidence for technical controls, not just security policy.
• Establish a mode for reporting incidents and escalations to management.

Who is subject to the NIS2 Directive

Direct duties apply to entities meeting NIS2 criteria and the relevant national implementing law. Assess sector, size, service type and exceptions to size thresholds. Serving a regulated customer does not automatically make a supplier an essential or important entity, but may create contractual security and evidence requirements. Assess those two scopes separately.

What should the board approve?

NIS2 moves cybersecurity from a technical checklist to a risk management level. Therefore, the board should see a concise decision brief: regulatory scope, critical services, biggest gaps, cost of risk reduction and evidence that will be maintained regularly.

• Scope: documented legal qualification of the company and a separate list of contractual requirements arising from regulated customers.
• Priorities: which risks are stopping sales, production, logistics, digital services or customer service.
• Evidence: what backup tests, access reviews, monitoring reports and owner decisions will be maintained.
• Responsibility: who accepts risk, who conducts corrective actions and who reports status to management.
• Plan: legal and risk-based deadlines, action owners and illustrative progress reviews after 30, 60 and 90 days.

The most common errors in NIS2 projects

The biggest risk is treating NIS2 as a one-off documentation exercise. Compliance requires continuous management: decisions, testing, accountability, evidence and control improvements as the IT environment changes. Another risk is leaving all accountability with IT even though cyber risk affects sales, production, logistics, customer data and service continuity.

• Scope has not been confirmed and supply-chain requirements are omitted.
• Policies exist without backup tests, access reviews, monitoring reports or decision records.
• ICT suppliers can access critical systems but are neither assessed nor supervised.
• The incident procedure has not been exercised and nobody knows who submits the report.
• Management does not receive decision material covering impact, cost and priorities.

How Virtline helps you move from requirements to action

We combine audit, implementation and maintenance of the IT environment in one workstream: qualification, gap map, priorities, technical configurations, procedures, acceptance evidence and recurring reporting. We then map NIS2 obligations to existing controls and evidence, identify gaps without assigned owners and sequence work across incident handling, continuity, suppliers, access and management oversight. We begin by verifying the entity category, its essential or important services and the systems that support them.

Related articles

The NIS2 topic is worth reading alongside practical compliance auditing, DORA digital resilience and IT controls under KSB 315, as all of these areas require evidence, owners and clear decisions.

How do you determine whether the company falls within NIS2 scope?

Determining NIS2 scope requires an assessment of the sector, organisation size, type of services, dependencies on regulated customers and the company's role as an ICT supplier. A company may not be designated directly as an essential or important entity and still receive cybersecurity requirements from customers, partners or financial institutions. The assessment should therefore cover the supply chain, critical processes and contracts, not only the sector tables.

• Verify the business sector, headcount, turnover and links to critical services.
• Assess whether the company provides services to essential or important entities.
• Map the systems, data, ICT suppliers and processes whose failure would stop operations.
• List cyber-resilience requirements imposed by customers, insurers, auditors and regulators.
• Obtain a management decision on audit scope, priorities and risk owners.

Which obligations must be translated into action?

The core NIS2 obligations concern risk management, incident handling, business continuity, backup, supplier security, access control, cryptography, training and reporting. A security policy without evidence is not enough. The company should be able to show that controls operate effectively: MFA is enabled, backups have been tested, incidents follow a defined procedure and suppliers are supervised.

What does the NIS2 preparation process look like?

Qualification and critical-service mapping define scope, and a gap review sets priorities. Contain urgent threats in parallel without waiting for all documentation to be finished. Required MFA, backup, monitoring, incident response and recovery evidence must follow risk and applicable legal deadlines. The following 30/60/90-day reviews illustrate work organisation; they are neither a grace period nor a promise of compliance in 90 days.

• Stage 1: regulatory scope, critical services, process owners and ICT suppliers.
• Stage 2: review of MFA, backup, vulnerabilities, monitoring, incident procedures and business continuity.
• Stage 3: priorities, cost of risk reduction, decision owners and the phased action plan.
• Stage 4: implementation of controls, testing, documentation, reports and management materials.
• Stage 5: maintenance, reviews, risk updates and evidence after changes in the environment.

How do you maintain NIS2 compliance after the initial implementation?

NIS2 requires a process that continues after the first audit. A change to a system, supplier, infrastructure, application or operating model should trigger a review of risks and evidence. The company should periodically review privileged accounts, MFA, backups, monitoring reports, vulnerabilities, incidents, ICT suppliers and restoration tests. Management also needs a concise decision report showing which risks decreased, which increased, which require budget and which were consciously accepted. Without this rhythm, compliance becomes outdated along with the documents.

• Quarterly review of risks, owners, ICT suppliers and critical services.
• Periodic backup restoration tests, incident exercises and verification of the reporting route.
• Update the evidence register after changes in Microsoft 365, networks, systems, applications and suppliers.
• Management reporting with priorities, decisions, exceptions and the action plan for the next period.
• Keep documentation aligned with actual configurations rather than an environment from several months ago.

What evidence should be included in the periodic review?

After the initial implementation, the company needs a standing evidence package that demonstrates not only the existence of policies but also control execution, risk-owner decisions and responses to change. It should be concise for management, detailed enough for an auditor and updated after each material incident, test or implementation.

Contact

Call when the company is unsure whether NIS2 applies, when a customer requests evidence of cyber resilience, or when gaps remain in MFA, backup, monitoring, incident procedures or supplier oversight. A short conversation at +48 12 200 27 10 helps determine whether the first step should be a scope audit, risk workshop, implementation of controls or organisation of evidence for management.

• You have clients from regulated sectors and you need to confirm the level of security.
• You do not know whether the company meets the criteria of an essential or important entity.
• There are no backup tests, incident procedures or reporting to the management.
• ICT providers have access to critical systems, but there is no formal oversight.
• You need a compliance-control implementation plan with costs, owners and evidence.

Sources and further reading