NIS2 Implementation for Essential and Important Entities

What you'll learn

---

Determine whether an organisation is in scope of NIS2 and whether it is an essential or an important entity
Apply the ten Article 21 risk-management measures and evidence that each one actually operates
Run the directive's incident reporting sequence: early warning, notification, intermediate and final report
Build the Article 20 governance record, including management body approval, oversight and training
Assemble a supplier, risk and evidence pack that holds up under supervision and audit
Requirements

---

Basic familiarity with information security or IT operations. No legal background is required.
Access to your own national transposing law, since NIS2 reaches entities through national rules.
Description

---

"This course contains the use of artificial intelligence."
NIS2 is a directive, not a regulation. That single fact shapes everything in this course: your obligations do not reach you from the EU text directly, they reach you through the national law that transposes it, and Member States are free to go beyond the floor the directive sets. This course teaches NIS2 implementation with that distinction kept in front of you throughout.We start with scope, because most organisations that are newly caught by NIS2 found out late. You will work through Annex I's eleven sectors of high criticality and Annex II's seven other critical sectors, the size cap and how it is actually measured, the cases where size does not matter at all, and the jurisdiction and registration rules that are routinely confused with one another.
From there the course follows the shape of the directive. You will see how an entity lands in the essential or the important class, and why the obligations are identical while the supervision is not. You will work through Article 20's governance and management accountability duties, then take the ten Article 21 risk-management measures one by one, together with the supply chain duty that sits above them. A full section covers incident detection and the reporting sequence: the early warning, the incident notification, intermediate reports and the final report.Later sections cover Implementing Regulation 2024/2690 and exactly who it binds, supervision, audits and the enforcement ladder that runs before any penalty, and how NIS2 sits alongside DORA, the Cyber Resilience Act, GDPR and the CER Directive. The course closes with a realistic ninety-day programme sequence and a capstone that assembles a complete compliance file.
Labs run throughout: a scope determination on a real organisation, a gap assessment against all ten measures, a risk register and control mapping, a supplier tiering and assessment pack, a tabletop exercise, and one significant incident carried through every required report. The course is vendor-neutral and practical. It is implementation guidance, not legal advice.
Who this course is for

---

Security and compliance leads, IT managers and CISOs at EU organisations newly in scope of NIS2
Consultants and auditors who advise clients on NIS2 scoping, implementation and readiness
Homepage

---