NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
NIS2 fines and penalties: how much, for what, and what else regulators can do
For breaches of Article 21 or 23, national law must set NIS2 fines with a maximum of at least €10M or 2% of worldwide turnover for essential entities and €7M or 1.4% for important ones. What triggers them, group turnover, GDPR, other powers and personal liability.
NIS2 for healthcare: which hospitals, clinics, labs and pharma companies are in scope
NIS2 covers healthcare providers, pharma R&D and manufacturing, and medical device makers once they have 50 staff, or turnover and balance sheet both over €10 million. Clinics, radiology, labs, pharmacies and pharma, essential or important, and what applies.
NIS2 all-hazards approach: what it means for physical and environmental security
NIS2 Article 21(2) requires measures based on an all-hazards approach that protects network and information systems and their physical environment. The hazards the recitals name, the rules for digital providers, the link with the CER Directive and a proportionate SME baseline.
NIS2 digital infrastructure: what applies to cloud, data centre, DNS, CDN and IXP providers
NIS2 Annex I names nine digital infrastructure entity types. DNS, TLD, trust service and telecom providers are covered at any size; cloud, data centre, CDN and IXP providers from medium size. Definitions, status, jurisdiction, incident thresholds and a checklist.
NIS2 essential vs important entities: how you are classified and what changes for you
Large Annex I entities and a few named categories are essential; other in-scope Annex I and II entities are important. Both follow the same Articles 20, 21 and 23. Supervision, enforcement and fines differ. How classification works, and what changes for you.
NIS2 for the energy sector: which operators are in scope and what applies (electricity, gas, oil, hydrogen, heating)
NIS2 applies to electricity, district heating and cooling, oil, gas and hydrogen operators of an Annex I type that are at least medium-sized; large ones are essential. Scope by subsector, oil and gas, the electricity network code, the CER Directive and OT in practice.
NIS2 incident reporting timeline: 24 hours, 72 hours, one month, and what goes in each report
NIS2 gives you 24 hours from becoming aware of a significant incident for an early warning, 72 hours for the incident notification and one month after that for the final report. What each report contains, who receives it, telling customers, and a timeline to copy.
NIS2 board duties: what Article 20 requires from management, and when directors can be held liable
Under NIS2 Article 20 the management body approves the Article 21 measures, oversees their implementation and can be held liable; its members must follow training. What each duty means, whether approval can be delegated, who is liable, and a board-pack template.
NIS2 Article 21: the 10 cybersecurity risk-management measures, explained
Article 21 of NIS2 requires appropriate and proportionate measures to manage cybersecurity risk, based on an all-hazards approach, and lists ten minimum measures. What each one means in practice, what proportionate means, and what evidence an authority will ask for.