NIS2 readiness for an important entity

Scope

An important entity carries the same substantive duties as an essential entity. The risk-management measures in Article 21 and the reporting obligations in Article 23 apply to both tiers ¹. Supervision is what differs. Article 33 supervises important entities ex post, on evidence, indication or information of non-compliance ². Readiness for this tier is therefore not a reduced programme. It is the same programme, held so the case can be made from records that already exist.

In scope: the tier determination, the entity data owed to the competent authority, the ten measure families in Article 21(2), the notification chain, and management-body approval and training.

Out of scope: sector-specific Union acts that displace the directive under Article 4, national transposition detail, and day-to-day security operations, which are a capability rather than a governance artefact.

Phases

Phase	Purpose	Planning horizon	Closes when
1. Tier determination	Place the entity against the sector annexes and the size ceilings referred to in Article 3	usually planned over 2–4 weeks	A written determination names sector, subsector, entity type and tier
2. Measure gap assessment	Test each of the ten families in Article 21(2) against what actually operates	usually planned over 6–10 weeks	Every family has a status, an owner and a treatment decision
3. Evidence and reporting build	Produce the registers, the policies and the notification chain, then rehearse it	usually planned over 3–5 months	A rehearsal yields an early warning, a notification and a final report
4. Governance handover	Move approval, review and training into the management body's own cycle	usually planned over 4–6 weeks	The management body has approved the measures on its own record

Horizons are planning input. They describe how this shape of work is usually scheduled, never how long anything took.

Deliverables

Deliverable	Required by	Who maintains it afterwards
Scope and tier determination	Article 3(1) and (2)	Compliance owner
Entity registration record	Article 3(4), including a two-week change duty ³	Compliance owner
Policies on risk analysis and information system security	Article 21(2), point (a)	Security function
Incident-handling procedure and notification runbook	Article 21(2), point (b), and Article 23(4)	Security function
Continuity, backup and crisis-management plan	Article 21(2), point (c)	Continuity owner
Supplier requirements and supplier assessment record	Article 21(2), point (d), and Article 21(3)	Procurement and security
Effectiveness-assessment procedure	Article 21(2), point (f)	Internal audit
Management-body approval record and training log	Article 20(1) and (2) ⁴	The management body

Roles

Role	Side	Accountable for
Management body	Organisation	Approving the measures, overseeing implementation, following training
Compliance owner	Organisation	Tier determination, registration data, evidence set
Security function	Organisation	The measures themselves and the notification chain
Procurement	Organisation	Supplier requirements and the assessment record
Adviser	External	Method, gap assessment, rehearsal design, handover

What the authority asks

What the auditor asks

"Show the determination that placed this entity in its tier, and the size test behind it." — answered by: the tier determination, against Article 3(1) and (2).
"Where is the record that the management body approved these measures?" — answered by: the approval record required by Article 20(1).
"Point (d) of Article 21(2) covers supply chain security. Which suppliers were assessed, and against what?" — answered by: the supplier assessment record, read with Article 21(3).
"Walk one significant incident from awareness to the final report." — answered by: the notification runbook and the records behind Article 23(4), points (a) to (d).
"What did the management body's training consist of, and when?" — answered by: the training log required by Article 20(2).
"When did the entity last notify a change to its registration details?" — answered by: the registration record, against the two-week duty in Article 3(4).

Failure modes

Failure mode

The tier is decided by the security team rather than by the annexes. Early signal: the determination cites headcount and turnover but names no subsector. It surfaces as a finding that scope was never established.
Article 21(2) is treated as ten documents rather than ten measure families. Early signal: every family maps to a policy and none maps to a record.
The reporting clock is read from containment rather than from awareness. Early signal: the runbook starts at triage. Article 23(4) runs from becoming aware, so the 24-hour early warning is already late.
Supplier assurance stops at a questionnaire. Early signal: no file names a specific supplier vulnerability or a secure development procedure, which is what Article 21(3) asks the entity to weigh.
The important tier is read as a lighter duty. Early signal: measures are deferred because supervision is ex post. Article 33 still reaches on-site inspection and targeted security audits.

Mapping

Obligation	Article	Evidence that answers it
Be placed in the correct tier	Art. 3(1), 3(2)	Tier determination, annex extract
Give the authority current entity data	Art. 3(4)	Registration record, change log
Have the management body approve and oversee	Art. 20(1)	Signed approval, oversight minutes
Train the management body	Art. 20(2)	Training log, curriculum
Operate all-hazards risk-management measures	Art. 21(2), points (a)–(j)	Policy set plus operating records
Take supplier-specific factors into account	Art. 21(3)	Supplier assessment record
Correct known non-compliance without undue delay	Art. 21(4)	Corrective action register
Notify a significant incident on the statutory clock	Art. 23(4)(a)–(d)	Early warning, notification, final report

Obligation to article to evidence. Article numbers are those of Directive (EU) 2022/2555.

References

European Parliament and Council. Directive (EU) 2022/2555 (NIS 2 Directive). OJ L 333, 27.12.2022, p. 80. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng ⁵
The sector annexes are titled Sectors of high criticality and Other critical sectors ⁶.
Administrative fines for infringement of Article 21 or 23 are set per tier in Article 34(4) and 34(5) ⁷.

Scope#

Phases#

Deliverables#

Roles#

What the authority asks#

Failure modes#

Mapping#

References#

Sources

Related patterns