NIS2 Directive (EU 2022/2555) — Gap Analysis
Network and Information Systems Security Directive 2 — Effective 17 October 2024About NIS2 Directive (EU 2022/2555)
NIS2 (Directive (EU) 2022/2555) is the EU’s expanded cybersecurity directive, in force since 16 January 2023 and transposed into national law by 17 October 2024. It replaces the original NIS Directive (2016/1148), greatly broadening scope (now covering 18+ sectors and many medium-large entities), tightening governance, mandating specific risk-management measures (Article 21), imposing strict 24-hour/72-hour/1-month incident reporting (Article 23), and introducing significant administrative fines (up to €10m or 2% of global turnover).
Issuing Body
European Union — Directive (EU) 2022/2555
Edition
2024
Coverage
Cybersecurity risk-management measures (Article 21) and incident-reporting obligations (Article 23) for Essential and Important Entities.
Typical Users
Essential Entities (energy, transport, banking, financial infrastructure, healthcare, water, digital infrastructure, public admin, space) and Important Entities (postal, waste, chemicals, food, manufacturing, digital providers, research) operating in the EU.
How to use this tool
1. Work through each clause. For each requirement, choose Compliant, Partial, Non-compliant, or leave as Not assessed.
2. Add notes against any requirement to record evidence, gaps, or corrective actions.
3. Click Save progress — data is stored locally in your browser, never uploaded.
4. Export the report as TXT, CSV, JSON or print to PDF for your audit file.
Note: This tool is a guided self-assessment. It does not replace a third-party audit and the authoritative version of the standard must be obtained from the issuing body.
ISO Xpert — Get in touch
UK-based consultancy specialising in management-system gap analysis, training and certification preparation across ISO, API, Halal, GFSI, ESG, cybersecurity and industry-specific standards.
Phone / WhatsApp
Office
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, UK