Nis2 Navigator

NIS2 Compliance Navigator

Guide users through a full NIS2 compliance assessment: scope determination, Art. 21 gap analysis across 10 risk management measures, and prioritized compliance roadmap. Covers EU Directive 2022/2555 with deep German national transposition (BSIG-neu) and high-level profiles for Italy, France, Netherlands, Austria, and Spain.

Session Initialization

1. Display Disclaimer (show at session start, do not block)

Important: This skill provides structured NIS2 compliance guidance based on EU Directive 2022/2555 and national transposition laws. It is not legal advice. Final compliance decisions should involve your organisation's CISO / Information Security Officer and qualified legal counsel experienced in cybersecurity regulation.

2. Web Search on Activation

Search for current regulatory developments before starting — NIS2 transposition is still evolving in many Member States, and enforcement practice is developing rapidly:

NIS2 enforcement updates [current year]
NIS2 implementing regulation EU Commission [current year]

For the full catalog of official EU and BSI sources, load references/regulatory-sources.md when you need to cite specific guidance or direct the user to official resources.

3. Determine Jurisdiction Focus

"Will this assessment focus on (a) EU-level NIS2 Directive obligations, (b) a specific Member State's national law, or (c) both?"

• EU-level only → Use Directive references (Art. 21, Art. 23, Annexes I/II)
• Germany → Load references/germany-nis2umsucg.md. Use § references (§ 28, § 30, § 32 BSIG-neu) and BSI-specific obligations
• Italy, France, Netherlands, Austria, or Spain → Load references/eu-jurisdiction-profiles.md. These profiles highlight key national differences — a full deep-dive with local counsel is still necessary. Verify transposition status via web search, since several laws are still in legislative process
• Both (e.g., EU + Germany) → Lead with Directive, layer national specifics where they diverge
• Cross-border group → Flag that multiple transpositions apply. Load relevant profiles and recommend local counsel per jurisdiction
• Any other Member State → The EU-level assessment is fully applicable. National specifics will need separate research

Phase 1: Scope & Classification (~5 minutes)

Determine whether the organization falls under NIS2 and classify as essential or important. This is the most common first question any entity has, and getting the classification right is foundational — it determines enforcement intensity, fine levels, and reporting obligations.

For German entities, mention the BSI's free Betroffenheitsprüfung (betroffenheitspruefung-nis-2.bsi.de) as a complementary first step. Note it only covers scope — our assessment goes further into compliance maturity and roadmap.

Ask questions ONE AT A TIME in this order:

Classification Logic

Load references/sector-classification.md for the full Annex I/II sector mapping and size thresholds.

Decision tree:

1. Sector match → Map to Annex I (high criticality) or Annex II (other critical)
2. Size test → Medium: ≥50 employees OR (turnover >€10M AND balance sheet >€10M). Large: ≥250 employees OR (turnover >€50M AND balance sheet >€43M)
3. Essential entity if: Annex I + large, OR qualified trust service provider, TLD registry, DNS provider, public comms provider, central public administration, or KRITIS operator (DE)
4. Important entity if: Annex I + medium, OR Annex II + medium/large
5. Regardless-of-size: Check special categories in reference file
6. Out of scope if: Below medium thresholds AND no special status
7. DORA check: Financial entities under DORA are excluded from NIS2 Art. 21 and Art. 23 — redirect to DORA compliance (DORA acts as lex specialis with its own equivalent requirements)
8. CIR check: Digital infrastructure/provider entities face additional binding requirements under CIR 2024/2690 beyond Art. 21 — flag early

Group structure: Apply the size test at the level where the NIS2-relevant service operates. Consolidated figures apply with operational integration. Independent entities within a group: assess separately.

Classification Output

SCOPE DETERMINATION

• Sector: [Annex I/II sector and sub-sector]
• Size classification: [Small / Medium / Large]
• Entity category: [Essential / Important / Out of Scope]
• Basis: [Directive Art. / national law reference]
• Special flags: [DORA exclusion / CIR applies / Regardless-of-size / None]

If Germany: BSI registration [required/not required], status [completed / overdue]

Example: A German managed IT services provider with 120 employees and €25M turnover in the ICT service management sector (Annex I) → Annex I, medium enterprise, essential entity (MSPs are essential regardless of size). BSI registration required (overdue since 6 March 2026). CIR 2024/2690 applies. This entity faces both proactive BSI supervision and the additional CIR technical requirements — communicate this clearly because it significantly increases the compliance scope compared to a typical important entity.

If Out of Scope → inform user, suggest voluntary adoption (supply chain pressure from in-scope customers is increasingly common), and end assessment. Otherwise proceed to Phase 2.

Phase 2: Art. 21 Gap Analysis (~15 minutes)

Walk through the 10 risk management measures from Art. 21(2)(a)–(j) / § 30 BSIG-neu. The purpose is rapid maturity scoring — enough to identify critical gaps and prioritize, not a full audit. This keeps the assessment accessible for entities encountering NIS2 for the first time while still producing actionable output.

Load references/art21-measures.md for measure descriptions, scoring criteria, and ISO 27001 references.

Assessment Approach

For each measure, ask ONE targeted question, then score on a 0–4 scale:

ISO 27001 References

For each measure, include a brief reference to relevant ISO 27001:2022 Annex A controls. Many organizations approaching NIS2 already have ISO 27001, so this mapping creates immediate practical value — "you already satisfy Art. 21(2)(a) through your A.5.1 and A.5.2 controls" is the kind of output that saves hours of consultant time.