Broader scope. Personal accountability.
NIS2 is an EU directive implemented through each member state’s national law. It covers medium and large organisations in sectors from energy, transport, health and finance to digital infrastructure, ICT service management, manufacturing and digital providers — and makes management bodies accountable for cybersecurity.
US companies are affected in two ways. Some — for example cloud, data centre, managed service and managed security providers offering services in the EU — can be directly in scope and may need to designate an EU representative. Many more are suppliers to in-scope entities, which must manage supply-chain security and will pass requirements on to you.
The ten measures, in practice.
Risk analysis & security policies
Documented policies on risk analysis and information system security.
Incident handling
Detecting, responding to and recovering from incidents — and reporting significant ones.
Business continuity
Backup management, disaster recovery and crisis management.
Supply-chain security
Security in relationships with direct suppliers and service providers.
Secure development, access & crypto
Secure acquisition and development, vulnerability handling, cryptography, access control, MFA, cyber hygiene and training.
Four steps, one accountable team.
Engage any single stage or the whole journey. Every engagement reuses the controls and evidence you already have, and runs on Verigo Assure so compliance stays current after we finish.
Scope & applicability
Work out whether NIS2 applies to you directly, through which member states, or only through customers.
Gap assessment
Map your current controls (ISO 27001, SOC 2, NIST CSF) to the Article 21 measures.
Incident reporting & governance
Build the reporting workflow and management-body oversight NIS2 expects.
Ongoing assurance
Keep measures effective and evidenced for customers and authorities — on Verigo Assure.
From scoping to ongoing assurance.
Indicative phases and durations. Your plan is scoped to your services, existing controls and deadlines.
Keep NIS2 evidence current, not just audit-ready once.
Our compliance platform keeps controls, evidence and owners in one place and flags gaps before they become findings. Included with Verigo consulting engagements.
Good to know before we start.
Questions about scope, timelines or how NIS2 fits with your existing frameworks? A senior practitioner will walk you through it.
It can. Certain digital providers established outside the EU but offering services there — such as cloud computing, data centre, managed service and managed security service providers — can fall within scope and may need to appoint a representative in the EU. Other US firms are affected indirectly as suppliers to in-scope EU entities.
Not sure if NIS2 applies to you?
Start with an applicability assessment. We will tell you whether you are in scope, in which countries, and what your EU customers are likely to ask for.