NIS2: managing the directive's obligations, from management to evidence
Directive (EU) 2022/2555, known as NIS2, raises the level of cybersecurity across the European Union. It extends the first NIS directive to many sectors and to medium-sized companies, classified as essential and important entities, and makes their management accountable.
Read a NIS2 client case (in French)By Alexandre Vivier, ISO 27001 Lead Implementer · Updated on 10 October 2026
What NIS2 requires
Governance (article 20)
Management approves the risk management measures, oversees their implementation and follows training. It can be held liable for infringements.
Measures (article 21)
Technical, operational and organisational measures proportionate to the risks, based on an all-hazards approach.
Incidents (article 23)
Significant incidents are notified to the authority: early warning within 24 hours, notification within 72 hours, final report within one month. CompliKey does not handle these notifications.
The minimum measures of article 21
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, backup management and crisis management
- Supply chain security
- Security in network and information systems acquisition, development and maintenance
- Assessing the effectiveness of measures
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communications
In Belgium and France
Belgium: CyFun
The Belgian NIS2 law has been in force since 18 October 2024. The CCB's CyFun framework, or an ISO 27001 certification accepted by the CCB, gives a presumption of conformity.
The CyFun guideFrance: ReCyF
As at 10 October 2026, the transposition law has not been adopted. ANSSI, the authority designated by the bill, published the ReCyF as a working document on 17 March 2026.
The ReCyF guide (in French)Mappings to other frameworks
In CompliKey, a control assessed for NIS2 can cover requirements of other frameworks; every mapping is traced, with no coverage claimed by default.
| Framework | Link with NIS2 | Page |
|---|---|---|
| CyFun NIS2 | Belgian framework for implementing NIS2 | View CyFun NIS2 |
| ReCyF NIS2 | French framework for implementing NIS2 (working document, page in French) | View ReCyF NIS2 |
| ISO 27001 | ISMS: many shared controls, reused in CompliKey | View ISO 27001 |
NIS2 in CompliKey
- 1Choose the framework suited to your country: CyFun, ReCyF or NIS2, alongside your existing frameworks.
- 2Audit on evidence: each control receives a score from 0 to 4, gaps become tracked tasks.
- 3Report to management (article 20): audit report and statement of applicability exported to PDF, history from one review to the next.
NIS2: frequently asked questions
Is my organisation concerned?
It depends on your sector (Annexes I and II of the directive) and your size: as a rule, medium-sized and large companies in the listed sectors are concerned, with exceptions. Your classification then depends on national law. We look at it with you in the demo, based on the official texts.
Does CompliKey handle incident notification?
No. Significant incidents are notified to the authority (article 23) through the national authority’s channels. CompliKey manages governance, controls and evidence; it is not an incident management tool.
Does NIS2 require certification?
Not as such. Some countries recognise conformity schemes: in Belgium, CyFun verification or certification, or an ISO 27001 certification accepted by the CCB, give a presumption of conformity.
Can I reuse my ISO 27001 work?
Yes: in CompliKey, shared controls are reused across frameworks and every mapping remains traceable.
See NIS2 in CompliKey
A demo on a sample NIS2 scope, with your country's framework.