NIS2 compliance: measures implemented and provable in practice
Measures deployed, documented, provable.
Being NIS2 compliant is not just a matter of writing policies. The supervisory authority expects measures to be applied, and evidence that they are. The engagement turns the requirements of Article 21 of Directive (EU) 2022/2555 into practices within your organisation.
The work starts from a status report, drawn from a prior gap assessment or produced at the outset of the engagement. Workstreams then run in a realistic order: what reduces risk the most comes first, documentation later. Each measure is linked to verifiable evidence.
Two obligations need particular attention. Article 20 makes management bodies accountable for approving and overseeing the measures. Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. These channels must exist before an incident occurs.
What you get
- Risk analysis policy and information systems security policy, approved by management
- Business continuity plan, tested backup strategy and crisis management procedure
- Security clauses and questionnaires for critical suppliers
- Incident handling and notification procedure aligned with Article 23
- Evidence file organised measure by measure, ready for inspection
How it runs
Starting point
Review of the existing diagnostic or a rapid gap analysis. The work plan and the contact person for each workstream are approved by management.
Governance and risk
Risk analysis, security policies, roles and responsibilities. Management gives formal approval, as Article 20 requires.
Operational measures
Continuity and backups, access control, multi-factor authentication, supplier security, incident handling. Each measure is implemented with your teams.
Evidence and handover
Assembly of the evidence file, an incident notification exercise, and transfer to the internal owners who will run the framework.
Frequently asked
Why 8 to 12 weeks?
The gap depends on your starting point and the number of systems concerned. The exact range is set at scoping, once the scope is known, and then committed in writing.
Do we need a tool to manage compliance?
Not necessarily. A well-maintained spreadsheet can be enough for a limited scope. Valtieri publishes Presidio, a compliance platform covering fourteen frameworks, but the engagement does not require it.
Do NIS2 and ISO 27001 overlap?
Largely. Many Article 21 measures have an equivalent in Annex A of ISO/IEC 27001:2022. Work done for one serves the other, which avoids documenting things twice.
Who remains accountable after the engagement?
Your management, within the meaning of Article 20. The engagement hands over a documented framework and trained internal owners. Ongoing support remains possible, but is not mandatory.
Further reading
- Loi Résilience: withdrawn again, what the NIS2 void requires10 October 2026
- CNIL closes the France Travail order: what the four remediation measures reveal about your GDPR Article 329 October 2026
- DGFiP: the ANSSI report of 29 September identifies three blind spots your NIS2 entities probably share1 October 2026
In the same practice area : Security
- Posture assessment
Where you stand, and what is missing.
- Fractional CISO
Accountability sits with management. We carry the file with them.
- Security tooling integration
A tool installed is not a tool in service.
- Penetration testing
Find the flaws before those who are looking for them.
- Preparation for ISO/IEC 27001 certification
From gap analysis to the certification audit.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
- Incident response retainer
When an incident happens, you know who to call.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call