EU CYBERSECURITY DIRECTIVE
How NIS2 reaches EU entities and UK suppliers through customer contracts and supply-chain requirements.
01
Essential and important entities in EU member states, in the sectors the Directive lists, through the national laws that transpose it (transposition was due 17 October 2024; member states transposed on different dates). A UK company is not itself an NIS2 entity, but an EU customer that is one must manage its supply chain under Article 21, and that is how the obligation reaches UK suppliers: through the customer's contract and questionnaire.
02
A gap assessment against the Article 21 risk-management measures and the Article 23 incident-reporting duties, written as a control mapping the EU customer can read, with ISO 27001 as the management system that evidences it. Where the company sells into the EU and the UK, the same system also covers the UK NIS Regulations 2018.
03
Nobody. NIS2 has no certificate. The evidence is the mapped ISO 27001 system and the customer's acceptance of it.
04
ISO 27001 Sprint, with the NIS2 mapping as a deliverable.
05
Scoped on the diagnostic. Any third-party fee is paid direct.
Scoped on the diagnosticBring the contract, questionnaire or buyer request. The diagnostic establishes the scope and the evidence route.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible, Microsoft Clarity, which records session replays, and Apollo. Read our Cookies policy.