The NIS2 Management System

NIS2 applies to medium and large entities in the sectors listed in Annexes I and II, and to some entity types whatever their size. Each entity is classified as essential or important. It must take cybersecurity risk-management measures under Article 21, have its management body approve and oversee them under Article 20, report significant incidents to tight deadlines under Article 23, and accept supervision under Articles 32 and 33. That is a system. It is not a questionnaire. Organisations outside the Union meet this duty only where they provide services in the Union or are otherwise in scope. Organisations that do not are not in scope of NIS2.

What the duty asks for

Three questions come first. Am I in scope: sector, entity type, headcount, turnover and balance sheet, and the types that are always in. Which class: essential or important, which decides the supervision regime and the fine exposure under Article 34. Which clock: a 24-hour early warning, a 72-hour notification, and a final report one month later, each with its own trigger.

For digital-infrastructure and digital-provider entities, Implementing Regulation (EU) 2024/2690 adds technical requirements and criteria for a significant incident. National law adds its own duties. In Germany the BSIG covers registration, reporting and the duties of operators of critical facilities. The EU-level system stays the same. The national layer sits on top of it. Organisations outside the Union meet these layers only where they are in scope of the directive.

What a list leaves unbuilt

A list of Article 21 measures, marked in place, does not calculate the class from size, sector and designation. It does not record a management-body approval. It does not run the significance test, including the loss threshold. It does not start the 24-hour clock from a recorded awareness time. It does not stop an author approving their own record. When the authority asks, the organisation has a completed questionnaire and no system of record.

How a management system meets it

A management system covers NIS2 from the scope decision to the answer to a supervisory authority. Every obligation has its own record type, tied to its article, to the annex point of the implementing regulation, or to the national provision. Every record follows the same approval lifecycle. A scope engine applies the size test and the always-in-scope types. The class is calculated and stored. An override needs a reason. Article 21 measures are controlled records: policy, incident handling, continuity, supply chain, development and vulnerability handling, effectiveness, hygiene, cryptography, access and assets. A gap register is seeded for each entity. Only assessors set a gap's status.

Incident reporting is a process. The register holds the 24-hour, 72-hour, intermediate, final and progress reports, with timers and overdue flags. A "not significant" decision needs a written justification. An author cannot approve their own record. If an approved record is edited, it returns to draft and the approval is cleared. Approved records are locked. An approved record, with its evidence, closes a gap item.

AICOB is the process model. NIS2 is mapped onto it where the organisation is in scope of it. The platform is the environment. The management body approves and oversees. It does not operate the measures. That separation is the duty, not a design preference. Organisations that are not in scope of NIS2 still benefit from the same process model for their own cybersecurity obligations under other laws, including ISO/IEC 27001.

The IT Governance platform for this system is available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so a selected record can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both forms. Nextcloud is the environment the record stays in.