NIS2
NIS2 is EU law, not a certification. Essential and important entities must adopt cybersecurity risk-management measures, make their management body accountable for them and report significant incidents against a fixed clock. Complyanz runs that program, including the national law that actually applies to you.
The measures, the accountability and the reporting clock
How a NIS2 program runs
Entity classification
Record your sector, size and special cases, and see whether you are an essential or an important entity, or out of scope.
Article 21 measures
Assess cybersecurity risk and record the applicability and status of each of the ten risk-management measures.
Governance and designations
Management body approval and training, plus the cybersecurity officer, point of contact and registration your national authority requires.
Incident reporting
Declare a significant incident and every report is tracked against its deadline, per country, until it is filed.
NIS2 alongside your other programs
NIS2 is standalone in Complyanz — it does not require ISO 27001. Most of the Article 21 measures map onto ISO 27001 controls, though, and the same assets, incidents, suppliers and training records serve both, which is why many European companies run them together.
NIS2 FAQ
Does NIS2 apply to us?
Generally if you operate in one of the sectors listed in the directive's annexes and have at least 50 staff or more than €10 million in both turnover and balance sheet. Some providers are in scope regardless of size, such as DNS services, trust service providers and public electronic communications. The classification step in Complyanz walks through it and records the result.
Which national laws do you cover?
Portugal's Decreto-Lei 125/2025, in force since April 2026, including the CNCS designations and Portugal's own incident-reporting stages. Spain's law is still a draft; its obligations are included and clearly marked as draft until it is passed. For other member states you work from the directive itself.
How does incident reporting work?
You declare an incident significant and Complyanz creates each report with its deadline: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within a month. Portugal follows its own sequence: initial notification, 72-hour update, end-of-impact notification and a final report 30 working days later.
Is there a NIS2 certificate?
No. NIS2 compliance is supervised by your national authority rather than certified. An ISO 27001 certificate is often used as evidence for many of the measures, and Complyanz can run both.
Build your NIS2 program
Create an organization and the measures, classification and reporting workflow are ready to work with.