NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
NIS2 coordinated vulnerability disclosure: what Article 12 sets up, and what your company must do about vulnerabilities
NIS2 Article 12 makes one CSIRT per country the coordinator for vulnerability reports and has ENISA run a European vulnerability database. Article 21 makes companies handle and disclose vulnerabilities. What each means, the CRA link and a policy template.
NIS2 manufacturing: which manufacturers are in scope (NACE C26 to C30 and medical devices)
NIS2 covers makers of medical devices and IVDs and of products in NACE Rev. 2 divisions 26 to 30, from 50 staff or over EUR 10 million turnover and balance sheet. What each division covers, automotive suppliers, car dealers, status and duties.
NIS2 for financial services: when DORA applies instead, and where CER fits
NIS2 lists only banks, trading venue operators and CCPs, and even for them DORA replaces the NIS2 risk and reporting rules. Insurers, investment firms, payment institutions and fund managers follow DORA alone. Who follows what, DORA's deadlines, and where CER fits.
NIS2 certification: is there a NIS2 certificate, and what counts as proof?
There is no NIS2 certificate for companies. NIS2 lets authorities require certified ICT products (Article 24), encourages standards such as ISO 27001 (Article 25) and audits entities (Articles 32 and 33). What exists, what is proposed, and what an auditor asks for.
NIS2 for MSPs and MSSPs: are managed service providers in scope, and what applies?
Managed service providers and managed security service providers are an Annex I sector under NIS2. If you are medium-sized or larger, you are in scope: important if medium, essential if large. What applies, which country supervises you, what to register and report.
NIS2 vs GDPR: the differences, where they overlap, and how to handle one incident under both
GDPR protects personal data; NIS2 protects the systems behind essential and important services. One incident can trigger both: a NIS2 early warning within 24 hours and a GDPR notification within 72. Side-by-side table, fines, a worked example and a joint playbook.
What is a significant incident under NIS2? The legal test, the thresholds for digital providers, and how to decide fast
Under NIS2 Article 23(3), an incident is significant if it causes or can cause severe operational disruption or financial loss for you, or considerable damage to others. The legal test, who decides, the thresholds for digital providers, a decision tree and the GDPR difference.
NIS2 for transport: which air, rail, water and road operators are in scope and what applies
NIS2 covers transport operators of an Annex I type that are at least medium-sized: air carriers, airports, air traffic control, rail, shipping, ports, VTS, road authorities and ITS operators. Who is in and out, essential or important, and how Part-IS, ISPS and CER fit.
Who enforces NIS2? Competent authorities, CSIRTs and the EU bodies behind them
NIS2 is enforced by national competent authorities; incident reports go to a national CSIRT or the authority. What each national and EU body does, which ones a company deals with, how to find yours, and what the 2026 proposal would change for ENISA.