NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
NIS1 vs NIS2: the key differences, side by side
NIS2 replaced NIS1 on 18 October 2024. The biggest change is scope: NIS1 covered operators each country chose in 7 sectors, NIS2 applies by size in 18 sectors. It adds ten minimum measures, management liability, a 24-hour clock and fine ceilings. The comparison table.
NIS2 scope: does NIS2 apply to your company? A four-step check
NIS2 applies to entities of a type listed in Annex I or II that are at least medium-sized and active in the EU, plus a short list covered regardless of size. The four-step check, a decision table, the size rules, exclusions and registration.
NIS2 compliance: what the directive requires, who is in scope, and where to start
NIS2 applies to medium-sized and larger entities in 18 sectors. Compliance means registering, board approval and training, ten minimum security measures and incident reporting within 24 hours. Who is in scope, each duty, fines, national laws and a 90-day plan.
Is ISO 27001 worth it? When the certificate pays for itself, and when it does not
ISO 27001 is worth it when a tender or a customer already asks for it, or when NIS2 applies to you: the certificate is then a cost of revenue. What it buys, how to weigh the €50,000 to €150,000 first year, when it is not worth it yet, and how to get the same result for less.