NIS2 Explained: Scope, Duties and Penalties Made Simple

Is your organisation covered by NIS2? What exactly do you have to do, by when, and what happens if you get it wrong? The NIS2 Directive (EU) 2022/2555 is the EU's main cybersecurity law for essential and important entities.

It reaches far beyond the energy and telecom operators covered by the first NIS Directive. Manufacturing, food, health, transport, digital infrastructure, ICT service providers, waste, chemicals, postal services and many more sectors are now in scope, along with the suppliers that serve them. Management can be held accountable, incidents must be reported within 24 hours, and fines can reach EUR 10 million or 2% of worldwide annual turnover.

NIS2 Explained: Scope, Duties and Penalties Made Simple turns that law into a clear, step-by-step, practical course. It is built for managers and specialists, not only lawyers. You get slide-led lessons in plain English, decision tools, templates and a full manual, so you can move from "are we in scope?

" to an audit-ready, board-ready programme. What the course covers (10 modules, 30 sections)Welcome and the NIS2 Big Picture: why NIS2 exists, how the directive is structured, and what changed since the first NIS DirectiveScope, Who Is In and Who Is Out: sectors and subsectors (Annex I and II), size thresholds, special cases, essential vs important entities, jurisdiction and registrationGovernance and Management Accountability: what Article 20 requires of management bodies, liability, training and board reporting, and how to build the governance structureCybersecurity Risk-Management Measures (Article 21): the risk-based approach, the ten minimum measures, incident handling, business continuity, crisis management, and technical and organisational controlsSupply Chain Security: supplier risk, contracts and assessments in practice, ICT service providers, cloud and coordinated risk assessmentsIncident Reporting: what counts as a significant incident, the 24-hour early warning, 72-hour notification and one-month final report, and reporting in practiceSupervision, Enforcement and Penalties: the supervisory regime, fines and other measures, and how to survive an audit or inspectionNational Implementation and Related EU Laws: national transposition and authorities (with Romania and Estonia examples), and how NIS2 fits with GDPR, DORA, the Cyber Resilience Act, ISO 27001 and other frameworksThe Implementation Roadmap: scoping and gap assessment, building the programme, sector playbooks and case studiesMaintaining Compliance and Course Wrap-Up: metrics, audits and continual improvement, common mistakes and myths, FAQs, practice scenarios and final checklistsEverything included, ready to download and useA full course manual of about 100 pages (Word), with chapters that match the course modules, worked examples, checklists, self-tests, glossary and article index7 cheatsheets: Scope Decision Tree, Sector Table (Annex I and II), Article 21 Measures Map, Incident Reporting Timeline, Supervision and Penalties Summary, NIS2 Glossary and Board Briefing Sheet12 practical templates: Scoping Worksheet, Gap Assessment Workbook, Risk Register, Evidence Register, Supplier Security Questionnaire, Contract Clause Library, Incident Reporting Templates, Significance Assessment Checklist, Information Security Policy, Board Briefing Pack, 12-Month Roadmap with 30-60-90 Plan, and Tabletop Exercise Kit10 module quizzes and a 40-question final exam with answer keys, so you can test yourself as you goWhat you will be able to doDecide whether NIS2 applies to you and how you are classifiedBrief your board and show management what the law expects of themBuild and evidence the Article 21 measuresAssess suppliers and write the right clauses into contractsRun an incident reporting process that meets the deadlinesPrepare for supervisors, audits and inspectionsPlan a realistic 12-month roadmap and run a tabletop exerciseUp to dateThe content reflects the law as of 7 October 2026, including the status of national transposition across the EU, the Commission's pending amendment proposal and the common incident reporting templates. The course also marks which points are still developing, so you know what to re-check.

Who teaches thisYour instructor is a working cybersecurity practitioner and ISO 27001 lead auditor, so the course focuses on what regulators and auditors actually look for, not just what the text says. Who this course is forManagers, directors and board members; compliance, risk and data protection professionals; CISOs, IT and security teams; consultants and auditors; and suppliers to regulated sectors. Enroll now and turn NIS2 from a compliance headache into a plan you can defend.