02 / Compliance and certification
NIS2, read against how your organisation actually runs
We help you work out whether the directive reaches you, where your security measures fall short of it, and how to show your supervisor that the work is done and still running.
Overview
What NIS2 asks of you
The NIS2 Directive, Directive (EU) 2022/2555, sets cybersecurity obligations for essential and important entities across a long list of sectors. In short: take appropriate risk-management measures, report significant incidents to the authorities on a fixed timeline, and make the management body answerable for both.
NIS2 is a directive, so it reaches you through national law. Each member state writes its own act, names its own authorities and settles details such as registration and supervision. What you owe depends on where you operate and which sector you are in, and we start there.
Black Fox is not a lawyer, a regulator or a national authority. We do the security work the law describes and keep the evidence tidy. Legal questions about your classification belong with your counsel, and we work alongside them.
Who it is for
Medium and large organisations in the sectors the directive lists, and some smaller ones a member state designates directly. Also suppliers who are not in scope themselves but whose clients now ask NIS2 questions in every contract.
The work, from scoping to evidence.
What we do
Applicability check
We map your activities, sectors and member states against the directive and the national acts, so you know whether you are likely to be an essential or an important entity, or neither.
Gap assessment
A review of your controls against the risk-management measures, such as risk analysis, incident handling, business continuity, access control, cryptography and vulnerability handling.
Incident reporting process
A process that tells your people what counts as significant, who decides, and who sends the early warning, the notification and the final report to the authority on time.
Supply chain security
A look at your direct suppliers and service providers: which ones matter, what your contracts say about security, and how you check that they mean it.
Management training
Sessions for the management body, which must approve the measures, oversee them and follow training. Plain language, real scenarios, no slides full of articles.
Evidence
Policies, registers and records arranged so that a supervisory request can be answered from a folder, not from memory.
How the engagement runs
Kickoff
We agree the scope, the entities and countries involved and the people we need, and sign an NDA first if you want one.
Applicability and context
We collect what you do, where and for whom, and set out the likely classification with the open questions for your counsel.
Gap assessment
Interviews, document review and technical sampling, ending in a gap report ranked by risk and effort.
Implementation support
We work with your owners on the gaps: measures, documents, the incident process and supplier requirements.
Exercise and training
An incident reporting exercise against the timeline and a training session for the management body.
Handover and follow-up
Recommendations, a business report with the risk assessment and a technical report, then optional follow-up as the national rules settle.
What you receive
- Applicability memo with open questions for your counsel
- Gap assessment against the risk-management measures
- Prioritised action plan
- Incident reporting procedure and decision guide
- Supplier security requirements and review record
- Management body training material and attendance record
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Are we in scope?
It depends on your sector, your size and the national law of each member state where you operate. We give you a reasoned assessment and the points that need a legal view. The final call on classification rests with you, your counsel and, where it applies, the authority.
How fast do we have to report an incident?
The directive sets a staged timeline for significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. National law may add detail on how and to whom.
Is there a NIS2 certificate?
Not as such. NIS2 is supervised by national authorities, not certified. A certification such as ISO/IEC 27001 covers much of the same ground and is useful evidence, but it does not replace the national obligations.
Why does management have to be involved?
Because the directive says so. The management body approves the risk-management measures, oversees how they are applied and can be held accountable when they are not. Delegating the work is fine; delegating the responsibility is not.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
- Advisory and responseDigital forensics and incident responseDFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
Find out where you stand
Tell us what you do and where. We will tell you what NIS2 is likely to ask of you and what is missing.