NIS2 Explained: Scope, Duties and Penalties Made Simple

Is your organisation covered by NIS2? What exactly do you have to do, by when, and what happens if you get it wrong?

The NIS2 Directive (EU) 2022/2555 is the EU’s main cybersecurity law for essential and important entities. It reaches far beyond the energy and telecom operators covered by the first NIS Directive. Manufacturing, food, health, transport, digital infrastructure, ICT service providers, waste, chemicals, postal services and many more sectors are now in scope, along with the suppliers that serve them. Management can be held accountable, incidents must be reported within 24 hours, and fines can reach EUR 10 million or 2% of worldwide annual turnover.

NIS2 Explained: Scope, Duties and Penalties Made Simple turns that law into a clear, step-by-step, practical course. It is built for managers and specialists, not only lawyers. You get slide-led lessons in plain English, decision tools, templates and a full manual, so you can move from “are we in scope?” to an audit-ready, board-ready programme.

What the course covers (10 modules, 30 sections)

1. Welcome and the NIS2 Big Picture: why NIS2 exists, how the directive is structured, and what changed since the first NIS Directive

2. Scope, Who Is In and Who Is Out: sectors and subsectors (Annex I and II), size thresholds, special cases, essential vs important entities, jurisdiction and registration

3. Governance and Management Accountability: what Article 20 requires of management bodies, liability, training and board reporting, and how to build the governance structure

4. Cybersecurity Risk-Management Measures (Article 21): the risk-based approach, the ten minimum measures, incident handling, business continuity, crisis management, and technical and organisational controls

5. Supply Chain Security: supplier risk, contracts and assessments in practice, ICT service providers, cloud and coordinated risk assessments

6. Incident Reporting: what counts as a significant incident, the 24-hour early warning, 72-hour notification and one-month final report, and reporting in practice

7. Supervision, Enforcement and Penalties: the supervisory regime, fines and other measures, and how to survive an audit or inspection

8. National Implementation and Related EU Laws: national transposition and authorities (with Romania and Estonia examples), and how NIS2 fits with GDPR, DORA, the Cyber Resilience Act, ISO 27001 and other frameworks

9. The Implementation Roadmap: scoping and gap assessment, building the programme, sector playbooks and case studies

10. Maintaining Compliance and Course Wrap-Up: metrics, audits and continual improvement, common mistakes and myths, FAQs, practice scenarios and final checklists

Everything included, ready to download and use

• A full course manual of about 100 pages (Word), with chapters that match the course modules, worked examples, checklists, self-tests, glossary and article index

• 7 cheatsheets: Scope Decision Tree, Sector Table (Annex I and II), Article 21 Measures Map, Incident Reporting Timeline, Supervision and Penalties Summary, NIS2 Glossary and Board Briefing Sheet

• 12 practical templates: Scoping Worksheet, Gap Assessment Workbook, Risk Register, Evidence Register, Supplier Security Questionnaire, Contract Clause Library, Incident Reporting Templates, Significance Assessment Checklist, Information Security Policy, Board Briefing Pack, 12-Month Roadmap with 30-60-90 Plan, and Tabletop Exercise Kit

• 10 module quizzes and a 40-question final exam with answer keys, so you can test yourself as you go

What you will be able to do

• Decide whether NIS2 applies to you and how you are classified

• Brief your board and show management what the law expects of them

• Build and evidence the Article 21 measures

• Assess suppliers and write the right clauses into contracts

• Run an incident reporting process that meets the deadlines

• Prepare for supervisors, audits and inspections

• Plan a realistic 12-month roadmap and run a tabletop exercise

Up to date

The content reflects the law as of 7 October 2026, including the status of national transposition across the EU, the Commission’s pending amendment proposal and the common incident reporting templates. The course also marks which points are still developing, so you know what to re-check.

Who teaches this

Your instructor is a working cybersecurity practitioner and ISO 27001 lead auditor, so the course focuses on what regulators and auditors actually look for, not just what the text says.

Who this course is for

Managers, directors and board members; compliance, risk and data protection professionals; CISOs, IT and security teams; consultants and auditors; and suppliers to regulated sectors.

Enroll now and turn NIS2 from a compliance headache into a plan you can defend.

Courze