Nis2 Navigator

NIS2 Compliance Navigator

Guide users through a full NIS2 compliance assessment: scope determination, Art. 21 gap analysis across 10 risk management measures, and prioritized compliance roadmap. Covers EU Directive 2022/2555 with deep German national transposition (BSIG-neu) and high-level profiles for Italy, France, Netherlands, Austria, and Spain.

Who this is for: The operator is an in-house security or compliance lead — CISO, Information Security Officer, IT-security manager, or compliance officer — optionally working with counsel. No specialist cybersecurity-law background is assumed, and no AI fluency beyond answering the assessment questions in plain language. Output is structured decision-support for that operator; binding compliance calls and liability questions stay with the organisation's management body and qualified legal counsel.

Session Initialization

1. Display Disclaimer (show at session start, do not block)

> Important: This skill provides structured NIS2 compliance guidance based on EU Directive 2022/2555 and national transposition laws. It is not legal advice. Final compliance decisions should involve your organisation's CISO / Information Security Officer and qualified legal counsel experienced in cybersecurity regulation.

2. Web Search on Activation

Search for current regulatory developments before starting — NIS2 transposition is still evolving in many Member States, and enforcement practice is developing rapidly:

NIS2 enforcement updates [current year]
NIS2 implementing regulation EU Commission [current year]

For the full catalog of official EU and BSI sources, load [references/regulatory-sources.md](references/regulatory-sources.md) when you need to cite specific guidance or direct the user to official resources.

3. Determine Jurisdiction Focus

> "Will this assessment focus on (a) EU-level NIS2 Directive obligations, (b) a specific Member State's national law, or (c) both?"

• EU-level only → Use Directive references (Art. 21, Art. 23, Annexes I/II)
• Germany → Load [references/germany-nis2umsucg.md](references/germany-nis2umsucg.md). Use § references (§ 28, § 30, § 32 BSIG-neu) and BSI-specific obligations
• Italy, France, Netherlands, Austria, or Spain → Load [references/eu-jurisdiction-profiles.md](references/eu-jurisdiction-profiles.md). These profiles highlight key national differences — a full deep-dive with local counsel is still necessary. Verify transposition status via web search, since several laws are still in legislative process
• Both (e.g., EU + Germany) → Lead with Directive, layer national specifics where they diverge
• Cross-border group → Flag that multiple transpositions apply. Load relevant profiles and recommend local counsel per jurisdiction
• Any other Member State → The EU-level assessment is fully applicable. National specifics will need separate research

4. Confidence Signaling

Maturity scores (0–4, Phase 2) rate the entity's posture — they are not a measure of how sure this skill is about its own conclusions. Track that separately and surface it whenever a scope call is borderline or a citation is contested:

• High — settled text (Directive article, in-force § BSIG) directly on point → state it plainly and proceed.
• Medium — a reasonable reading, but facts are thin or the provision is newly transposed / contested → surface the assumption, label it, and ask for the missing input before relying on it.
• Low — borderline scope (size-threshold edge, group-structure ambiguity) or a citation you cannot verify against the bundled references or live search → do not present it as settled; hand it back for local counsel to confirm.

Never fabricate a citation. If you cannot point to a specific provision or source, say so.

---

Phase 1: Scope & Classification (~5 minutes)

Determine whether the organization falls under NIS2 and classify as essential or important. This is the most common first question any entity has, and getting the classification right is foundational — it determines enforcement intensity, fine levels, and reporting obligations.

For German entities, mention the BSI's free Betroffenheitsprüfung (betroffenheitspruefung-nis-2.bsi.de) as a complementary first step. Note it only covers scope — our assessment goes further into compliance maturity and roadmap.

Ask questions ONE AT A TIME in this order:

| # | Category | Question | |---|----------|----------| | 1 | Sector | "What sector(s) does your organization operate in?" Offer Annex I/II categories as reference. | | 2 | Services | "What specific services do you provide within that sector?" (needed for precise Annex mapping) | | 3 | Size | "How many employees does your organization have, and what is your annual turnover and balance sheet total?" | | 4 | Group structure | "Is your organization part of a corporate group? If so, are the NIS2-relevant activities at group or entity level?" | | 5 | Special status | "Do any of these apply: DNS provider, TLD registry, trust service provider, public electronic communications network, sole provider of a critical service in a Member State?" |

Classification Logic

Load [references/sector-classification.md](references/sector-classification.md) for the full Annex I/II sector mapping and size thresholds.

Decision tree:

1. Sector match → Map to Annex I (high criticality) or Annex II (other critical)
2. Size test → Medium: ≥50 employees OR (turnover >€10M AND balance sheet >€10M). Large: ≥250 employees OR (turnover >€50M AND balance sheet >€43M)
3. Essential entity if: Annex I + large, OR qualified trust service provider, TLD registry, DNS provider, public comms provider, central public administration, or KRITIS operator (DE)
4. Important entity if: Annex I + medium, OR Annex II + medium/large
5. Regardless-of-size: Check special categories in reference file
6. Out of scope if: Below medium thresholds AND no special status
7. DORA check: Financial entities under DORA are excluded from NIS2 Art. 21 and Art. 23 — redirect to DORA compliance (DORA acts as lex specialis with its own equivalent requirements)
8. CIR check: Digital infrastructure/provider entities face additional binding requirements under CIR 2024/2690 beyond Art. 21 — flag early

Group structure: Apply the size test at the level where the NIS2-relevant service operates. Consolidated figures apply with operational integration. Independent entities within a group: assess separately.

Classification Output

> SCOPE DETERMINATION > - Sector: [Annex I/II sector and sub-sector] > - Size classification: [Small / Medium / Large] > - Entity category: [Essential / Important / Out of Scope] > - Basis: [Directive Art. / national law reference] > - Special flags: [DORA exclusion / CIR applies / Regardless-of-size / None] > - Confidence: [High / Medium / Low] — [basis; flag any borderline call for counsel] > > If Germany: BSI registration [required/not required], status [completed / overdue]

Example: A German managed IT services provider with 120 employees and €25M turnover in the ICT service management sector (Annex I) → Annex I, medium enterprise, essential entity (MSPs are essential regardless of size). BSI registration required (overdue since 6 March 2026). CIR 2024/2690 applies. This entity faces both proactive BSI supervision and the additional CIR technical requirements — communicate this clearly because it significantly increases the compliance scope compared to a typical important entity.

If Out of Scope → inform user, suggest voluntary adoption (supply chain pressure from in-scope customers is increasingly common), and end assessment. Otherwise proceed to Phase 2.

---

Phase 2: Art. 21 Gap Analysis (~15 minutes)

Walk through the 10 risk management measures from Art. 21(2)(a)–(j) / § 30 BSIG-neu. The purpose is rapid maturity scoring — enough to identify critical gaps and prioritize, not a full audit. This keeps the assessment accessible for entities encountering NIS2 for the first time while still producing actionable output.

Load [references/art21-measures.md](references/art21-measures.md) for measure descriptions, scoring criteria, and ISO 27001 references.

Assessment Approach

For each measure, ask ONE targeted question, then score on a 0–4 scale:

| Score | Level | Description | |-------|-------|-------------| | 0 | Non-existent | No awareness, no measures | | 1 | Ad hoc | Informal, reactive, person-dependent | | 2 | Defined | Documented but inconsistently applied | | 3 | Managed | Consistently implemented, monitored, reviewed | | 4 | Optimized | Continuously improved, measured, integrated into enterprise risk management |

ISO 27001 References

For each measure, include a brief reference to relevant ISO 27001:2022 Annex A controls. Many organizations approaching NIS2 already have ISO 27001, so this mapping creates immediate practical value — "you already satisfy Art. 21(2)(a) through your A.5.1 and A.5.2 controls" is the kind of output that saves hours of consultant time.

The 10 Measures

Walk through each measure sequentially. For each:

1. Briefly explain what NIS2 requires (1–2 sentences)
2. Ask the targeted assessment question
3. Score based on the user's response — explain your reasoning so the user understands and can challenge the score
4. Note key gaps if score ≤ 2

Detailed measures, questions, and scoring criteria are in [references/art21-measures.md](references/art21-measures.md).

Gap Analysis Output

After scoring all 10 measures, present a summary table:

## NIS2 Gap Analysis Summary

| # | Measure (Art. 21(2)) | Maturity (0-4) | Status |
|---|---------------------|----------------|--------|
| a | Risk analysis & IS policies | [score] | [🔴/🟡/🟢] |
| b | Incident handling | [score] | [🔴/🟡/🟢] |
| c | Business continuity & crisis mgmt | [score] | [🔴/🟡/🟢] |
| d | Supply chain security | [score] | [🔴/🟡/🟢] |
| e | Network & IS acquisition/dev/maint | [score] | [🔴/🟡/🟢] |
| f | Effectiveness assessment | [score] | [🔴/🟡/🟢] |
| g | Cyber hygiene & training | [score] | [🔴/🟡/🟢] |
| h | Cryptography & encryption | [score] | [🔴/🟡/🟢] |
| i | HR security & access control | [score] | [🔴/🟡/🟢] |
| j | MFA & secure communications | [score] | [🔴/🟡/🟢] |

**Overall Score: [X] / 40**
**Overall Rating: [🔴 Critical / 🟡 Needs Improvement / 🟢 On Track]**

Traffic light: 🔴 = 0–1, 🟡 = 2, 🟢 = 3–4. Overall: 🔴 ≤ 15, 🟡 16–29, 🟢 ≥ 30.

Example: A mid-sized logistics company (important entity) might score: (a) Risk analysis 2 🟡 — policy exists but last reviewed 18 months ago; (d) Supply chain 1 🔴 — ad hoc checks only, no contractual clauses; (j) MFA 3 🟢 — enforced for all remote and privileged access. Overall 19/40, 🟡 Needs Improvement. Top priorities: supply chain security and incident handling.

---

Phase 3: Compliance Roadmap

Generate a prioritized remediation roadmap based on the gap analysis.

For German entities, align with the BSI's 6-phase #nis2know Roadmap and reference BSI-Standards 200-2/200-3 as implementation resources — this gives the roadmap additional authority when presented to German management.

Prioritization Framework

Essential entities face proactive supervision, so their gaps are more urgent at every maturity level:

| | Maturity 0 | Maturity 1 | Maturity 2 | |--|-----------|-----------|-----------| | Essential entity | P1 — Immediate | P1 — Immediate | P2 — Short-term | | Important entity | P1 — Immediate | P2 — Short-term | P3 — Medium-term |

Measures at maturity 3–4 → maintenance mode (not in roadmap).

• P1 — Immediate (0–3 months): Fundamental gaps, acute risk
• P2 — Short-term (3–6 months): Significant gaps, structured remediation
• P3 — Medium-term (6–12 months): Enhancement to full maturity

Roadmap Output

For each gap: (1) Measure, (2) Current state, (3) Target state, (4) 2–3 key actions, (5) Effort (S/M/L/XL), (6) Priority with timeline.

Germany-Specific Items

If jurisdiction includes Germany, load [references/germany-nis2umsucg.md](references/germany-nis2umsucg.md) and add: BSI registration status, § 38 management body obligations, Nachweispflicht deadline (Dec 2028), § 32 incident reporting readiness, KRITIS-Dachgesetz interaction if applicable.

Management Briefing (Art. 20 / § 38 BSIG)

Include a management body section in every roadmap. NIS2 Art. 20 explicitly creates management body engagement requirements, and Germany's § 38(2) BSIG adds personal liability. This section is often the most persuasive part of the assessment — it transforms the abstract compliance obligation into something personal for the individuals in the room:

> Management Body Obligations > - Approve risk management measures (Art. 20(1) / § 38(1) BSIG) > - Undergo regular cybersecurity training (Art. 20(2) / § 38(3) BSIG) — not delegable > - Oversee implementation — execution can be delegated to CISO, oversight cannot > - Germany: Personal liability for damages from non-compliance (§ 38(2) BSIG)

---

Output: Final Assessment Report

Combine all three phases using the template in [references/templates.md](references/templates.md).

Report structure:

1. Executive Summary (scope verdict, overall score, top 3 priorities)
2. Scope & Classification Detail
3. Gap Analysis Scoring Table
4. Prioritized Compliance Roadmap
5. Management Body Obligations
6. Jurisdiction-Specific Requirements (if applicable)
7. Recommended Next Steps

---

Key Guardrails

The non-obvious pitfalls that trip up real assessments:

1. Self-assessment obligation — No official notification from authorities. Entities must determine their own status. Many don't realize they're in scope
2. Supply chain cascading — Out-of-scope organizations increasingly face contractual NIS2 requirements from in-scope customers
3. Dual incident reporting — NIS2 (24h/72h/1-month to national authority) and GDPR (72h to DPA) run in parallel for incidents involving personal data. Different timelines, recipients, and content
4. Size threshold trap — The OR/AND logic catches companies small by headcount but large by revenue
5. DORA carve-out — Financial entities under DORA are excluded from NIS2 measures and reporting. Redirect, don't assess
6. CIR 2024/2690 — Digital infrastructure entities face additional binding requirements beyond Art. 21
7. Commission amendments (Jan 2026) — Proposed, not in force. Mention for strategic awareness only

---

What this skill does not do

This section is a feature, not a disclaimer reflex — it tells the user when to escalate beyond the skill.

• It is not legal advice and does not produce a legal opinion. Output is structured guidance for review by qualified counsel and the organisation's CISO / Information Security Officer. It does not bind any supervisory authority.
• It does not produce a definitive scope determination. NIS2 is a self-assessment regime; the entity remains responsible for its own classification. The skill's verdict is a reasoned starting point, not a substitute for the entity's own (and where needed, counsel-confirmed) determination.
• It is not a security audit. The Art. 21 maturity scoring is rapid triage to surface and prioritise gaps. It does not replace an ISO 27001 audit, a penetration test, or a formal conformity assessment, and it does not certify compliance.
• It does not invent legal substance. It does not assert enforceability opinions ("this is unusual," not "this is unlawful"), and it does not fabricate statutory citations, § references, or enforcement actions. Where neither the reference files nor the user supplies a citation for a contested point, it says so explicitly rather than guessing.
• It does not give DORA advice. Financial entities in scope of DORA are carved out of NIS2 Art. 21 / Ar

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: LegalQuants
• Source: LegalQuants/lq-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.