NIS 2 LI common mistakes
NIS 2 LI · Understand the traps and how to avoid them.
Treating NIS 2 as a voluntary best-practice framework and describing it as 'recommended guidance' rather than binding EU law transposed nationally.
Candidates carry over habits from ISO 27001 or GDPR awareness training, where the instrument is a standard or a regulation with direct effect, and assume the same posture applies. The directive nature of NIS 2 is easy to skim past.
What to do instead
State explicitly that NIS 2 is a directive (EU) 2022/2555 requiring national transposition, that obligations bind entities once transposed, and that penalties are set by Member States. Practise distinguishing directive, regulation and standard in one sentence each before answering scoping questions.
Confusing 'essential' and 'important' entities by size thresholds alone, ignoring sector and criticality annexes.
The size rule (medium and large enterprises) is memorable, so candidates apply it as the sole test and forget the Annex I and Annex II sector split, the special cases for qualified trust service providers, TLD registries, DNS providers, and the exclusion of micro and small entities unless specific conditions apply.
What to do instead
Build a two-axis decision tree: sector annex first, then size, then the exception list. Memorise which sectors sit in Annex I versus Annex II and which entity types are in scope regardless of size, and rehearse borderline examples such as a small managed service provider.
Listing all ten minimum risk-management measures as a flat checklist without explaining that they are a minimum baseline to be applied proportionally and risk-based.
The article listing the measures is the most quotable part of the directive, so candidates reproduce it verbatim and stop there, missing the requirement for an all-hazards approach and management-body accountability.
What to do instead
For each measure, prepare one sentence on what it means in practice and one on how proportionality changes its depth for a small versus large entity. Always pair the list with the governance point: management body approval, oversight and training obligations.
Describing incident notification as a single report to a single authority, omitting the early warning, incident notification and final report stages and their deadlines.
Candidates default to the GDPR 72-hour single-breach model and overwrite the NIS 2 three-stage timeline, or they recall the 24-hour early warning but not the 72-hour notification and one-month final report.
What to do instead
Memorise the sequence as a timeline: early warning within 24 hours of awareness, incident notification within 72 hours with an initial assessment, final report within one month, plus intermediate progress reports on request. Practise writing a short timeline for a worked scenario with dates.
Treating supply chain security as a procurement formality and answering with 'obtain supplier certifications' as the complete control.
Certificates are tangible and easy to cite, so candidates stop at the artifact and miss the directive's expectation of assessing the security practices of direct suppliers and service providers, including their quality and resilience.
What to do instead
Frame supply chain answers around assessed risk: what data or access the supplier has, what assurance evidence is proportionate, contractual security terms, and monitoring over the relationship. Include managed service providers as a distinct in-scope category with their own obligations.
Assuming NIS 2 registration is optional or automatic, and giving no answer on when and where an entity must register.
Registration is a small procedural detail buried in the text, so it is skipped during study and then appears as a straightforward mark lost on scoping questions.
What to do instead
Note that in-scope entities must register with the competent authority, that the details and deadlines follow national transposition, and that the directive sets the framework while Member States set the specifics. If a question asks for exact national deadlines, answer at the directive level and flag the national variation.
Confusing supervisory and enforcement bodies, naming ENISA or a national CSIRT as the entity that imposes fines.
ENISA and CSIRTs appear frequently in the text in advisory and incident-handling roles, so candidates conflate visibility with authority.
What to do instead
Separate three roles clearly: CSIRTs handle incident response and early warnings, competent authorities supervise and enforce, and ENISA supports cooperation and knowledge exchange. Draw the mapping once and reuse it for every governance question.
Answering continual improvement questions with generic 'review and update policies annually' without linking to measurable evidence such as KPIs, audit results, management review inputs and post-incident lessons.
Generic improvement language feels safe, so candidates avoid committing to specific mechanisms and end up with an answer that could apply to any framework.
What to do instead
Name concrete inputs and outputs: incident post-mortems feeding control changes, metric trends reviewed by the management body, internal audit findings, and supplier reassessment cycles. Tie each to a record that a supervisor or auditor could inspect.
Mixing NIS 2 requirements with ISO 27001 or GDPR obligations and presenting the combination as a single legal requirement.
Candidates often study NIS 2 alongside other frameworks and blur the sources, especially around incident reporting and risk assessment, because the vocabulary overlaps heavily.
What to do instead
For any answer that references another framework, label it explicitly as an alignment or mapping aid, not a legal obligation under NIS 2. Keep a short list of where the regimes diverge: reporting timelines, addressees, penalties, and scope criteria.
Writing long narrative answers that describe the organisation's general security posture instead of answering the specific command verb, such as 'identify' or 'justify'.
Under time pressure candidates dump everything they know about the topic, hoping the marker finds the right point, which loses marks for structure and buries the required element.
What to do instead
Underline the command verb and the scope limit before writing, then structure the answer to match: a list for identify, a cause-and-effect chain for explain, a reasoned trade-off for justify. Keep the first sentence of each point as the direct answer and put supporting detail after it.