NIS 2 LI study plan

Define the Directive's purpose, legal basis and relationship to national transposition laws in your own words

Map the scope rules (essential and important entities, sector annexes, size thresholds and exceptions) into a decision table

Distinguish NIS 2 obligations from GDPR, DORA and national telecom security rules on at least five concrete points

List the governance duties of management bodies and the consequences of non-compliance

Explain the registration duties, timelines and information an entity must submit to its competent authority

Identify which supervisory regime (ex ante or ex post) applies to each entity category and what evidence each regime demands

Draft the first version of a compliance gap assessment covering all eleven risk-management areas of Article 21

Sequence the programme into workstreams with owners and dependencies

Build a governance structure that assigns accountability to the management body and names a responsible officer

Write a scoping statement that fixes entity classification, critical services and geographic footprint

Estimate budget, headcount and tooling needs for the first compliance cycle

Define a compliance roadmap with quarterly checkpoints and success criteria

Translate each Article 21 measure into at least two implementable controls with an evidence source

Perform a risk assessment on one business-critical service using an accepted method and record treatment decisions

Design technical and organisational measures for identity, access and privileged account management

Select control frameworks that map cleanly onto NIS 2 so evidence is reusable for certification

Specify encryption and key-management requirements for data at rest, in transit and in backup

Define vulnerability management and patch timelines by severity, including exception handling

Design a business continuity and backup regime with tested recovery objectives

Draft awareness and training activities targeted at management bodies and technical staff

Build an incident classification scheme that distinguishes significant incidents from ordinary ones using the Directive's criteria

Write the early warning, incident notification and final report workflow with owners and deadlines

Assess the supply chain requirements and define due-diligence questions for critical suppliers

Draft contractual security clauses covering access, audit, incident cooperation and subcontracting

Run a tabletop exercise on a ransomware scenario and record where the playbook breaks down

Define monitoring metrics and key risk indicators that show control effectiveness over time

Establish an internal audit and management review cycle with defined inputs and outputs

Prepare the evidence file structure that a supervisory authority or certification auditor would expect

Revise the playbook and control catalogue using exercise findings and close the highest-priority gaps

Map the evidence file to certification scheme requirements and identify remaining shortfalls

Complete two timed mock exams and analyse every wrong answer by domain

Produce a 90-day post-exam action list for continuous improvement