NIS 2 Foundation common mistakes
NIS 2 Foundation · Understand the traps and how to avoid them.
Treating NIS 2 as applying only to 'important' entities and forgetting that 'essential' entities sit inside the same scope, so questions asking which entity types are covered get answered with a partial list.
Candidates skim Article 3 and anchor on one category name, or they carry over the older NIS 1 distinction between operators of essential services and digital service providers. NIS 2 replaced that binary with essential and important entities, and both are in scope.
What to do instead
Memorise the two-tier structure explicitly: essential entities (Annex I sectors above size thresholds, plus qualified trust service providers, top-level domain registries, DNS providers and certain telecom/public network operators regardless of size) and important entities (Annex II sectors and other Annex I entities below the essential thresholds). Write out both tiers from memory before answering any scope question.
Applying the size thresholds mechanically without checking the sector-specific and size-independent carve-outs, so a small entity is wrongly excluded or a medium entity wrongly treated as out of scope.
The medium-enterprise threshold (50+ staff or turnover/balance sheet above EUR 10 million) is easy to recall, but the exceptions for qualified trust services, TLD registries, DNS service providers, public electronic communications networks/services, and entities identified as critical under the CER Directive are scattered across Article 3 and its annexes.
What to do instead
Build a one-page decision tree: first check whether the entity is in a sector listed in Annex I or II, then check whether it falls into a size-independent category, then apply the size test. Practise with borderline examples (a 40-person managed service provider, a small trust service provider) until the carve-outs are automatic.
Confusing the risk-management obligations of Article 21 with the reporting obligations of Article 23, and answering a question about 'what must management approve' or 'what must be reported' using the wrong article's content.
Both articles are long lists, both are frequently tested, and both use similar vocabulary (incident handling, business continuity, supply chain). Under time pressure candidates pattern-match on keywords rather than on the obligation type.
What to do instead
Tag every measure you memorise with its article. Article 21 is a preventive/structural list (ten minimum measures including risk analysis, incident handling, business continuity and backup, supply chain security, vulnerability handling, cryptography, access control, MFA, training). Article 23 is a time-bound notification process. When a question mentions a deadline, it is Article 23; when it mentions a measure, it is Article 21.
Reciting Article 21's ten measures as a loose paraphrase and missing specific mandatory items such as multi-factor authentication, secured communications, and the training obligation for management.
Candidates learn the 'big' measures (risk analysis, incident handling, backup) and assume the rest are optional good practice. In NIS 2 all ten are minimum measures that must be applied, and the MFA/encryption point is often tested as a discrete fact.
What to do instead
Memorise the ten measures as a numbered list with the exact trigger words: risk analysis and information system security policy; incident handling; business continuity and crisis management including backup and disaster recovery; supply chain security; security in acquisition, development and maintenance; effectiveness assessment; cyber hygiene and training; cryptography and encryption; access control including MFA and secured communications; and asset management. Recite them aloud until complete.
Assuming the management body can delegate cybersecurity accountability to the CISO and that only the CISO can be held liable.
In many organisations security responsibility is operationally delegated, so candidates project that practice onto the Directive. Article 20 makes the management body explicitly responsible for approving and overseeing the measures and requires members to undergo training.
What to do instead
Anchor on Article 20: the management body approves the risk-management measures, oversees their implementation, and can be held liable for infringements; members must follow training. Operational delegation to a CISO is possible, but accountability stays with the management body. Answer 'who is responsible' questions with the management body, not the CISO.
Mixing up the 24-hour early warning, the 72-hour incident notification, and the one-month final report, or assigning the 24-hour deadline to the wrong trigger.
Three deadlines in one article invite transposition errors, and the 24-hour warning is easily confused with the GDPR 72-hour rule, which candidates often know better.
What to do instead
Fix the sequence in memory as a timeline: without undue delay and in any event within 24 hours, an early warning (including whether the incident is suspected to be malicious or cross-border); without undue delay and in any event within 72 hours, an incident notification updating the assessment, severity and indicators of compromise; on request of the CSIRT or authority, intermediate progress reports; and within one month, a final report. Note that the 72 hours runs from the early warning, not from detection.
Describing the reporting flow as 'report to the regulator' without naming the correct recipient (the CSIRT or the competent national authority) and without mentioning the possible onward notification to other affected Member States.
Candidates generalise from other regimes where a single supervisory authority receives breach reports, and they overlook that NIS 2 assigns the receiving role to the CSIRT or competent authority designated by each Member State.
What to do instead
State the recipient explicitly in every answer: the CSIRT or, where applicable, the competent authority. Add that the CSIRT may inform the public where disclosure is necessary and may inform other Member States where the incident has cross-border impact. If a question asks who receives the early warning, the answer is the CSIRT or competent authority, not 'the Commission'.
Treating supervision as identical for essential and important entities, for example assuming all entities face the same ex ante audits or that all entities can be subject to a temporary suspension of certification.
The Directive deliberately splits the regimes, and the differences are buried in Articles 32 to 34. Candidates learn the word 'supervision' and stop there.
What to do instead
Separate the two regimes: essential entities are subject to proactive supervision, including on-site inspections, regular security audits, targeted security scans and requests for information; important entities are subject to reactive ex post supervision, triggered by evidence or indication of non-compliance. Reserve the heaviest enforcement measures (including suspension of authorisation or certification and a ban on exercising management functions) for the essential-entity regime, and remember that both regimes can issue binding instructions and orders.
Confusing the self-assessment of conformity in Article 21(5) with third-party certification, and asserting that NIS 2 mandates certification for all in-scope entities.
The Directive uses the word 'certification' in several places (Article 21(5), Article 24, and the EU cybersecurity certification schemes under the Cybersecurity Act), and candidates collapse these into a single mandatory certification duty.
What to do instead
Keep the three apart: Article 21(5) lets Member States require entities to submit relevant evidence supporting their self-assessment, which is not third-party certification; Article 24 concerns standardisation and voluntary use of European or international standards; and EU cybersecurity certification schemes are voluntary unless a specific legal act makes them mandatory. Answer 'certification is mandatory for all entities' as false.
Answering enforcement questions with a vague 'fines apply' instead of the two-tier figures, and omitting that the maximum is a floor for Member States and that additional measures exist alongside fines.
Candidates remember that fines exist but not the amounts, and they assume a single maximum applies to all entities. The Directive sets different ceilings for essential and important entities and lets Member States set higher ones.
What to do instead
Memorise the pair: essential entities at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher; important entities at least EUR 7 million or 1.4% of turnover, whichever is higher. Add that Member States may set higher maxima and that fines are accompanied by other measures such as binding instructions, orders, suspension of certification, and a temporary ban on management functions.