NIS 2 Foundation study plan

Map the structure of the NIS 2 Directive article by article, noting which articles define scope, which define obligations, and which define supervision.

Classify at least 15 example organisations as essential, important, or out of scope using the Annex I and Annex II sector lists and the size thresholds.

Explain in writing why the Directive uses a directive-plus-national-transposition model rather than a regulation, and what that means for a compliance officer working in one member state.

Distinguish essential entities from important entities and list the concrete consequences of that classification for supervision and enforcement.

Summarise the special treatment of qualified trust service providers, top-level domain registries, DNS providers, and public electronic communications networks.

Identify the categories of risk-management measures listed in Article 21 and state the purpose of each category in one sentence.

Explain the all-hazards, state-of-the-art, proportionality logic that governs how measures are selected.

Break down the supply chain security requirement into practical supplier due-diligence steps a mid-sized entity could actually run.

Describe the role of management bodies in approving and overseeing risk-management measures and in bearing accountability.

Explain the relationship between the Directive's baseline measures and the more specific requirements in sectoral legal acts, including how conflicts are resolved.

Draft five audit-style questions that would test whether an entity has genuinely implemented each of the main measure categories.

Outline the incident-reporting workflow from detection to final report, including the three-stage timing structure and what each stage requires.

Explain the early warning, incident notification, and final report content requirements and identify what information is realistically available at each deadline.

Describe how an entity decides whether an incident is significant, including cross-border impact considerations.

State the reporting obligations that flow to recipients of services and to competent authorities.

Compare the ex-ante and ex-post supervisory regimes for essential and important entities and list the supervisory tools available to competent authorities.

Describe the enforcement ladder, including administrative fines, the different maximum thresholds for essential and important entities, and non-monetary measures such as suspension or bans on management.

Explain the personal accountability of management bodies, including the possibility of temporary bans and the requirement to follow training.

Summarise how member states organise competent authorities, CSIRTs, and single points of contact, and how the cooperation group and EU-CyCLONe fit in.

Explain how harmonised standards and implementing acts support the presumption of conformity with Article 21 requirements.

Describe the role of the European cybersecurity certification schemes established under the EU Cybersecurity Act and how they interact with NIS 2 obligations.

Distinguish voluntary certification and good-practice use from mandatory legal obligations, and identify where certification is used as evidence rather than as a legal requirement.

List the information-sharing arrangements the Directive encourages and the safeguards that apply to sharing threat intelligence.

Assess how national transposition differences can change obligations for a multinational entity operating in several member states.

Identify the registration and information duties that apply to entities, including the self-identification expectation for entities not automatically listed.

Evaluate a realistic good-practice scenario and identify three gaps against the Directive's requirements, with a remediation action for each.

Revisit the scope decision tree from week 1 and correct any errors found after deeper study of the sector annexes.

Synthesise all four domains into a single mental model that connects scope, measures, reporting, supervision, and conformity.

Complete two timed practice sets and review every wrong answer to its source article or concept.

Recite from memory the key thresholds, deadlines, and fine levels without reference material.

Identify the three weakest sub-topics from practice results and close each with a focused review session.