How to comply with the NIS2 Directive: a practical guide

By Kike Gandia · Co-Founder & CEO, OSCP

The NIS2 Directive (Directive (EU) 2022/2555) requires medium and large companies in 18 sectors to manage their cybersecurity risk with technical and organizational measures and to report significant incidents within fixed deadlines. Member States had to apply it from October 18, 2024, but Spain has not yet published its transposing law, which raises a fair question about whether to act now. This guide answers the questions in the order worth asking them: whether it applies to you, where the law stands in Spain, how to organize compliance step by step and exactly what it requires.

First step: does NIS2 apply to you?

NIS2 applies to public and private entities in the sectors listed in its annexes that are at least medium-sized enterprises under Recommendation 2003/361/EC. It comes down to three checks, in this order:

Once in scope, the directive classifies you as an essential or an important entity. The classification does not change which measures apply, but it does change how you are supervised and the maximum fine; details below.

Where NIS2 stands in Spain (October 2026)

Spain missed the European transposition deadline of October 17, 2024. On January 14, 2025, the Council of Ministers approved the draft Law on the Coordination and Governance of Cybersecurity, which would create a National Cybersecurity Center as the national authority, but at the time of this update the law has not been published in the Official State Gazette (BOE). The European Commission sent Spain a letter of formal notice in November 2024 and a reasoned opinion in May 2025, and on July 8, 2026, referred it to the Court of Justice of the EU, asking for a lump sum and daily penalties until transposition is complete.

What this means for a company:

• There is currently no NIS2 penalty regime applicable to companies in Spain. A directive does not impose direct obligations on a private company until it is transposed. The previous framework, Royal Decree-law 12/2018 and Royal Decree 43/2021, still applies to those already within its scope.
• The obligations will arrive with the law, and they are likely to follow the directive closely, because a Member State has limited room when transposing.
• Your customer may set the real timetable. If you supply a regulated entity, in Spain or in a Member State that has already transposed, the requirements will reach you by contract before they reach you by law.

Complying now is not about an imminent fine; it is about not having to rush, once the law is published, through work that a mid-sized organization cannot finish in a few weeks.

Roadmap: how to comply with NIS2 in six steps

This order avoids the most common mistake, which is writing policies before knowing what needs protecting:

The step most companies skip is the fifth. An approved plan with controls nobody has tested survives neither a real incident nor an inspection, and the directive itself asks you to assess whether measures are effective, not just to have them.

The ten measures of Article 21

Article 21(2) lists the minimum risk management measures. Read them as capabilities you must be able to demonstrate, not as ten documents to write:

Point (f) is the one most often overlooked and the one tied directly to technical testing: the directive is not satisfied by controls existing, it asks you to check they work. A penetration test or periodic technical audit is the most direct way to produce that evidence.

Incident notification: the deadlines you can't ignore

Article 23 sets three submissions to the CSIRT or competent authority when an incident is significant:

The authority can also request intermediate reports, and if the incident is still ongoing when the month is up, a progress report is due and the final report is due one month after the incident is resolved. What makes companies miss these deadlines is rarely the wording of the notice: it is not realizing in time that the incident is significant. That is why the procedure has to define in advance who decides significance and on what criteria.

Accountability of management bodies

Article 20 requires management bodies to approve the Article 21 risk management measures, oversee their implementation and undergo cybersecurity training themselves, and provides that they can be held liable for infringements. This covers boards of directors, executive committees and anyone with management functions. In practice the compliance plan needs formal approval and documented reviews; a technical owner pushing it along is not enough.

Essential or important entity: what changes in practice

The classification does not change what you have to do—the Article 21 measures are the same for everyone—but it does change how you will be supervised and how much non-compliance can cost.

The practical consequence is that an essential entity has to be able to demonstrate compliance at any moment, not only when something goes wrong. That turns documentary evidence—audit reports, training records, risk review minutes—into part of compliance itself rather than an extra.

Supply chain: the requirement that generates the most work

Of the ten Article 21 requirements, supply chain security is the one most organizations underestimate, because it does not depend on you alone. The directive makes you responsible for managing the risk introduced by your direct suppliers and your ICT service providers.

In practice that means four pieces of work: inventorying which suppliers have access to your systems or process relevant information and classifying them by criticality; carrying security obligations into the contracts, including the duty to notify you of incidents that affect you and within what deadline; establishing a verification mechanism proportionate to the risk, which can range from a questionnaire to a right to audit; and recording all of it, because a supplier managed without evidence is worth nothing before a supervisor.

The interesting side effect is that this cascades down the chain: if you are a supplier to an essential entity, the obligations will reach you contractually even if your company sits in none of the eighteen sectors.

FAQ

Is NIS2 already mandatory in Spain even though the directive hasn't been transposed yet?

For a private company, not yet: a directive needs a national transposing law to impose obligations and penalties on private parties, and at the time of this update the Spanish Law on the Coordination and Governance of Cybersecurity has not been published in the BOE. The previous framework (Royal Decree-law 12/2018) does still apply to those already within its scope. The Spanish law will come, very likely close to the directive's text, and full compliance cannot be improvised in a few weeks, which is why it pays to start earlier.

Are SMBs required to comply with NIS2?

As a general rule, no: scope starts at medium-sized enterprises, meaning 50 or more employees, or annual turnover and balance sheet above €10 million. There are size-independent exceptions such as providers of public electronic communications, trust service providers, DNS service providers, top-level domain registries or the sole provider of an essential service. And an SMB that is not obliged can still receive the requirements by contract if it works for an entity that is.

Where does a gap analysis start and what does it deliver?

It starts by defining scope: which group entities, which systems and which services are in. From there, the current situation is compared against each of the ten Article 21 requirements and against the notification and registration obligations. The useful deliverable is not a list of gaps but a prioritized plan: what is missing, what risk each gap represents, what effort closing it takes and in what order it should be done.

We already have ISO 27001 or an ENS certification. Is that enough?

It gets you a long way, but it does not exempt you. An established management system already covers much of risk management, access control, continuity and training, and above all gives you the documentary culture NIS2 requires. What usually falls outside is the fit with the specific incident notification deadlines, registration with the competent authority, and the depth the directive asks for in supply chain and vulnerability management.

Who is accountable inside the company?

The management body. That is one of the directive’s innovations: approving the risk management measures, overseeing them and training the executives themselves are obligations of the management body, and failing them can carry personal liability. In practice it means the compliance plan needs formal approval and documented periodic review, not just a technical owner pushing it along.

We are not in any regulated sector, but we supply a company that is. Does it affect us?

Not directly through the directive, but very much in practice. Your customer is obliged to manage their supply chain risk, so they will pass requirements down to you contractually: specific security measures, an obligation to notify incidents within set deadlines and, frequently, technical evidence that what you claim is actually in place. Getting ahead of that conversation usually costs less than answering a questionnaire against the clock.

Related service

NIS2 compliance consulting

Related content

• NIS2 fines and penalties in Spain
• NIS2 in Spain, two years without a law: where transposition stands
• DORA vs NIS2: key differences
• Cybersecurity regulatory compliance
• DORA compliance

Sources

• Directive (EU) 2022/2555 — official NIS2 text on EUR-Lex
• ENISA — NIS2 Directive implementation guide
• ENISA — the NIS2 Directive: scope and obligations for covered entities
• European Commission — Spain referred to the Court of Justice for failing to transpose NIS2 (July 8, 2026)
• European Commission — NIS2 transposition status in Spain

See our NIS2 compliance consulting