Lion Cipher Lab
Does NIS2 apply to you? Scope it, size it, and run a gap assessment
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
NIS2 is the EU's flagship cybersecurity law, and it quietly became one of the widest-reaching compliance regimes in the world when its transposition deadline passed in October 2024. It does not just cover power grids and banks any more; it reaches deep into manufacturing, food, waste, digital services, managed IT providers, cloud, postal services and more, and — crucially for anyone outside Europe — it can catch a company with no EU office at all, purely because it offers services into the EU. The first skill that actually matters is not memorising the articles; it is being able to answer the…
What you'll learn
- NIS2 applicability and scoping
- essential vs important entity classification
- Annex I / Annex II sector mapping
- the size-cap rule and its exceptions
- reading a directive vs a regulation (national transposition)
- Article 21 risk-management gap assessment
- the Article 23 incident-reporting timeline (24h / 72h / one month)
- mapping NIS2 onto an existing ISO 27001 control set instead of building a parallel programme
Steps in this lab
- What NIS2 actually is — and why 'directive' is the most important word in the name
- Set up your worksheet and pick a fictional org
- Applicability part 1 — is your org in a covered SECTOR? (Annex I vs Annex II)
- Applicability part 2 — the SIZE test, and the exceptions that ignore it
- Classify — ESSENTIAL vs IMPORTANT, and why the split has teeth
- The obligations, in one head — Article 20 governance, Article 21 measures, Article 23 reporting
- Build and score the Article 21 gap assessment — the ten measures
- Do it better — map NIS2 onto ISO 27001 instead of building a parallel programme
- Write the one-page verdict and the prioritised fix list