The transposition deadline was October 2024. Two years on, most member states have NIS 2 in national law, and the authorities have moved from publishing guidance to asking questions.
And yet the conversation I have with CISOs, compliance leads and IT managers across Europe is always the same one.
"We know NIS 2 applies to us. We have read the directive. We have not actually started."
If that is you, this is not a reading problem.
The gap nobody talks about
NIS 2 is a directive, not a manual.
It tells you what to achieve. It says nothing about how. And "how" is where everyone is stuck.
You have fifty pages of legal text. You understand the scope, the sectors, the reporting obligations. Then Monday morning arrives, someone asks you where to start, and the honest answer is that you do not know yet.
That gap, between understanding the directive and implementing it, is where organisations lose six months. Six months you no longer have.
What makes NIS 2 different from everything you have done
If you have run ISO 27001 or GDPR, you might file NIS 2 under "another framework". It is not.
Your management is personally liable. Not the organisation. The people. If you are the CISO or the compliance lead, your governance body carries accountability that a certificate does not absorb.
The reporting clock is hard. Twenty-four hours for an early warning. Seventy-two for a full notification. There is no "we will come back to you next week".
Supply chain security is not a clause you sign. You need documented assessments, contractual obligations and monitoring that survives being asked for evidence.
The fines are structural. Up to 10 million euros or 2% of global annual turnover for essential entities, and your organisation can be named publicly.
Cross-border means plural. Operating in several member states means several national implementations of the same directive, and they do not agree with each other.
ISO 27001 is a good foundation. It does not cover the reporting timelines, the sector-specific requirements, or the management accountability. Those are new, and they are the parts with teeth.
The five questions your regulator will ask
When your national authority comes calling, and it will, this is what it wants to see.
- Governance. Do you have a cybersecurity governance framework with named roles and real management oversight? Can you prove senior management is involved, not merely informed?
- Risk management. Is there a formal risk assessment? Documented? Linked to specific controls? Can you show how you prioritised?
- Incident response. Do you have a tested plan that meets the 24 and 72 hour obligations? Have you actually drilled it?
- Supply chain. How do you assess and monitor cybersecurity risk in your suppliers? Which contracts, which controls, which evidence?
- Continuous improvement. What do you measure? What do you report? How do you test and improve?
If you cannot answer all five with documentation and a straight face, you have a gap. That gap has a price.
14 to 18 December: close it in five days
This is what the NIS 2 Directive Lead Implementer course is for.
From 14 to 18 December we run a live online cohort, in English, through the complete implementation process. Not the theory. Not the normative text. The methodology you will use the following Monday.
| Day | Focus |
|---|---|
| Mon 14 Dec | NIS 2 foundations, requirements, scoping your organisation, initiating the implementation project |
| Tue 15 Dec | Governance structure, roles and responsibilities, asset management, risk management methodology |
| Wed 16 Dec | Cybersecurity controls, supply chain security, incident management, crisis management frameworks |
| Thu 17 Dec | Business continuity, awareness and training, testing, metrics and monitoring, continuous improvement |
| Fri 18 Dec | Certification examination |
Cohorts are capped at six people, which is the reason the questions get answered properly.
What you walk away with
"You will learn a lot" is not a value proposition. Here is the specific list.
- An implementation roadmap you can put in front of your board on Monday. Phases, milestones, owners, not notes from a training.
- Incident response frameworks that meet the 24 and 72 hour obligations. Documented, tested, defensible.
- A risk assessment methodology built on real scenarios, not textbook examples.
- Supply chain approaches that go past "our vendors signed an NDA". Assessment frameworks, contractual requirements, ongoing monitoring.
- The PECB Certified NIS 2 Directive Lead Implementer credential, recognised across Europe, with the exam included in the price and 31 CPD credits.
- The [Certification or Refund guarantee](/trainings/certification-or-refund). If you complete the course, sit the exam and do not pass, you are refunded.
Why this one is different
There are other NIS 2 courses. Most are taught by trainers who read slides about the directive.
I am a practising CISO. I run NIS 2 implementations for organisations across Europe. When I teach incident response, it is because I built incident response plans this year and watched them get used. When I teach supply chain assessment, it is because I have argued with suppliers about evidence.
That is the difference between a course about a directive and a transfer of implementation know-how from someone doing the work.
Is this for you
This course is for people who are done reading about NIS 2.
- CISOs and security managers leading, or about to lead, a NIS 2 compliance project
- GRC and compliance officers turning the directive into operational reality
- IT managers in the eighteen sectors now in scope: energy, transport, healthcare, digital services and the rest
- Consultants advising on NIS 2 who need the credential behind the advice
- Risk managers folding NIS 2 into an enterprise risk framework
Not quite right? If you want a high-level introduction to what NIS 2 is and who it applies to, NIS 2 Foundation is the better starting point.
Secure your seat
NIS 2 Directive Lead Implementer 14 to 18 December 2026, live online, in English. PECB certification exam included, 31 CPD credits, Certification or Refund guarantee.
Six seats. That is not scarcity marketing, it is the number that lets everyone ask their own questions.