This is not legal advice and not a fine schedule. It is a map of questions to ask your accountant, counsel or the competent authority — before someone sells you a “NIS2 pack”.
Two layers people confuse
- Obligations of essential / important entities (KSC implementing NIS2) — apply to listed sectors and thresholds. Not every company with a VAT number automatically “must have a SOC”.
- Good practice and contracts — customers, an insurer, a tender or a supply-chain partner may require MFA, a restore test and an incident owner without putting you on the essential-entity list.
If you do not know which layer you are in: establish status first (essential / important / out of scope), then buy tools.
What usually still makes sense outside the formal scope
These help day-to-day work and insurer conversations — regardless of the NIS2 label:
- named accounts and MFA (M365 / Google baseline);
- a list of internet-facing services (exposure worksheet);
- backup with a restore test;
- who answers the phone in an incident (role map);
- vendor access with an end date (checklist).
What not to buy “because NIS2”
- Round-the-clock “SOC on subscription” without written scope and without people who understand your estate.
- A wall certificate instead of closing RDP and email.
- A “compliance” audit without a control list and without owners for fixes.
GDPR and incidents
A separate path: a personal-data breach may require assessment and — in defined cases — notification to the supervisory authority on a short deadline. That is not the same as a SIEM ticket. The “who when” map is in the incident resource.
How I can help
I can help assemble technical facts (accounts, exposure, email, backup, IR path) for a conversation with counsel or an insurer. I will not issue an opinion that “you are / are not an essential entity” — that is a legal call.