Eu nis2 compliance
Skill BuilderCed/agent-skills/skills/compliance/eu-nis2-compliance
31 cross-platform AI agent skills for regulated industries & underserved markets. EU compliance (AI Act, NIS2, DORA, GDPR), French professional (accounting, tax, notary, real estate), security audit, agent evaluation, Africa mobile money, offline-first.
npx -y skills add BuilderCed/agent-skills --skill eu-nis2-complianceAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Implement NIS2 Directive (2022/2555) cybersecurity obligations for essential and important entities — risk management, incident reporting, supply chain security.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
5.4 KB, as published. Nobody here has run it
EU NIS2 Compliance
DISCLAIMER: This skill provides guidance only. It does not constitute legal or cybersecurity advice. Always verify with qualified professionals.
When to Use
- Determining if your organization falls under NIS2 scope
- Implementing cybersecurity risk management measures
- Setting up incident reporting procedures
- Auditing supply chain security
- Preparing for national authority inspections
Step 1: Scope — Am I Affected?
NIS2 applies to entities in these sectors meeting size thresholds:
Essential Entities (stricter obligations)
| Sector | Examples |
|---|---|
| Energy | Electricity, oil, gas, hydrogen, district heating |
| Transport | Air, rail, water, road |
| Banking | Credit institutions |
| Financial market | Trading venues, CCPs |
| Health | Hospitals, laboratories, pharma, medical devices |
| Drinking water | Supply and distribution |
| Waste water | Treatment |
| Digital infrastructure | DNS, TLD, cloud, data centers, CDNs, trust services |
| ICT service management (B2B) | Managed service providers, managed security providers |
| Public administration | Central government (excluding judiciary, parliament, central banks) |
| Space | Ground-based infrastructure operators |
Important Entities (lighter obligations)
| Sector | Examples |
|---|---|
| Postal & courier | Services |
| Waste management | Collection, treatment |
| Chemicals | Manufacturing, production, distribution |
| Food | Production, processing, distribution |
| Manufacturing | Medical devices, computers, electronics, machinery, motor vehicles |
| Digital providers | Online marketplaces, search engines, social networks |
| Research | Research organizations |
Size Thresholds
- Medium: 50-249 employees OR turnover EUR 10-50M
- Large: 250+ employees OR turnover > EUR 50M
- Some entities included regardless of size (DNS, TLD, qualified trust services)
Step 2: Risk Management Measures (Article 21)
Implement at minimum:
- Risk analysis and information system security policies
- Incident handling — detection, response, recovery
- Business continuity and crisis management — backups, disaster recovery
- Supply chain security — assess security of direct suppliers
- Security in network and information system acquisition, development, and maintenance — vulnerability handling, disclosure
- Policies and procedures to assess effectiveness — testing, auditing
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption policies
- Human resources security, access control, and asset management
- Multi-factor authentication or continuous authentication — where appropriate
Step 3: Incident Reporting (Article 23)
Timeline
| Deadline | Report | Content |
|---|---|---|
| 24 hours | Early warning | Is it suspected malicious? Could it have cross-border impact? |
| 72 hours | Incident notification | Initial assessment, severity, impact, indicators of compromise |
| 1 month | Final report | Root cause, mitigation, cross-border impact if any |
Significant Incident Criteria
An incident is significant if it:
- Caused or can cause severe operational disruption or financial loss
- Has affected or can affect other natural or legal persons by causing material or non-material damage
Reporting Authority
Report to the national CSIRT or competent authority. In France: ANSSI (Agence nationale de la securite des systemes d'information).
Step 4: Supply Chain Security
For each critical supplier:
- Assess their cybersecurity maturity
- Include security requirements in contracts
- Monitor their security posture continuously
- Have contingency plans for supplier failure or compromise
Step 5: Governance (Article 20)
- Management body must approve cybersecurity risk management measures
- Management body must oversee implementation
- Management body members must receive cybersecurity training
- Personal liability possible for management body members in case of non-compliance
Penalties
| Entity Type | Max Fine |
|---|---|
| Essential | EUR 10M or 2% of worldwide annual turnover (whichever is higher) |
| Important | EUR 7M or 1.4% of worldwide annual turnover (whichever is higher) |
Key Dates
- 17 October 2024: Transposition deadline (member states must transpose into national law)
- 17 April 2025: List of essential and important entities established
- 17 October 2027: Commission review of the Directive
What This Skill Does NOT Do
- Does not perform penetration testing
- Does not configure security tools (firewalls, SIEM, etc.)
- Does not manage incident response execution
- Does not replace ANSSI or national authority guidance