NIS2 preparation in 8 steps: from compliance assessment through gap analysis to full implementation of all Art. 21 requirements.
Steps 1-4: Foundations and analysis
Step 1 — Check applicability: determine sector membership and company size, classify as an essential vs. important entity, resolve uncertainties with the compliance check on 360tprm.com. Step 2 — Gap analysis: assess the current state of the 10 minimum measures (Art. 21), identify documentation gaps, prioritise by risk and effort. Step 3 — Ensure governance: inform and train executive management on NIS2 obligations, define or strengthen the CISO role, set up approval processes for security measures. Step 4 — Set up risk management: risk analysis per ISO 31000, document security policies, start a TPRM programme with 360TPRM.
Supply chain security (Art. 21 d) is the fastest quick win in NIS2 preparation with 360TPRM: immediately demonstrable, fully automated.
Steps 5-8: Implementation and documentation
Step 5 — Implement technical measures: MFA for all critical systems, formalise the patch management process, review encryption of sensitive data, test backup and recovery processes. Step 6 — Prepare reporting obligations: develop an incident response plan, identify the relevant authority, keep reporting forms and processes ready. Step 7 — Supply chain security (Art. 21 d): roll out 360TPRM for continuous supplier monitoring, identify and assess critical suppliers, review contracts against security requirements. Step 8 — Finalise documentation: document every measure, obtain management approvals, keep audit documentation ready.
NIS2 compliance is an ongoing state — not a project that gets completed. Continuous monitoring (360TPRM) and regular reviews are permanently required.
FAQ
Start NIS2 preparation now
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →