What do you need to know about the ten measures of NIS2?
The NIS2 Directive describes ten types of measures with which organizations can demonstrate their digital security. It is not about ten separate rules that you must tick off one by one, but about ten areas in which an organization should have policies and procedures in place. Many customers adopt these areas literally in their cybersecurity questionnaire, because they in turn must be able to demonstrate that their suppliers are doing something about them.
Whether the Directive applies directly to your organization depends on the sector in which you are active and your size. Many smaller companies do not fall directly under NIS2, but still receive the questions because their customer does and the chain must ask through. That difference between directly falling under the Directive and being part of someone else's accountability is precisely where much confusion arises.
What do the ten areas cover
The Directive mentions, among other things, risk analysis and information security policy, incident handling, business continuity and crisis management in the event of a disruption, and supply chain security. In addition, it mentions security in the procurement, development and maintenance of network and information systems, policy to assess the effectiveness of measures, and basic practices in cyberhygiene and awareness training for employees. The last areas cover policy on the use of cryptography and encryption, personnel security and access policy, the management of corporate assets, and the use of multi-factor authentication or similar solutions for secure communication.
It is important to see that these are policy areas, not a checklist with one correct answer. An installation company with ten employees will probably give a different, simpler response to each of these areas than an IT service provider with a hundred employees. Supervisory authorities look at whether the measures fit the risks associated with the organization, not at a fixed template that is the same for everyone.
Why your customer is asking about this
If your customer falls under NIS2, that customer must be able to demonstrate that their suppliers also pay attention to these areas. This is why questionnaires often literally go through the ten areas: do you have an incident procedure, do you use multi-factor authentication, do you have a policy for your suppliers. For you as the recipient of the questionnaire, this often means that the same ten topics come up in slightly different wording with each customer who sends the list.
That is also immediately the biggest practical problem: not the content of the questions, but the repetition. The same information about your password policy, your backup procedure and your incident handling is requested in ten different formats, with ten different portals. Supplia was built to reduce that repetitive work: you answer these topics once in your own chain file, and the system recognizes similar questions in the list from each new customer. You confirm each answer yourself with yes or no before it goes to your customer's portal; Supplia does not assess anything and does not log in anywhere itself.
How to make this manageable for yourself
It helps to not start with the ten areas themselves, but with what you already have: a password policy, a backup schedule, a list of who has access to which systems. Many of those documents already exist, but are scattered across folders and minds. Organizing them is often more work than actually implementing new measures. the explanation per topic in the knowledge base goes through the ten areas one by one with what belongs to each.
If you want to quickly know which of these areas are already in order in your situation and which need attention, then provides the recognition check in a few questions provides an initial indication. For anyone who wants to know where the information on Supplia comes from and how it is maintained, the page about our working method explains that.
Whether NIS2 applies in your specific case and which measures precisely fit, is something you best discuss with a legal advisor or the competent supervisory authority. This article describes the directive in general terms and does not replace that advice.
Do you recognize the questions your customer sends, but would you like to see first how filling in works in practice? Read the frequently asked questions about filling in and submitting or start the free quick-scan to see which topics apply to your company.