NIS2: a 90-day implementation plan
A 90-day NIS2 implementation plan will not make you “100% compliant”. However, it gives you what a supervisor, a customer or your own board will ask for first. That means approved governance, assessed risks, priority measures under way and an incident reporting procedure that works. Here are three 30-day phases with deliverables, owners and evidence.
In 30 seconds: first (days 1-30), confirm whether Directive (EU) 2022/2555 applies to you, appoint owners and build your inventory. Then (days 31-60), assess risks and the gap against the 10 measures in Article 21. In addition, have the 24-hour / 72-hour / one-month reporting procedure ready. Finally (days 61-90), gather evidence, train the board and staff, test the response plan and set up periodic review.
Who does what in a NIS2 implementation
A NIS2 implementation is not an IT-only project. Article 20 requires the management body to approve the risk-management measures and oversee their implementation. In addition, the management body can bear liability for infringements, and its members must follow training. We cover this in NIS2 management liability. Split the roles like this:
- Board and senior management: sponsor the NIS2 implementation, allocate budget, approve policy and risks, and receive a monthly report.
- Security lead (CISO): coordinates the plan, runs the gap analysis, keeps the risk register and classifies incidents.
- IT and operations: system inventory, access, MFA, backups, patching and logging.
- Procurement and supplier management: list of critical ICT suppliers, security questionnaires and contract clauses.
- Legal and compliance: fit with national law, contracts, notifications to authorities and alignment with the GDPR.
The 90-day plan, phase by phase
Days 1-30 of the NIS2 implementation: scope and governance
- First, confirm whether you are in scope and whether you would be an essential or an important entity. Sector (Annexes I and II), size and special cases all matter. If unsure, start with how to tell whether NIS2 applies to you.
- Then get formal board backing for the NIS2 implementation: minutes recording the mandate, the owner and the budget.
- Inventory services, systems, assets and ICT suppliers, and flag those that support critical services.
- Finally, choose a risk assessment method and book the first board training session.
Days 31-60: risks, gaps and priorities
- Assess risks to critical services with an all-hazards approach (attacks, failures, human error, suppliers, physical events).
- Next, compare what you have with the 10 measures in Article 21(2). Then prioritise: access and MFA, tested backups, encryption, incident handling and continuity.
- Also write the reporting procedure with significant-incident criteria, templates and contacts.
- Finally, take the security policy and risk treatment plan to the board for approval.
Days 61-90: evidence, training and testing
- Gather evidence for each measure (configurations, minutes, logs, restore tests).
- In addition, train staff in cyber hygiene and key teams in the incident procedure.
- Run a tabletop exercise (ransomware or a supplier outage) with the 24- and 72-hour clock running.
- Finally, set indicators and report the status of the NIS2 implementation and open items to the board.
| Phase | Deliverables | Evidence you keep | Lead owner |
|---|---|---|---|
| Days 1-30 | Applicability analysis, board mandate, inventory of services, assets and suppliers | Board minutes, appointment, dated inventory | Board and security lead |
| Days 31-60 | Risk assessment, gap report against Art. 21(2), treatment plan, reporting procedure | Risk register, approved plan, versioned procedure | Security lead and IT |
| Days 61-90 | Priority measures in place, training, response exercise, indicators | Training records, exercise report, screenshots and configurations | IT, procurement and legal |
NIS2 implementation week by week: the 10 Article 21(2) measures
In a NIS2 implementation, each measure has to stay proportionate to your exposure, size and likelihood of incidents. In addition, specific rules apply if you provide cloud, data centre, managed services, DNS or other digital services. Specifically, Implementing Regulation (EU) 2024/2690 sets out the technical requirements and when an incident counts as significant. An indicative 13-week schedule:
| Measure (Art. 21(2)) | First practical step | Weeks |
|---|---|---|
| (a) Risk analysis and information system security policies | Method, assessment and approved policy | 3-8 |
| (b) Incident handling | Procedure, log and exercise | 6-8 and 11-12 |
| (c) Business continuity: backups, disaster recovery and crisis management | Isolated backups and a restore test | 7-9 and 11 |
| (d) Supply chain security | Critical suppliers, questionnaire and clauses | 2-4 and 7-9 |
| (e) Security in acquisition, development and maintenance, including vulnerability handling | Patching and a vulnerability disclosure channel | 8-10 |
| (f) Assessing the effectiveness of measures | Indicators and quarterly review | 12-13 |
| (g) Cyber hygiene and training | Board and staff training | 4 and 10-12 |
| (h) Cryptography and encryption | Encryption policy at rest and in transit | 7-9 |
| (i) HR security, access control and asset management | Inventory, joiners and leavers, least privilege | 2-7 |
| (j) MFA and secured communications | MFA on remote access and privileged accounts | 5-7 |
Do not leave the supply chain until last
Article 21(3) asks you to take into account the vulnerabilities of each direct supplier. It also covers the quality of their cybersecurity practices, including secure development. Within 90 days of NIS2 implementation, ranking suppliers by criticality and sending the critical ones a questionnaire is enough. Then review their contracts (incident notification, subcontracting, audit, exit). If you are the supplier, prepare your answers, because customers subject to NIS2 will ask for them.
Incident reporting: 24 hours, 72 hours and one month
Article 23 requires you to report significant incidents to the CSIRT or competent authority. In other words, those that cause or can cause severe operational disruption, financial loss or considerable damage to others. The clock starts when you become aware:
- Early warning, within 24 hours: stating whether you suspect unlawful or malicious action or a cross-border impact.
- Incident notification, within 72 hours: initial assessment of severity and impact, plus indicators of compromise where available.
- Intermediate report: when the authority requests one.
- Final report, within one month of the notification: description, root cause, mitigation and any cross-border impact. If the incident is still ongoing, you submit a progress report instead. You then send the final report one month after you have handled it.
Trust service providers must notify within 24 hours for incidents affecting those services. If the incident affects personal data, the GDPR adds its own deadline. In that case, you must notify the data protection authority (in Spain, the AEPD) within 72 hours. Therefore, join up both processes, as we explain in how to report a breach within 72 hours.
After day 90: sustaining your NIS2 implementation
Your NIS2 implementation does not end on day 90; from then on, keep it running like this:
- Close the remaining gaps in the treatment plan with dates and owners. In addition, Article 21(4) requires corrective measures without undue delay when you find non-compliance.
- Review risks every year and also after significant changes or incidents.
- Report to the board every quarter and refresh its training.
- Repeat exercises and restore tests, and reassess critical suppliers.
- Finally, check your progress against the NIS2 checklist for SMEs.
The situation in Spain (October 2026)
The transposition deadline passed on 17 October 2024 and Spain still has no law. In January 2025 the Council of Ministers approved the draft Cybersecurity Coordination and Governance Act. In Spanish, it is the anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad. However, it has not completed its passage. Then, on 8 July 2026, the European Commission referred Spain to the Court of Justice of the EU. It also asked for a lump sum and daily penalties. With Parliament dissolved on 6 October 2026, a general election follows on 29 November. As a result, the law cannot pass this year. Meanwhile, Royal Decree-law 12/2018, which transposed the first NIS Directive, remains in force. We analyse this in NIS2 in Spain: transposition pending and the CJEU.
Still, waiting for the law before starting your NIS2 implementation is not a good strategy. The Directive requires maximum fines of at least €10 million or 2% of worldwide turnover for essential entities. For important ones, the figure is €7 million or 1.4%. Your customers are also already asking for proof. In addition, the Commission proposed targeted NIS2 amendments in January 2026. However, they do not change these measures or deadlines unless and until the EU adopts them.
NIS2 implementation: frequently asked questions
Can you complete a NIS2 implementation in 90 days?
You can put the foundations in place: governance, risks, priority measures and reporting. However, a mature NIS2 implementation across the 10 measures takes further cycles, depending on your size and starting point.
If Spain has not transposed NIS2, do you need to act now?
Yes, for three reasons. First, Royal Decree-law 12/2018 still applies to those already covered. In addition, customers subject to NIS2 in other countries require measures from their suppliers. Finally, once the law arrives, the adaptation window will be short.
What are the NIS2 reporting deadlines?
An early warning within 24 hours and an incident notification within 72 hours. Then a final report within one month of that notification, plus intermediate reports if the authority asks.
What does the board have to do?
Approve the risk-management measures, oversee their implementation and undergo training. Its members can also face liability for infringements, so record these decisions in the minutes.
Does NIS2 require ISO 27001 certification?
No. The Directive asks for appropriate measures that take European and international standards into account. However, it does not require a specific certification. Even so, ISO 27001, or Spain’s ENS for public sector suppliers, helps a great deal in demonstrating compliance.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with your NIS2 implementation
Atalaya GRC turns your NIS2 implementation into tasks with owners and dates. First, it applies NIS2 service by service. Then it maps the 10 Article 21 measures to controls you reuse for ISO 27001, ENS, DORA and the GDPR. As a result, one control covers many regulations. It also stores their evidence, flags deadlines through its regulatory clock and keeps the third-party register. In addition, it manages incidents and the 24-hour, 72-hour and one-month notifications. See the NIS2 guide or request a demo.
