GRCLibrary.ai

Annex

NIS 2 Implementation Annex

This annex describes how an entity in scope of EU Directive (EU) 2022/2555 (NIS 2) can use the core GRC library to implement the cybersecurity risk-management measures and the incident reporting obligations the directive imposes. It identifies the entity classification, the article-by-article mapping to library artefacts, the management body responsibilities, and the supplementary documentation that NIS 2 transposing laws require beyond the library baseline.

Type
Annex
Version
1.2.12
Date
2026-10-21
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Sector-Specific
Review frequency
Annual and upon material national NIS 2 transposition, supervisory guidance, or sector designation change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Entity classification (Articles 2 to 3 and Annexes I to II)
  • DORA and sector-specific lex specialis (Article 4)
  • Article 21 cybersecurity risk-management measures
  • Article 20 management body responsibilities
  • Article 23 incident reporting
  • Supervision and penalties (Articles 32 to 34)
  • Library gaps requiring additional documentation
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents