REGULATORY COMPLIANCE
NIS2
Compliance
NIS2 is an EU directive, and most of the companies that need help with it are not European. If you operate an in-scope entity in Europe, or you supply industrial equipment and services to customers who do, NIS2 obligations reach you. Arista Cyber helps North American operators and vendors establish what applies, close the gaps that matter, and hold evidence that survives scrutiny.
Why a North American company is reading this page
NIS2 reaches US and Canadian organizations by two routes, and they call for different work. The first is direct: you operate a subsidiary, plant or service in the EU that falls inside the directive as an essential or important entity. The second is contractual: Article 21(2)(d) requires your European customers to manage cybersecurity in their supplier relationships, so their obligations arrive at your door as questionnaires, audit clauses and contract terms. If you are not sure which applies to you, that is the first thing we establish, and it is usually a short piece of work.
NIS2 sets out ten risk management measures in Article 21(2), covering risk analysis and security policies, incident handling, business continuity and backup, supply chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. Article 20 makes management bodies responsible for approving those measures and overseeing their implementation, and requires management body members to follow training.
Article 23 sets the reporting clock: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. Member states must set maximum fines of at least 10 million euro or 2 percent of worldwide annual turnover for essential entities, whichever is higher, and 7 million euro or 1.4 percent for important entities.
For the full obligation set, our NIS2 compliance playbook for OT and ICS and our guide for energy and utility operators go into detail.
NIS2 is a directive, not a regulation, which means each member state writes its own national law on top of it. Those laws diverge on registration mechanics, local thresholds for a significant incident, and how far obligations are pushed down the supply chain. Transposition was due by 17 October 2024 and several states were late. In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice over transposition delays.
The practical consequence is that your exposure depends on which member states you operate in or sell into. We map that first, because building to a guess at national law is wasted effort. Our analysis of the NIS2 transposition patchwork explains the mechanics.
Applicability and Scoping Assessment
We establish whether NIS2 reaches you and how. Entity classification against the Annex I and Annex II sectors, size thresholds, essential versus important status, which member states are relevant, and whether your exposure is direct or contractual. This is where every engagement starts and it frequently narrows the scope substantially.
Article 21 Gap Assessment
A structured assessment against the ten risk management measures, focused on operational technology rather than corporate IT. We assess what you have, what the evidence looks like, and where the gaps are, with findings rated and the rating method stated so they can be defended.
OT Asset Inventory and Architecture Review
Nothing in Article 21 is achievable without knowing what you have. We build or validate the asset inventory using passive, non-disruptive methods, then assess the network architecture against zones and conduits. This underpins asset management, access control, business continuity and incident handling simultaneously.
Supplier Evidence Pack Development
For equipment makers, integrators and service providers answering European customers. We build the reusable evidence pack that answers supplier questionnaires once: software bill of materials, secure development statement mapped to IEC 62443-4-1, product security baseline, disclosure policy, support periods, remote access procedure and subcontractor register.
Incident Reporting Readiness
Article 23 compliance is an operational capability, not a policy. We define your significance threshold with worked OT examples, establish named filing authority with on-shift delegation, build templates for all three reporting stages, identify your competent authorities per member state, and run a timed exercise against a plausible industrial scenario.
Management Body Briefing and Article 20 Evidence
Board-level briefings built on your own assets and your own risk register rather than generic threat material, which is what Article 20(2) actually requires. We also review whether your governance records evidence approval and oversight, which is the gap most often found in otherwise strong programs.
Remediation Roadmap and Implementation Support
Findings sequenced by consequence and effort, with outage requirements flagged per item and effort estimated. We support delivery on live plants, planning changes around your outage windows and bringing safety review into anything touching protective systems.
Audit and Assessment Support
Preparation for supervisory engagement or customer audit, including evidence organization, mock assessment and response support. Essential entities face proactive supervision, so readiness is not optional once you are in scope.
How we work
| Phase | What happens |
|---|---|
| Scoping | Applicability, entity classification and member state exposure. Delivered as a written position you can act on and defend. |
| Assessment | Gap assessment against Article 21, passive and non-disruptive by default. Active testing only on specific assets with your explicit authorization. |
| Prioritization | Findings sequenced by consequence and effort, separating what needs an outage from what does not. |
| Implementation | Delivery support inside your change windows, with safety review where protective systems are affected. |
| Evidence | The documentation that demonstrates compliance, handed over in a form you can maintain. |
- A written applicability position stating whether and how NIS2 reaches you, with the reasoning.
- An asset inventory in a format you can maintain, not a PDF appendix.
- A gap register against the ten Article 21 measures, with evidence and a stated rating method.
- A sequenced remediation plan with effort estimates and outage requirements flagged.
- Incident reporting procedures, templates and a tested escalation path.
- Governance evidence supporting Article 20 approval, oversight and training.
- For vendors, a versioned supplier evidence pack and answer library.
We are not a compliance software vendor and we do not resell GRC platforms. If you are looking for a tool to automate evidence collection, we can tell you what the tool needs to produce, but we will not sell you one and we have no commission riding on which you choose. Our work is the assessment, the architecture and the evidence. Tooling decisions stay yours.
Most NIS2 advisory comes from IT compliance firms applying a corporate framework to an industrial environment. The Article 21 measures land very differently on a running plant: you cannot patch a turbine on a Tuesday, you cannot scan a Level 1 controller, and multi-factor authentication on an engineering workstation has consequences a corporate assessor will not anticipate.
We work on live industrial assets. Our consultants hold functional safety credentials alongside OT security certification and work to IEC 62443, which means our recommendations account for what a security change does to a safety case rather than treating the two separately. We operate across the US, Canada and the Gulf. See our case studies and our wider OT cybersecurity services.
Common Questions
Not sure whether NIS2 reaches your organization?
Start with a scoping assessment. We establish whether NIS2 applies to you, by which route, and in which member states, and deliver a written position you can act on. It is a short engagement and it frequently narrows the work substantially.