NIS2 in depth (Art 21 measures, Art 23 reporting, Art 20 board)¶
The law behind the baseline¶
By the time you reach NIS2, you have already done most of the work to satisfy it. Choosing CyFun Important (Lesson 3.1) and operating it, and pursuing ISO 27001 (Lesson 3.3), was not a separate exercise from the law: the CCB built CyFun as a recognised route to NIS2 conformity, so selecting and running the socle already covers the bulk of what NIS2 demands. This Lesson shows you the law sitting behind that baseline, and adds the two things the frameworks do not hand you: an incident-reporting clock (Article 23) and duties on your board (Article 20). You still need to know the directive itself, because a regulator does not audit your CyFun label; it checks whether you meet NIS2.
Article 21: the risk-management measures¶
Article 21 requires "appropriate and proportionate technical, operational and organisational measures" and lists the categories they must cover. They are not exotic; they are the socle, and each maps to a risk Scaldimet already has:
| Article 21 measure | The risk it addresses, at Scaldimet |
|---|---|
| Risk-analysis and information-system security policies | Acting blind: no view of what could go wrong (Module 4) |
| Incident handling | A compromise spreads and remains unaddressed because no one runs a response |
| Business continuity and backups, crisis management | A ransomware hit halts the line with no tested recovery |
| Supply-chain security | The SCADA/MES vendors' remote support and software updates, with no assurance over their own security |
| Security in acquisition, development and maintenance | Buying or changing systems without security built in |
| Policies to assess the effectiveness of measures | Assuming controls work without ever testing them (Lesson 3.6) |
| Basic cyber hygiene and training | Staff at both sites enabling avoidable attacks |
| Cryptography and encryption | Customer design data exposed in transit or at rest |
| Human-resources security, access control, asset management | The unowned systems and accounts from Module 2 |
| Multi-factor authentication and secured communications | Stolen credentials giving an attacker easy entry |
Every one of these measures is already in the CyFun Important baseline you selected in Lesson 3.1. That is not a coincidence: CyFun was assembled to cover exactly this common risk and calibrated as a NIS2 conformity route, so choosing and operating the socle already met the bulk of Article 21. The table shows the law behind the controls you adopted. It is not a fresh list of work to do.
Article 23: reporting a significant incident¶
NNIS2 turns incident reporting into a time-bound control, with deadlines that must be managed. When an entity suffers a significant incident, it must notify its national authority on a defined timeline:
- Within 24 hours: an early warning, flagging that a significant incident has occurred and whether it looks like the result of unlawful or malicious action.
- Within 72 hours: a fuller incident notification, with an initial assessment of severity, impact and any indicators of compromise.
- Within one month: a final report with a detailed description, the type of threat, mitigations applied, and any cross-border impact. (Interim and progress reports may be required in between.)
Reporting is itself risk management. Fast notification lets the authority warn others and offer help, and it limits the regulatory damage: a missed or late report is its own breach, separate from the incident. Scaldimet therefore needs a reporting procedure defined and tested, before an incident.
Article 20: the board¶
NIS2 also places duties directly on the board (Article 20): management bodies must approve the measures, oversee them, and can be held liable, and members must be trained. This is the legal force behind the governance work of Module 2, and Module 6 covers it in full from the board's side. The point for the baseline: it is not a purely technical matter the CISO owns alone; directors approve and answer for it.
Where Scaldimet fails Article 21 today
The sharpest gaps map straight onto the list: supply-chain security (no assurance or contractual security duties over the OT vendors' remote support and updates), access control and asset management (the unowned OT, and the contractor's unmonitored access), business continuity (untested backups, nothing at Beta), and policies to assess effectiveness (no testing of any control).
Application: the reporting clock, and what is left to do¶
On paper, two tasks.
-
The reporting clock. A ransomware attack hits Site Alpha on a Monday morning, encrypting the ERP and halting order processing; early signs suggest it was deliberate. Scaldimet is a NIS2 important entity. Write what Scaldimet must send its national authority and by when: name the three deadlines and one line on what each report contains.
-
A judgement call. True or false, and why: "Scaldimet adopted CyFun Important, so its NIS2 obligations are met."
Model answer (open after you've drafted yours)
A workable answer to (1): within 24 hours, an early warning that a significant, apparently malicious incident has occurred; within 72 hours, a notification with an initial assessment of severity, impact and any indicators of compromise; within one month, a final report with a full description, the threat type, mitigations and any cross-border impact. This clock is the part CyFun and ISO do not hand you: it is a procedure to build and rehearse before an incident, because a missed or late report is a breach in its own right.
For (2): false, but for an instructive reason. Adopting and operating CyFun Important covered most of Article 21, the measures, so the selection work of Lessons 3.1 to 3.3 was already most of the compliance work. But NIS2 is more than its control list: Article 23 requires the reporting procedure above, and Article 20 requires the board to approve, oversee and be trained. Those are a process and a governance duty, not controls you satisfy by adopting a framework. Choosing the baseline did the bulk; the reporting clock and the board duties are what remain.
Key takeaway
NIS2 is the law the frameworks satisfy. Article 21 requires risk-management measures that read like Scaldimet's own gap list (supply chain, access control, continuity, testing, hygiene, cryptography, MFA), so the socle and the law overlap by design, and each measure is adopted for the risk it addresses. Article 23 makes reporting a timed control: early warning within 24 hours, notification within 72 hours, final report within one month, with late reporting a breach in itself. Article 20 makes the board approve, oversee and answer for it all.
Next: Lesson 3.4.B · Cross-border: Belgium (CCB) vs France (ANSSI) →