NIS2 Implementation Roadmap: A Practical 12-Month Plan for Infrastructure Teams

NIS2 has been applicable since October 2024, and national transposition is underway across EU member states. Some countries are ahead (Belgium, Croatia, Hungary enacted their laws). Others are behind (Germany, France, and several others missed the October 2024 deadline). Regardless of your country's transposition status, the directive's requirements are clear, and supervisory authorities will enforce them. Here's your 12-month implementation roadmap.

Month 1-2: Assessment & Scoping

• Determine your classification — Are you Essential or Important? Check Annex I and II against your activities. Consider the size criteria (50+ employees or €10M+ turnover).
• Register with your national authority — Article 3(3) requires registration. Provide entity name, sector, contact details, IP ranges, and domains.
• Gap analysis — Audit your current cybersecurity posture against all ten Article 21 requirements. Document what exists, what's partial, and what's missing.
• Risk assessment — Identify critical systems and data. Map dependencies. Assess threats and vulnerabilities. Calculate risk levels.

Month 3-4: Quick Wins

• MFA everywhere — Deploy multi-factor authentication on all administrative interfaces, VPN, email, and cloud consoles. This is the single most impactful control.
• Backup verification — Test your backup restoration. Document RTOs and RPOs. Fix any gaps. Ensure backups are isolated from production.
• Asset inventory — Create or update your hardware, software, and data asset inventory. You can't protect what you don't know about.
• Incident response plan — Draft or update your incident response plan with NIS2 reporting timelines (24h/72h/1month).

Month 5-7: Core Infrastructure

• Network segmentation — Implement microsegmentation for critical systems. Deploy network monitoring for east-west traffic.
• SIEM deployment — Deploy or enhance SIEM with NIS2-relevant detection rules. Integrate all critical system logs.
• Encryption audit — Verify TLS configuration on all endpoints. Implement encryption at rest. Deploy key management solution.
• Vulnerability management — Implement continuous scanning across infrastructure, containers, and applications. Establish patching SLAs.
• Supply chain controls — Implement SBOM generation, container image signing, and admission control.

Month 8-9: Policies & Procedures

• Cybersecurity policies — Document risk management policy, incident handling procedures, access control policy, cryptography policy, business continuity plan.
• Training program — NIS2 Article 21(2)(g) requires cybersecurity training. Deploy security awareness training for all employees. Specialized training for IT staff.
• Supplier security assessment — Assess critical suppliers against security requirements. Update contracts with cybersecurity clauses.

Month 10-11: Testing & Validation

• Tabletop exercises — Run incident response tabletop exercises with management team. Test the 24-hour reporting procedure.
• DR testing — Conduct disaster recovery test. Verify RTOs and RPOs. Document results and remediate failures.
• Penetration testing — Commission external penetration testing of critical infrastructure. Address findings before supervisory review.
• Policy effectiveness assessment — Article 21(2)(f) requires assessing the effectiveness of your measures. Document evidence.

Month 12: Compliance Readiness

• Management review — NIS2 Article 20 holds management bodies accountable. Brief the board or management on compliance status.
• Evidence package — Compile compliance evidence: policies, test results, training records, incident reports, vendor assessments.
• Continuous improvement — NIS2 compliance isn't a one-time project. Establish ongoing monitoring, regular reviews, and continuous improvement processes.

What Open Empower Delivers

We accelerate this timeline. Our AI Platform Assessment maps directly to NIS2 gap analysis (months 1-2). Our Platform Design delivers the architecture (months 5-7). Our Implementation deploys the infrastructure (months 5-9). And our Continuous Advisory provides ongoing compliance support. From assessment to production in weeks, not months.