NIS2 is not implemented overnight, but it is not an equation without a solution either. It has a clear order, with stages that follow one another logically and with deadlines set through the DNSC orders. When you approach them in context, the implementation becomes manageable. Here is the journey, stage by stage.
1. Registration with DNSC
The first official step is registration in the DNSC platform, with the entity's identification details and supporting documents. Based on them, DNSC issues the classification decision (it confirms you as an essential or important entity) and enrolls you in the OSE register. The registration details are updated whenever something relevant changes and are confirmed periodically.
2. The initial risk analysis
After the classification decision you have a short deadline (of the order of 60 days) to submit an initial risk analysis, according to the DNSC methodology. It estimates the disruptive effect of an incident on your services and helps confirm the target level.
3. The maturity self-assessment on CyFun
Next comes the maturity self-assessment of the security measures, using the CyFun framework, within 60 days of the confirmation of the risk assessment. You go through the controls across the six functions and receive a maturity score that shows exactly where you stand against the required level (Basic, Important or Essential). The result becomes the basis of the implementation plan. In practice, this initial step is also called the initial audit or gap analysis, as opposed to the internal audit after implementation.
4. Implementation of the measures
Based on the self-assessment, you implement the missing measures, prioritized by risk, and draw up the documentation and registers (assets, risks, incidents, suppliers, vulnerabilities and the rest). It is the stage with the most work, but also the one in which progress is most clearly visible, thus implementing the ISMS (Information Security Management System).
5. The internal audit and the external one
Before the official audit you carry out an internal audit, which checks the level of compliance following the implementation. Then comes the external compliance audit, performed by attested cybersecurity auditors. For essential entities, compliance audits are periodic (usually every few years), and between them you remain under supervision, with the obligation to make the maturity self-assessment available to DNSC on an annual basis.
6. Maintaining compliance
Compliance is not a single project, but a continuous management system and an organizational culture that you maintain: annual confirmations of the data, incident reporting within the deadlines, periodic review of risks, of registers and of plans, plus repeating the maturity assessment and any other new implementations, when the activity, the size of the organization or the risk context changes.
Each stage ends with something concrete: a decision, a signed document, a passed audit. Put together, you ultimately ensure cybersecurity and resilience at the level of the organization, in a continuous form, and we are by your side throughout the journey.