NIS1 to NIS2: Telecom Delta Analysis

A strategic gap analysis module for transitioning from the 2016 directive to the 2022 enhanced framework.

The Strategic Shift

Focus Area	NIS1 (2016-2022)	NIS2 (2022-2026+)
Scope	Operators of Essential Services (OES) only.	Expanded to Essential and Important Entities across more sectors.
Governance	General organizational duty to comply.	Personal liability for management bodies (Article 20). CRITICAL DELTA
Supply Chain	General security of services.	Mandatory software/hardware vetting and SBOM visibility (Article 21.2.j). CRITICAL DELTA
Reporting	Notification within 72 hours.	3-Tiered: 24H Early Warning, 72H Notification, 1-Month Final Report. CRITICAL DELTA
Sanctions	N/A or Member State discretionary.	Fines up to €10M or 2% of annual turnover. CRITICAL DELTA

TOOL // NIS2_READINESS_CALC

Calculate your transition readiness score by toggling existing NIS1-era controls.

0%READINESS

Board Liability Training (Art 20)+20% to NIS2 Target

24H Early Warning Pipeline+25% to NIS2 Target

Supply Chain SBOM Vetting+15% to NIS2 Target

Zero-Trust Architecture+20% to NIS2 Target

PQC Readiness Audit+20% to NIS2 Target

PLAN // MIGRATION_CHECKLIST

Article 20 Executive Briefing

Secure board-level sign-off and initiate mandatory legal liability training.

Governance

Reporting Pipeline Overhaul

Implement automated 24-hour notification triggers to National CSIRTs.

Operations

Vendor Security Review

Update supplier contracts to include Mandatory Article 21.2 security clauses.

Supply Chain