Entity classification
Essential or important? Which sectors, what size and turnover thresholds, which exemptions.
Greek Law 5160/2024 in force · Entity registration ongoing · Fines up to €10m
Check if you're in scope →
NIS2 · Directive (EU) 2022/2555 · Greek Law 5160/2024
NIS2: find out if you're in scope, and what it asks of you.
It isn't a technical standard. It's a legal obligation with deadlines, supervision, and personal liability of the management body. We start with the written classification — essential or important entity — then work through the measures, the 24-hour reporting, and what the supervisor actually asks for.
NIS2 (Directive (EU) 2022/2555, transposed in Greece by Law 5160/2024) is a legal obligation for essential and important entities, with fines up to €10m or 2% of turnover and personal liability for the management body (Article 20). KodeX GRC classifies your entity in writing, implements the Article 21 measures and sets up 24h/72h incident reporting, in about 8 weeks.
What it covers
The directive is organised at three levels: who's in scope, what they must do, and what happens if they don't. Each maps to a specific article and artefact.
Governance & board liability
Approval of measures, management training, oversight — and personal liability of the body.
Ten categories of measures
Risk analysis, incidents, continuity, supply chain, encryption, MFA, training.
Incident reporting
Early warning within 24h, notification within 72h, final report within 1 month.
Sanctions
Up to €10m or 2% of global turnover (essential), up to €7m or 1.4% (important).
Supervision & audits
What the authority asks for, how to prepare, which evidence proves compliance.
Who it's for
For organisations in the sectors of Annexes I or II — and for those who aren't sure. Classification is the first and often hardest step.
The classification rule: sector + size. If you operate in an Annex I or II sector, with 50+ employees or €10m+ annual turnover, you likely fall in scope.
There are exceptions — digital service providers regardless of size, single-person entities in specific sectors, public administration. The classification is written and reasoned — we deliver it as evidence.
Energy, transport, health, water — usually essential entities
Manufacturing, food, chemicals, digital services — usually important
ICT service providers — often regardless of size
Suppliers of essential entities with system access
Companies unsure whether they're in scope — let's settle it in writing
How we work
Four phases. The sequence is deliberate — classification precedes the measures, and the 24h reporting flow precedes the internal audit, because it's the most urgent obligation.
Classification
Essential or important
Mapping of sector, size, turnover and supplier relationships. Written, reasoned decision with legal basis.
1 weekArticle 21 gap analysis
The ten measures, one by one
Review of every sub-requirement of Article 21.2.a–j. Gap register prioritised by legal exposure, not by ease.
2 weeksImplementation & documentation
And board liability
Measures, policies, management approval minutes, board training record. Without these, compliance is a claim.
4 weeks24h reporting flow
The most urgent piece
Escalation flow, responsible person, templates, tabletop exercise. Without this, a fine is inevitable when an incident hits.
2 weeksYour obligations
The ten measures of Article 21.2, with priority level as it follows from the legal exposure each creates.
Measure
What it means in practice
Priority
21.2.a · Risk analysis
Methodology, register, acceptance criteria, periodic re-assessment.
Critical
21.2.b · Incident handling
Response process, roles, escalation, documentation, learning.
Critical
21.2.c · Business continuity
BCP/DR, backup, critical operations, testing, RTO/RPO.
Critical
21.2.d · Supply chain
Supplier register, assessment, clauses, relationship management.
Critical
21.2.e · Acquisition & development
Security in acquisition, development, maintenance — SDLC, code review, vulnerabilities.
High
21.2.f · Effectiveness assessment
Metrics, KPIs, internal audit, management review.
High
21.2.g · Cyber hygiene & training
Staff training, phishing, completion records, awareness.
High
21.2.h · Cryptography
Encryption of data at rest and in transit, key management.
Medium
21.2.i · HR & access control
Authentication, MFA, privileged access, offboarding, HR security.
Critical
21.2.j · MFA & secure communications
Multi-factor authentication, secure channels, emergency communication.
Critical
What you get
Six artefacts that prove compliance — not declare it. Each maps to a specific article that will be audited.
Written classificationReasoned essential / important decision, with legal basis and Annex reference.
Article 21 compliance registerEvery sub-requirement with status, owner, evidence, verification date.
Incident reporting policy24h / 72h / 1 month flow, responsible person, templates, authority channels.
Management approval minutesProof the management body approved the measures — explicitly required by Article 20.1.
Management training recordArticle 20.3 — mandatory training of the body. Often overlooked; a finding in audits.
Supervisory response planWhat the authority asks, who responds, with what evidence, within what timeframe.
Timeline — 8 weeks
NIS2 is faster than ISO 27001 because there's no certification — it requires documented compliance that holds up under supervision.
WK 01
Classification
Written essential / important decision, with legal basis and Annex reference.
WK 02–03
Gap analysis
Article 21.2.a–j review, gap register, prioritisation by legal exposure.
WK 04–07
Implementation & documentation
Measures, policies, management approval, board training, reporting plan.
WK 08
24h reporting test
Tabletop exercise, documentation, corrections, final delivery.
Frequently asked
The questions we hear before taking on NIS2 work — and the answers that usually aren't given.
Are we definitely in scope of NIS2?
If you operate in an Annex I or II sector, with 50+ employees or €10m+ annual turnover, likely yes. Digital service providers fall in scope regardless of size in many cases. Classification is written and reasoned — we deliver it as evidence, so you can defend it in an audit.
What is the difference between NIS2 and GDPR?
Different scope, different authority. GDPR covers personal data and is supervised by the Hellenic DPA. NIS2 covers network and information system security and is supervised by the National Cybersecurity Authority. One breach can trigger both — with different deadlines (72h for GDPR, 24h for NIS2) and different reports.
What happens if we don't comply with NIS2?
Fines up to €10m or 2% of global annual turnover for essential entities (€7m or 1.4% for important ones), supervisory audits, administrative sanctions — and most importantly: personal liability of the management body under Article 20. That means board members can be held personally accountable for failing to approve or oversee the measures.
How fast do we need to move on NIS2?
Yesterday. Law 5160/2024 is in force and authorities have begun registering entities. If you haven't done a written classification, you don't know if you're in scope — and that's the first finding in any audit. Classification is one week of work.
Do we also need ISO 27001 for NIS2?
Not mandatory, but it helps significantly. Around 85% of Article 21.2 measures map to ISO 27001 controls. If you intend to pursue both, NIS2 first — it's more urgent — and ISO 27001 follows with reduced effort, because the evidence is already there.
Related services
NIS2 rarely stands alone. It usually combines with the following, because they share artefacts, technical measures and board liability.
01 · ISO 27001
The framework that covers it
85% of Article 21 measures map to ISO 27001 controls. One system, two compliances.
08 · vCISOGovernance & board
For the ongoing liability of the management body, supervisory communications, and board reporting.
02 · ISO 42001If you use AI
NIS2 doesn't exempt AI systems from security measures. AI governance adds evidence that's also asked for under Article 21.
Get started
Free gap analysis in two weeks.
A gap register prioritised by legal exposure, a costed 8-week roadmap, and an executive summary for the board. No commitment — you can hand it to another consultant if you prefer.
No commitment
Confidential
Greek or English