Security NIS2 Compliance Services

The NIS2 Directive expands cyber security obligations for organisations providing essential and important services across the European Union. For many organisations, the challenge is not simply understanding the regulation. It is translating legal and regulatory expectations into clear governance, policies, processes and security improvements that work across the business.

KDDI Europe helps organisations assess their current position, identify priority gaps and develop a practical, risk-based roadmap towards NIS2 readiness. Our support combines governance and compliance expertise with practical cyber security experience, helping executive, risk, security and IT stakeholders move from uncertainty to structured action.

NIS2, formally Directive (EU) 2022/2555, is the European Union’s framework for strengthening cyber security and operational resilience across a broader range of critical and important sectors. It replaces NIS1 and introduces wider scope, more detailed cyber security risk-management expectations, stronger supervision and greater management accountability.

At a practical level, NIS2 focuses on four key areas that organisations should address as part of their cyber security and compliance programme:

• Broader organisational scope.
  NIS2 brings more sectors and sub-sectors within cyber security regulation. Applicability depends on factors such as the services an organisation provides, its size, its sector and the national law that implements the Directive.
• Cyber security risk-management measures.
  In-scope organisations are expected to adopt appropriate and proportionate measures across areas such as incident handling, business continuity, supply chain security, secure acquisition and development, security hygiene, training, cryptography, human resources security and multi-factor authentication.
• Management accountability.
  Senior management is expected to oversee cyber security risk-management measures and develop sufficient awareness to understand and manage cyber risk. This makes NIS2 a governance and business leadership issue, not only an IT responsibility.
• Incident reporting. 
  Organisations need defined processes for assessing and reporting significant incidents to the relevant national authority or CSIRT. The Directive includes staged notification expectations, including an early warning and subsequent reporting.

Determining applicability is a critical first step. NIS2 identifies sectors and entity categories at EU level, while each Member State implements the Directive through national legislation. Organisations operating across multiple countries may therefore need to consider the rules and competent authorities in each relevant jurisdiction.

Essential entities generally include qualifying organisations in highly critical sectors. Depending on the applicable criteria and national implementation, these may include:

• Energy, transport and financial infrastructure.
  Organisations supporting essential economic and societal functions may be in scope because disruption could have significant cross-sector consequences.
• Health, water and public administration.
  Entities delivering critical public or societal services may face enhanced governance, risk-management and supervisory expectations.
• Digital infrastructure and ICT services.
  Certain digital infrastructure providers, managed service providers and managed security service providers are specifically relevant to the scope of NIS2.

Important entities include qualifying organisations in other critical sectors and medium-sized or large organisations in specified areas. Examples may include:

• Manufacturing. Specified manufacturing activities, including certain pharmaceutical, electronic, optical, machinery and vehicle-related operations, may fall within scope.
• Digital providers, postal services and research. Organisations in these sectors should assess their activities, size and jurisdiction rather than relying only on a broad sector label.

KDDI Europe can help assess your organisation’s services, sector, size and operating footprint to support an initial understanding of potential NIS2 scope. This does not constitute legal advice. Final applicability and legal obligations should be confirmed with qualified legal adviser and, where appropriate, the relevant competent authority.

• Different national requirements.
  The Directive is implemented through national legislation, so organisations operating in several countries may need to manage different timelines, authorities and detailed requirements. A country-by-country view helps avoid treating NIS2 as a single uniform checklist.
• Limited visibility of current readiness.
  Policies and controls often exist across different teams, systems and business units. Without a structured assessment, it can be difficult to determine whether requirements are fully addressed, consistently implemented and supported by evidence.
• Unclear governance and accountability.
  NIS2 increases management involvement, but decision rights, reporting lines and risk ownership may not yet be sufficiently defined. Governance needs to connect leadership oversight with practical security and compliance activity.
• Supply chain complexity.
  Third-party relationships can create operational and information-security dependencies. Organisations need a proportionate approach to supplier due diligence, contractual expectations and ongoing monitoring of critical providers.
• Incident notification readiness.
  Meeting reporting expectations requires more than an incident response plan. Teams need clear thresholds, decision-making responsibilities, evidence collection and escalation pathways that connect technical response with legal and regulatory communication.
• Competing priorities and limited resources. Not every gap can be addressed at once. Risk-based prioritisation helps organisations distinguish urgent foundational actions from longer-term maturity improvements.

Our modular service portfolio supports organisations from initial scope determination through assessment, remediation planning and ongoing governance. Services can be tailored to the organisation’s size, risk profile, operating model and national obligations.

Our modular service portfolio supports organisations from initial scope determination through assessment, remediation planning and ongoing governance. Services can be tailored to the organisation’s size, risk profile, operating model and national obligations.

• Governance and management oversight. We examine how cyber risk is governed, including roles, responsibilities, oversight arrangements, decision-making and reporting to senior management.
• Risk management. We review how cyber risks are identified, assessed, treated, accepted and monitored, and whether the approach reflects business-critical services and dependencies.
• Information security policies and procedures. We examine relevant documentation for completeness, consistency, ownership, approval, communication and practical adoption across the organisation.
• Incident handling and reporting. We review incident response arrangements, escalation, classification, reporting responsibilities and coordination with legal, communications and regulatory stakeholders.
• Business continuity and crisis management. We assess how the organisation prepares for disruption, maintains critical services and recovers systems and operations.
• Supply chain security. We review third-party risk governance, supplier due diligence, contractual security expectations and monitoring of critical suppliers.
• Security awareness and human resources security. We examine awareness, role-specific training, management education and relevant workforce security processes.
• Technical and operational controls. Selected evidence may be reviewed across areas such as identity, authentication, monitoring, secure configuration, vulnerability management and protection of network and information systems.