ISOPlanner™ is Trusted By 600+ companies
Supporting 50+ Standards
Risk assessment and controls recorded in one place, with an owner and a status.
Incident registration with the deadlines built in, so the clock is not tracked by hand.
Reporting that can be shown to the board without anyone assembling it first.
Evidence gathered at the moment the work happens, not afterwards.
What the law asks
You assess the risks to your network and information systems and take appropriate measures. The list of measures in the law is a minimum, not a complete enumeration: what counts as appropriate depends on your risk profile.
How ISOPlanner™ helps
The risk assessment and the controls sit in one place, each with an owner and a status. Because "appropriate" depends on your own risk profile, you record for each control why you made that choice and why another control was not needed. That justification is exactly what a supervisory authority asks for, and it is already there. All inside your own Microsoft 365 environment, under your own access control.
What the law asks
Organisations that fall under the law register with the government, through the portal their member state provides.
How ISOPlanner™ helps
You register yourself, with your national authority. ISOPlanner™ does not take that over, and it should not. What the software does do is hold the justification: which sector list you land on, which threshold you test against, who established that and on what date. If something changes in your organisation that means the registration must be updated, that obligation sits as a task with a deadline in the same system, instead of in someone's head.
What the law asks
You report a significant incident within 24 hours as an early warning, followed by a fuller notification within 72 hours and a final report after that.
How ISOPlanner™ helps
The deadlines are built into the incident register. From the moment you record an incident, the clock runs visibly and you can see which notification is due when. Who filed the notification and what was reported sits with the incident itself. That means you write the final report from what was kept during the incident, instead of reconstructing it afterwards from mailboxes and chat messages.
What the law asks
This is the part that is most often underestimated. The Dutch supervisory authority puts it this way: "The board bears ultimate responsibility for governance and risk management." The law makes it possible to fine directors personally or to impose a penalty payment order. Compliance is therefore not a subject that can be left entirely to IT.
How ISOPlanner™ helps
A board can only take responsibility for what it can see. The reporting is built to be shown to the board without anyone assembling it first: which risks are open, which controls are behind, who owns them and what has changed since the last report. And because the evidence is recorded at the moment the work happens, that report reflects how things actually stand rather than a snapshot put together for the meeting.
01.
What is the difference between essential and important entities under NIS2?
NIS2 Article 3 divides in-scope organisations into two categories. Essential entities operate in critical sectors such as energy, transport, banking, health, and digital infrastructure. Important entities cover a broader set including postal services, waste management, food production, and digital providers. Essential entities face stricter supervision and higher maximum fines (up to €10M or 2% of global turnover). Important entities are subject to reactive supervision and lower maximum fines (€7M or 1.4%). ISOPlanner™ helps document the classification and governance obligations for either category.
02.
What security measures does NIS2 Article 21 require?
Article 21 requires appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks. These include policies on risk analysis, incident handling, business continuity, supply chain security, secure development practices, cybersecurity training, and multi-factor authentication. ISOPlanner™ maps each Article 21 requirement to your risk register and control framework so every measure is tracked and evidenced.
03.
What are the NIS2 incident reporting timelines?
NIS2 Article 23 introduces a three-stage reporting timeline. An early warning must reach the national CSIRT or competent authority within 24 hours of detecting a significant incident. A full incident notification with initial assessment follows within 72 hours. A final report with root cause analysis, impact, and applied mitigations is due within one month. ISOPlanner™ includes an incident response workflow that tracks each stage and generates the required notification records.
04.
How does NIS2 address supply chain security?
Article 21 explicitly requires organisations to assess and manage cybersecurity risks from their supply chain and supplier relationships. This includes evaluating the security practices of direct suppliers and service providers, and considering how vulnerabilities in third-party products or services could affect your own security posture. ISOPlanner™ provides a supplier register and assessment template to document and monitor third-party security obligations under NIS2.
05.
What are the penalties for NIS2 non-compliance?
NIS2 imposes significant administrative fines. Essential entities can be fined up to €10 million or 2% of total global annual turnover, whichever is higher. Important entities face maximum fines of €7 million or 1.4% of global turnover. Beyond financial penalties, NIS2 also introduces personal liability for senior management who fail to implement required security measures. ISOPlanner™ helps document governance accountability to reduce management exposure.
06.
How does NIS2 relate to ISO 27001?
ISO 27001 and NIS2 are highly complementary. The security measures required by NIS2 Article 21 closely mirror the technical and organisational controls in ISO 27001 Annex A. Organisations with a certified ISO 27001 management system are well-positioned to meet NIS2 obligations, since ISO 27001 audit evidence can directly support NIS2 compliance demonstrations. ISOPlanner™ cross-maps NIS2 Article 21 requirements to ISO 27001 Annex A controls so a single evidence base serves both frameworks.
07.
Which sectors fall within NIS2 scope?
NIS2 covers a much broader set of sectors than its predecessor. Highly critical sectors include energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure (cloud, data centres, DNS, trust services), public administration, and space. Additional critical sectors include postal services, waste management, chemicals, food production, medical device manufacturing, and digital providers such as online marketplaces, search engines, and social networks.
Log in to your ISOPlanner™ workspace, or start a free trial.
Log in Start your free trial