NIS2 before the law arrives

If you have been told “we’ll deal with it when the law passes”, this note is for you. It is not a legal explainer. It is the platform translation of the Article 21 measures: detection, identity, signed artifacts, logs you can query at three in the morning, and a report a board member can read without a translator.

None of what follows depends on the final wording in the BOE. Signatures, MFA, rehearsed restores and a 24-hour clock that actually starts are hygiene. The Spanish text may change the stamp and the authority; it will not give back the month you did not spend on being able to ship without a personal key.

Where the law actually is, in three sentences

Spain missed the 17 October 2024 transposition deadline (Art. 41 of Directive (EU) 2022/2555). On 14 January 2025 the Council of Ministers approved the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad; as of 26 August 2026 there is no law in the BOE and no notified complete transposition.

The Commission sent a letter of formal notice on 28 November 2024, a reasoned opinion on 7 May 2025, and on 8 July 2026 referred Spain to the Court of Justice in case INFR(2024)0270, asking for a lump sum and daily penalties until complete transposition is notified.

That is a case against the State, not a stay for your platform. Implementing Regulation (EU) 2024/2690 already specifies the Article 21 measures for digital infrastructure and ICT service management, and it applies without transposition. Waiting for the BOE is a calendar problem: signing artifacts, federating CI and rehearsing a restore take longer than the parliamentary process now has left.

One circulating claim is false: Real Decreto-ley 7/2025 does not transpose NIS2. It is the electricity package after the 28 April 2025 blackout, and it was repealed. Do not treat it as “part of the law already landed”.

Are you in scope — size, sector, and the one people miss

The size gate, short: if you operate in an Annex I or II sector and you exceed the small-enterprise ceiling in Recommendation 2003/361 — 50 people, or both turnover and balance sheet above €10M — you are in. Some types are in regardless of size (trust services, TLD, DNS, certain public administration). The annexes cover energy, transport, banking, health, water, digital infrastructure, B2B ICT management, public administration, space, and in Annex II postal, waste, chemicals, food, certain manufacturing, digital providers and research.

The one people miss is not in your CNAE. It is in the contract. Article 21(2)(d) requires whoever is in scope to look at the security of their direct suppliers. If you sell SaaS to a hospital, an operator or a ministry, Article 21 will arrive as a schedule, with audit rights, notice windows and MFA. You are not an essential entity; you operate as if you were. That is how NIS2 reaches 30-person companies that “are not in the annex”.

The 24h / 72h / one-month clock is a detection problem

Article 23 does not ask you for a PDF. It asks for an early warning within 24 hours of becoming aware, an incident notification within 72 hours with a first assessment and indicators of compromise, and a final report within a month. The legal clock starts when you become aware. The clock that matters starts when it happens. If you find out from a customer, you can still meet the legal deadline and have failed anyway: the early warning is no longer early for anybody.

You cannot file an early warning in 24 hours if the first human who finds out is outside your on-call. That is not fixed with a Confluence template. It is fixed with alerts that earn the page — the subject of alerts that earn the page: customer-visible impact, not CPU; a destination that wakes a person; a runbook that says who files, to which CSIRT (INCIBE-CERT or CCN-CERT), and with what.

The proof that the clock exists is not the procedure. It is a drill: a fake incident, timed, with the template filled and the filing channel used. If that sounds frightening, the fear is the data point.

Supply chain: verification, not a signed supplier declaration

Article 21(2)(d) and 21(3) are not satisfied by a supplier PDF that “meets ISO”. They ask you to take into account each direct supplier’s vulnerabilities and the quality of their practices, including how they develop. A signed declaration is not that. An artifact you can verify is.

• Image by digest, never by a moving tag.
• Signature and provenance: you know which pipeline built it and from which commit.
• SBOM published with every release, not an annual inventory in a spreadsheet.
• Pinned dependencies and base; a rebuild of production reproduces the digest.

That is the same contract we already use for one path to production, written up in one path to production. NIS2 does not ask you for a second compliance pipeline. It asks that the one you already have refuse a binary with no origin.

Access and identity: MFA everywhere, nothing that outlives the job

Article 21(2)(j) asks for multi-factor or continuous authentication. 21(2)(i) asks for access control and asset management. Together, on a real platform, they mean this:

• MFA enforced at the IdP for humans, including emergency access.
• No long-lived credentials in CI. Federated identity per job, a read-only plan role, an apply role only from the main branch.
• Inventory of human console users and of access keys, with dates. Anything without a rotation date is debt.
• A break-glass role: short session, two people, an audit trail. It exists so nobody uses a shared user in secret.

The infrastructure-as-code version of this — credentials that do not outlive the job, policy over the plan — is in Terraform without heroes. NIS2 does not introduce a new control. It turns into a duty what was already the only design that does not leave a hole the day somebody leaves.

Traceability: tamper-evident, centralised, queryable at 03:00

The Article 23 final report asks for description, severity, likely cause and measures. That can only be written if the logs are still there and if somebody who did not design them can query them. Retention is not compliance: retaining and being unable to query is a dead archive.

• One collector, not a different log per service on each node’s disk.
• Integrity: the on-call operator cannot rewrite the past without leaving a mark. Object lock, or a store the app has no delete on.
• Retention long enough to reconstruct a month, which is what the final report asks for, with headroom.
• Three saved queries: “what changed”, “who accessed”, “what failed for the customer”. If they take more than five minutes, they are not a system of record, they are a project.

Continuity: backups that have been restored, not backups that exist

Article 21(2)(c) names backups, recovery and crisis. A bucket with objects is none of the three. The evidence is a restore that was done, timed, with an owner, in the environment that matters — or in one identical in shape — and written up the same day, not the month after.

Short question for the next committee: when was the last restore, what was restored, how long it took, and whether the person leaving next week is the only one who would know how to repeat it. If the answer is silence, that is the gap, not the annex.

Management responsibility is personal — the report the platform should already produce

Article 20(1) says the management body approves the Article 21 measures, oversees implementation, and can be held liable for infringements. In a 50-to-250 person company that is not a new role: it is that somebody on the board receives a report that does not depend on an engineer having a free afternoon.

The report, generated from the same sources as production, not rebuilt on a slide:

1. Open significant incidents: detection, awareness, customer impact, status.
2. Detection and restore time for the last quarter, and whether the 24h early-warning path was drilled.
3. Vulnerabilities past SLA, by service, with owner.
4. Last backup restore: date, scope, duration, who authorised it.
5. Privileged access: human console users, access keys older than 90 days, MFA coverage.
6. Supply chain: unsigned artifacts still reaching production; suppliers without a named owner.
7. Training: last session of the management body; share of staff overdue.
8. Residual risks the board is accepting this quarter, named and dated.

If that pack cannot come out of the platform on a Friday afternoon, Article 20 is not covered, even if the board minutes say “we were informed”.

Where this breaks

• The contractual clause treated as compliance. Signing that “the supplier meets NIS2” does not produce a digest, an SBOM or a restore. It is risk transferred on paper and retained in the incident.
• The 24h alert treated as informational. If it does not page, the operational clock does not start. An email to a list that gets read on Monday is not an early warning.
• The vulnerability scan nobody triages. A permanently red dashboard is not 21(2)(e). A ticket with an SLA, an owner and a close date is.
• Waiting for the Spanish text so you do not have to sign artifacts. The implementing regulation already exists for part of the digital annex; the rest is hygiene you were going to need anyway.

Artifact: a gap checklist, one line per measure

One row per letter of Article 21(2), plus the Article 23 clock and the Article 20 report. The column that matters is where the evidence lives in your repo — or the system of record, if it is not in git. If a reviewer who does not own the system cannot open that path in five minutes, it is a gap.

This is not legal advice. It is the map we use when somebody asks “are we compliant?” and the honest answer is still a list of paths.

Ask us for the NIS2 technical gap checklist. Two lines about your stack, and we send back what you already cover and what you do not.