The EU's NIS2 Directive came into force in October 2024. UK organisations with EU operations, EU customers, or supply-chain reach into EU "essential" or "important" entities are in scope. The UK is aligning its NIS Regulations 2018 to substantially mirror NIS2 intent. This is the practical 10-step checklist UK IT leaders need.
Who's in scope
Essential entities — energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure (cloud, DNS, IXPs), ICT service management, public administration, space.
Important entities — postal services, waste management, chemicals, food, manufacturing of certain products, digital providers (search engines, social platforms, online marketplaces), research.
UK-only firms with no EU operations are NOT directly in scope of EU NIS2 — but the UK NIS Regulations 2018 (currently being updated to align) impose similar obligations on UK Operators of Essential Services + Digital Service Providers.
Article 21 — the 10 risk-management measures
Every in-scope entity must implement these as a minimum:
- •1. Risk analysis + information system security policies
- •2. Incident handling — including reporting (24h initial, 72h significant)
- •3. Business continuity + backup management + crisis management
- •4. Supply chain security
- •5. Security in network + information systems acquisition, development, maintenance
- •6. Policies + procedures to assess effectiveness of cybersecurity risk-management
- •7. Basic cyber hygiene + security training
- •8. Policies + procedures regarding cryptography + encryption
- •9. Human resources security, access control policies, asset management
- •10. Use of multi-factor authentication + secured voice/video/text communications + secured emergency communications systems
The 10-step implementation checklist
- •1. Confirm scope — essential vs important entity classification.
- •2. Appoint a designated cyber accountable executive (board-level).
- •3. Run NCSC CAF (Cyber Assessment Framework) gap analysis Profile A or B as appropriate.
- •4. Document risk register + treatment plan.
- •5. Deploy MFA + encryption + identity governance across all critical systems.
- •6. Implement immutable backup + tested recovery (see immutable architectures).
- •7. Establish 24h initial + 72h significant incident reporting capability (in-house SOC or MDR partner).
- •8. Supply chain security — assess ICT third parties + maintain register.
- •9. Annual penetration testing + quarterly vulnerability scanning.
- •10. Board reporting + KPI tracking.
Penalties
Essential entities: up to €10M or 2% of global annual turnover, whichever is higher.
Important entities: up to €7M or 1.4%.
Personal liability for senior managers in some cases.
What Servnet does
Servnet supports UK organisations with NIS2 + UK NIS Regulations alignment across the technical control set. Engagement: 1) gap analysis against NCSC CAF (3-4 weeks), 2) prioritised remediation plan (1 week), 3) deployment of identified controls (8-16 weeks depending on scope), 4) ongoing managed detection + incident reporting capability.