EU NIS2 Directive Compliance Playbook

Guide Origin: Community | ArcKit Version: [VERSION]

/arckit:eu-nis2 generates an NIS2 Directive (2022/2555) compliance assessment for entities in scope as essential or important operators in the EU, including French OIV/OSE obligations.

---

Inputs

Artefact	Purpose
Requirements (ARC-<id>-REQ-v1.0.md)	Service type and sector classification
Risk register	Cybersecurity risks and existing controls
Secure by Design	Existing security measures

---

Command

/arckit:eu-nis2 Assess NIS2 compliance for <entity and sector>

In Claude Code the overlay installs as its own plugin, arckit-eu, so the command is /arckit-eu:eu-nis2.

Output: projects/<id>/ARC-<id>-NIS2-v1.0.md

---

Assessment Structure

Section	Contents
Scope and Classification	Essential (Annex I) vs Important (Annex II) entity
French OIV/OSE Status	LPM designation and ANSSI obligations
Governance	Management body accountability (Art. 20)
Risk Management	10 minimum security measures (Art. 21)
Incident Reporting	24h early warning → 72h notification → final report no later than one month after the notification (Art. 23(4))
Supply Chain Security	Third-party ICT risk management
Vulnerability Disclosure	Coordinated disclosure policy
Enforcement	Supervisory authority (ANSSI for France)
Gap Analysis	Gaps with priority and NIS2 deadline

---

NIS2 Sectors (Annex I — Essential)

Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space.

NIS2 Sectors (Annex II — Important)

Postal/courier services, waste management, chemicals, food, manufacturing, digital providers (search engines, social networks, online marketplaces), research.

---

One-Page Workflow

Phase	Key Activities	ArcKit Commands
Discovery	Sector and entity classification	/arckit:requirements
Risk	Cybersecurity risk assessment	/arckit:risk
Assessment	NIS2 compliance assessment	/arckit:eu-nis2
French layer	ANSSI hygiene measures	/arckit:fr-anssi, /arckit:fr-ebios

---

Review Checklist

• Entity classification (Essential vs Important) determined with sector reference.
• French OIV/OSE designation assessed (LPM Article 22 for OIV).
• All 10 Art. 21 minimum measures assessed.
• Incident reporting pipeline ready: 24-hour early warning, 72-hour notification, final report no later than one month after the notification.
• Management body training and accountability documented.
• Supply chain ICT risk management programme in place.
• ANSSI as competent authority for France documented.

---

Key Notes

• France: NIS2 transposed via LPM (Loi de Programmation Militaire). OIV obligations are stricter than NIS2 minimums.
• CRA overlap: For product manufacturers, the CRA incident reporting obligations overlap with NIS2 — run /arckit:eu-cra.
• DORA for financial entities: DORA is a sector-specific Union legal act under NIS2 Article 4 (DORA Art. 1(2)). For the financial entities it covers, DORA's ICT risk-management, incident-reporting and supervision rules apply instead of NIS2 Articles 21 and 23 and Chapter VII (NIS2 recital 28) — run /arckit:eu-dora for those. NIS2 still applies to group entities or services in a NIS2 sector that DORA does not cover (Art. 4(1)), the entity can still be identified as essential or important under national law, and the DORA authority passes major-incident details to the NIS2 CSIRT, competent authority or single point of contact (DORA Art. 19(6)).