Network and Information Security Directive 2 (NIS2): Essential and Important Entities and Supply Chain Duties

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

A practitioner's map of Directive (EU) 2022/2555, from classifying essential and important entities across the Annex I and Annex II sectors to the ten Article 21 risk management measures, with supply chain security and vulnerability handling examined in depth, and the 24 hour, 72 hour and one month reporting timeline. It closes with management body accountability, supervision and penalties, then a 90-day plan for evidencing the programme with Software Bills of Materials, vulnerability management and supplier risk assessment.

What you'll learn

NIS2 Foundations: Scope, Entities and Sectors

From the First Directive to NIS2, and Why Transposition Matters
Essential and Important Entities: The Two-Tier Model
Annex I and Annex II Sectors, and the Size-Cap Rule

Article 21 Risk Management Measures

The Ten Article 21 Measure Categories and the Proportionality Principle
Supply Chain Security Under Article 21(2)(d)
Vulnerability Handling and Disclosure in Acquisition, Development and Maintenance

Reporting Obligations

The Three-Stage Timeline: 24 Hours, 72 Hours, One Month
What Counts as a Significant Incident
Cross-Border Reporting and National CSIRTs

01NIS2 Foundations: Scope, Entities and Sectors3 lessons

From the First Directive to NIS2, and Why Transposition Matters
Essential and Important Entities: The Two-Tier Model
Annex I and Annex II Sectors, and the Size-Cap Rule

02Article 21 Risk Management Measures3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Governance, Supervision and Penalties

Management Body Accountability and Personal Liability
Supervisory Regimes for Essential Versus Important Entities
Penalties and Enforcement Measures

Building the Evidence Programme

Evidencing Article 21 with Software Bills of Materials and Vulnerability Management
Supplier and Third-Party Risk Assessment
A 90-Day NIS2 Readiness Plan and Common Pitfalls

The Ten Article 21 Measure Categories and the Proportionality Principle

Supply Chain Security Under Article 21(2)(d)

Vulnerability Handling and Disclosure in Acquisition, Development and Maintenance

03Reporting Obligations3 lessons

The Three-Stage Timeline: 24 Hours, 72 Hours, One Month
What Counts as a Significant Incident
Cross-Border Reporting and National CSIRTs

04Governance, Supervision and Penalties3 lessons

Management Body Accountability and Personal Liability
Supervisory Regimes for Essential Versus Important Entities
Penalties and Enforcement Measures

05Building the Evidence Programme3 lessons

Evidencing Article 21 with Software Bills of Materials and Vulnerability Management
Supplier and Third-Party Risk Assessment
A 90-Day NIS2 Readiness Plan and Common Pitfalls2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.