NIS2 Compliance Is a Live Infrastructure Problem. Most Businesses Still Run It Like a Spreadsheet

NIS2 compliance can't be run from a spreadsheet updated before each audit. The directive expects continuous risk management, incident reports within hours and security across your supply chain, which only works when the evidence comes from the infrastructure itself. When systems produce that evidence as they run, an auditor's or a client's question can be answered from records that already exist.

What NIS2 compliance actually requires

NIS2 replaced the EU's original Network and Information Systems Directive with a wider scope and sharper teeth. The European Commission set 17 October 2024 as the deadline for member states to write it into national law, and the directive makes top management accountable when an organization fails to meet its cybersecurity risk management measures.

The scope is the part that catches service businesses off guard. The Commission's NIS2 FAQ lists ICT service management, meaning managed service providers and managed security service providers, among the sectors of high criticality. It also sets a size rule: all medium and large companies in the listed sectors are in, and member states may add smaller ones with a high risk profile. If you are an MSP with EU clients, NIS2 compliance is your problem as well as theirs.

The same FAQ says the directive gives every company in scope a list of 10 key elements to address, including incident handling, supply chain security, vulnerability handling and disclosure, and the use of cryptography and, where appropriate, encryption. For NIS2 compliance, each of those is something your systems do, not something a document says.

The penalties for failing NIS2 compliance follow the GDPR model. According to the same Commission FAQ, member states must allow maximum fines of at least 10 million euros or 2% of total worldwide annual turnover for essential entities, whichever is higher, and at least 7 million euros or 1.4% for important entities. The directive also adds liability for people in senior management positions.

The NIS2 compliance reporting clock

The reporting duties are what break spreadsheet workflows. Under the timelines the Commission describes, an affected organization must:

• send an early warning within 24 hours of becoming aware of a significant incident;
• file an incident notification within 72 hours;
• deliver a final report no later than one month after that.

Twenty-four hours is not enough time to discover an incident by someone happening to notice a dashboard. Detection has to be automated, and the facts the report needs have to already exist.

For digital service providers, the rules got more specific in October 2024, when the Commission adopted implementing rules that set out the technical requirements for risk management measures and define when an incident counts as significant. The list of providers covered includes managed service providers and managed security service providers.

NIS2 compliance terms in plain words

Essential and important entities

The two categories companies in scope fall into. The Commission's FAQ says they face different supervisory regimes and different fine ceilings; the duties to manage risk and report incidents apply to both.

Significant incident

An incident that could cause significant disruption or damage, in the words of the Commission's NIS2 page. This is what starts the 24-hour clock.

Early warning

The first report, sent within 24 hours to the national CSIRT or competent authority. The FAQ notes it also lets the company ask for guidance on mitigation.

Main establishment

For managed service providers, cloud and data centre providers and similar cross-border services, the member state of their main EU establishment has jurisdiction. Providers without one must designate a representative in the EU.

Enforcement is catching up

Member states were slow to set national rules for NIS2 compliance, and the Commission has been moving them along one step at a time.

1. Jan 2023 NIS2 enters into force. The Commission notes it came into force in January 2023.
2. 17 Oct 2024 Transposition deadline. Member states had until this date to write NIS2 into national law, and the Commission adopted the implementing rules for digital providers the same day. The original directive was repealed from 18 October 2024.
3. 28 Nov 2024 Infringement procedures. The Commission opened infringement procedures against 23 member states for failing to fully transpose NIS2.
4. 7 May 2025 Reasoned opinions. The Commission sent reasoned opinions to 19 of them.
5. 20 Jan 2026 Targeted amendments proposed. As part of a cybersecurity package, the Commission proposed amendments to NIS2 to increase legal clarity and simplify compliance. They still have to pass the Parliament and Council; as of November 2026 the European Parliament’s Legislative Observatory lists the file as awaiting committee decision.
6. 8 Jul 2026 Court referrals. After this note was first published, the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice and asked for financial sanctions.
7. 17 Oct 2027 First review due. The FAQ says the Commission reports on how the directive is working for the first time by this date.

The direction is clear. National laws are arriving, regulators are being given the tools to supervise, and NIS2 compliance is moving from a future project to a present obligation. The proposed amendments would change details of NIS2 compliance, not the core duties to manage risk and report incidents.

Why spreadsheets fail NIS2 compliance

The familiar workflow goes like this: keep a spreadsheet of controls, update it before the audit, collect screenshots from six systems, and hope nothing changed between the last review and the auditor's visit. That was tolerable when compliance meant passing an annual check.

It can't support continuous risk management, a 24-hour early warning or ongoing supplier oversight. If your systems weren't designed to produce evidence, you end up paying people to reconstruct it every audit cycle, and the reconstruction is only true for the day it was made.

A standalone monitoring tool helps with NIS2 compliance, but it has a limit. If the infrastructure underneath wasn't built with compliance in mind, the tool produces neat reports about a foundation that still doesn't meet the bar.

NIS2 compliance built into the infrastructure

When compliance is a property of the infrastructure rather than an audit exercise, a few things change.

• Controls live on the servers. Default-deny firewall rules, automated patching, encrypted secrets and access logging produce evidence as a byproduct of normal operation. The evidence collects itself.
• Detection is automated. Incident timelines depend on monitoring, not on someone noticing, which is the only way to hit a 24-hour window reliably.
• Isolation limits supply chain risk. Dedicated resources per client and no shared tenancy across customer environments put hard boundaries around what one incident can reach.

Why MSPs are in scope for NIS2 compliance

Supply chain security is one of the directive's biggest additions. The Commission says NIS2 requires companies to address cybersecurity risks in their supply chains and supplier relationships. Your clients' auditors will ask about you, which makes your architecture part of their NIS2 compliance evidence. An MSP that can hand a client its own logs, patch records and access history on request is easier to keep than one that has to assemble them.

Compliance is also a market access story

Treating compliance as an infrastructure capability does more than avoid fines. When a client, an insurer or a public buyer asks for proof, the answer already exists.

The same shift is visible in the United States. In March 2025 the General Services Administration announced FedRAMP 20x, a new approach to cloud security authorization built on automated validation and indicators that show security posture in near real time, replacing static yearly manual assessments. Regulators on both sides of the Atlantic are asking for evidence that machines produce, not documents people write.

We cover the US side of this in what continuous compliance means beyond a green dashboard and in the compliance assessment that pays for itself at insurance renewal.

How LTFI builds it

LTFI is run this way. Each company gets its own server, which Kief Studio hosts, patches and watches, with no other business’s data on it. Security monitoring, file integrity and compliance checks run on that server as part of the service, and every action by people and AI staff lands in the activity log, so the record exists before anyone asks for it. That is the kind of evidence NIS2 compliance asks for. Read how we watch the server, or talk to us about where your environment stands.

Frequently asked questions