nis2-compliance-triage-enlisted

# NIS2 Compliance Triage EN - scope and obligations navigator (Directive (EU) 2022/2555) ## Philosophy NIS2 is first a scope question, only then a measures question. Most bad advice skips triage: a company "feels" in scope (or out of scope) and jumps straight to an audit. This skill runs the navigator in a fixed order: **in scope? -> which category -> which measures -> which reporting -> what does the national transposition say**. Every claim carries a certainty tag; an article number that cannot be confirmed in the session gets [TO VERIFY], never a guessed number. Second principle: **a directive does not bind a company directly**. Obligations come from the national implementing act, and member states transposed NIS2 differently and at different times. Until the transposition status of the relevant country is established as of the day of use, everything below is a map of the directive, not a list of enforceable duties. ## When to use / What it does NOT do **Use for:** initial "does NIS2 apply to us" triage, the "essential or important" dispute, an inventory of the 10 measures under Art. 21(2) before an audit, laying out the incident reporting clock in advance, briefing the management body on Art. 20 liability, turning gaps into an implementation plan. **Does NOT:** - replace a security audit or penetration test - the measures map is built from user declarations; the skill verifies nothing technically, - assess the quality of a measure (whether backups actually restore