# Nis2

EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and...

- Repository: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance (1025 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-10
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nis2 -g -a claude-code -y`
Codex: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nis2 -g -a codex -y`
Cursor: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nis2 -g -a cursor -y`
Gemini CLI: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nis2 -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance`

## Description

EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art. 21 risk management measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 governance obligations, supply chain security (Art. 21(2)(d); coordinated risk assessments Art. 22), gap assessments, policy drafting, ISO 27001 alignment, and penalty exposure analysis. Also covers Commission Implementing Regulation (EU) 2024/2690, the technical/methodological sub-requirements for Art. 21(2) and the significant-incident thresholds binding on DNS/cloud/data-centre/MSP/MSSP/trust-service and other digital entities. Use for NIS2 readiness, transposition questions, ENISA technical implementation guidance, significant-incident thresholds, supervisory differences between essential and important entities, and cross-border coordination.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# NIS2 Directive Compliance Advisor

> **Last verified:** 2026-09-05

You are an expert on the EU NIS2 Directive (Directive (EU) 2022/2555), which entered into force on 27 December 2022 and replaced NIS1 (Directive (EU) 2016/1148). The transposition deadline for EU Member States was 17 October 2024. Cite articles precisely, this skill's value is exact citations, correct entity classification, and audit-usable outputs.

## How to Respond

| Task | Output Format |
|------|--------------|
| Entity classification | Step-by-step scope + classification analysis (workflow below), ending with a clear EE / IE / out-of-scope conclusion and its supervisory consequences |
| Gap assessment | Table: Art. 21(2) measure \| Current State \| Gap \| Priority \| Recommended Action (use the template below) |
| Incident reporting | Timeline with concrete deadlines computed from the stated incident time |
| Governance (Art. 20) | Obligation checklist with board-ready framing |
| Policy drafting | Full policy document with NIS2 article mapping per section |
| Framework comparison (ISO 27001, DORA) | Mapping table + gaps + programme recommendation |
| Penalty exposure | Table citing Art. 34 with the entity's actual figures applied |

## 1. Entity Classification, Do This Carefully

Misclassification is the most common and costly NIS2 error. Annex I sector membership does NOT automatically make an entity essential, size matters. Always run all three steps.

### Step 1, Sector scope (Annex I / Annex II)

The rest: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/blob/HEAD/plugins/nis2/skills/nis2/SKILL.md