Home/ Project plans/ NIS2 implementation
Example project plan

Project plan for a NIS2 implementation

This NIS2 implementation project plan covers 10 phases, 83 tasks, 30 weeks and an approximate €378,000 budget for a 350-employee machinery manufacturer. The plan addresses governance, authority registration, risk management, incident reporting, supply chain security, workforce training and IT/OT controls. It also assigns responsibilities, schedules tasks and establishes evidence for ongoing compliance.

  • 30 Weeks
  • 10 Phases
  • 83 Tasks
  • Budget approx. €378,000
Open this plan in PathHub Create your own plan

No sign-up · opens instantly

Your own project? The AI project plan generator builds a plan like this from a short description.

This is how the plan looks in PathHub: click through the tabs or tick off tasks.

app.pathhub.ai/try?example=nis2-enOpen live
Example plan

NIS2 Cybersecurity Compliance and Operational Resilience Implementation

This project will implement NIS2 requirements for a mid-sized machinery manufacturer with 350 employees, covering authority registration, governance, cybersecurity risk management, incident reporting, supply chain security, and workforce training. The work must align regulatory obligations with operational realities in both IT and production/OT environments. Security controls and process changes will be introduced in a way that protects manufacturing continuity and minimizes disruption. The project also establishes the evidence base and operating cadence needed for ongoing compliance.

Total Progress0%
30Weeks
0/10Phases
0/83Tasks
€378,000Budget
AI Recommendations KIAI Chat KIAI Tools KI

Phases

1

Phase 1: Applicability, Scope and Project Mobilization

Pending · 3W · 0/5
CISO / IT Security Manager
0

This phase confirms the manufacturer’s NIS2 applicability, defines the legal and operational scope, and establishes the governance needed to deliver the 12-month implementation. It also aligns management, IT, production, legal, and external parties on objectives, decision rights, and constraints.

Confirm NIS2 applicability, entity classification, essential service scope, and national implementation requirements with Legal, Compliance, and the competent authority
Oct 1 – Oct 5 5 days
Legal, Compliance and Data Protection Officer
Define the in-scope legal entities, production sites, IT services, OT environments, business processes, and critical third-party dependencies
Oct 1 – Oct 4 4 days
CISO / IT Security Manager
Appoint the NIS2 steering committee, workstream owners, escalation paths, and management decision rights
Oct 1 – Oct 2 2 days
Managing Director / Management Board
Approve the 12-month delivery roadmap, resource assumptions, implementation principles, and production change constraints
Oct 3 – Oct 5 3 days
Managing Director / Management Board
Prepare the authority engagement pack, including company details, contacts, preliminary scope, authority questions, and required registration information
Oct 8 – Oct 10 3 days
Legal, Compliance and Data Protection Officer
Build and validate the IT/OT asset inventory covering servers, endpoints, applications, network devices, PLC-related systems, engineering workstations, remote access routes, and unsupported legacy equipment
Oct 22 – Nov 1 9 days
IT Infrastructure and Application Owners / OT Engineering
Map critical business services, production lines, information flows, system dependencies, recovery priorities, and single points of failure
Oct 22 – Oct 29 6 days
Business Continuity, Quality and Risk Management
Assess existing cybersecurity policies, standards, procedures, technical configurations, operating records, and audit evidence against NIS2 requirements
Oct 22 – Oct 30 7 days
CISO / IT Security Manager
Review identity management, privileged access, remote maintenance access, authentication controls, account lifecycle processes, and access recertification
Oct 31 – Nov 6 5 days
IT Infrastructure and Application Owners
Assess vulnerability management, patching, endpoint protection, logging, monitoring, backup, recovery, and security testing practices across IT and OT
Nov 7 – Nov 15 7 days
IT Infrastructure and Application Owners / OT Engineering
Evaluate incident detection, escalation, evidence preservation, crisis communication, authority notification, and post-incident review capabilities
Oct 22 – Oct 26 5 days
Incident Response Team / SOC or MSSP
Identify critical suppliers for automation, software, maintenance, logistics, cloud services, managed IT, and remote engineering support
Oct 22 – Oct 26 5 days
Procurement and Supplier Quality Management
Review existing management and employee security training, completion records, role coverage, and production-specific awareness content
Oct 22 – Oct 24 3 days
HR and Learning & Development
Produce the consolidated NIS2 gap assessment, prioritized findings, control maturity ratings, evidence register, and remediation recommendations
Nov 16 – Nov 23 6 days
CISO / IT Security Manager
Define and approve the management accountability framework, including oversight duties, risk acceptance authority, reporting obligations, and management training responsibilities
Oct 29 – Nov 1 4 days
Managing Director / Management Board
Establish the cybersecurity governance model with committee terms of reference, workstream ownership, escalation thresholds, meeting cadence, and decision logs
Oct 29 – Nov 1 4 days
CISO / IT Security Manager
Complete and submit the NIS2 registration with the competent national authority, including entity information, services, security contacts, incident contacts, and required organizational details
Nov 2 – Nov 8 5 days
Legal, Compliance and Data Protection Officer
Create the controlled compliance evidence repository with document ownership, version control, retention rules, access restrictions, and evidence-indexing conventions
Oct 29 – Nov 1 4 days
CISO / IT Security Manager
Define the policy hierarchy covering information security, acceptable use, access control, vulnerability management, incident response, business continuity, supplier security, and training
Nov 2 – Nov 9 6 days
CISO / IT Security Manager
Review monitoring, employee-data, incident-recording, and security-investigation requirements with the Data Protection Officer and works council, where applicable
Oct 29 – Oct 31 3 days
Legal, Compliance and Data Protection Officer
Establish the NIS2 management dashboard with status indicators for risks, incidents, remediation, training, suppliers, testing, and audit evidence
Nov 12 – Nov 15 4 days
CISO / IT Security Manager
Define the NIS2 risk methodology, risk scoring model, impact criteria, likelihood scales, risk appetite, acceptance thresholds, and review requirements for IT and OT
Nov 26 – Nov 30 5 days
Business Continuity, Quality and Risk Management
Define asset criticality classes for production systems, safety-related systems, engineering environments, enterprise applications, data, and external services
Nov 26 – Nov 30 5 days
OT/Production Engineering and Plant Management
Develop threat scenarios for ransomware, malware propagation, compromised remote access, supplier compromise, production manipulation, data loss, and prolonged outage
Nov 26 – Nov 30 5 days
CISO / IT Security Manager
Conduct risk workshops with IT, production, engineering, procurement, quality, HR, and business owners for critical services and production processes
Dec 3 – Dec 12 8 days
CISO / IT Security Manager
Assess backup, recovery, resilience, segregation, access, vulnerability, supplier, and incident risks against the validated asset and dependency inventory
Dec 3 – Dec 11 7 days
IT Infrastructure and Application Owners / OT Engineering
Create and prioritize the enterprise cybersecurity risk register, linking each risk to affected assets, business impact, control gaps, owners, and proposed treatments
Dec 13 – Dec 20 6 days
CISO / IT Security Manager
Develop risk treatment plans with target controls, implementation deadlines, dependencies, resource needs, and temporary compensating measures for legacy OT
Dec 21 – Dec 31 7 days
CISO / IT Security Manager
Document formal risk acceptance and exception procedures, including management approval, expiry dates, compensating controls, and reassessment triggers
Nov 26 – Nov 28 3 days
Managing Director / Management Board
Establish quarterly risk reviews and event-driven reassessment triggers for major system changes, incidents, supplier changes, and production expansions
Nov 26 – Nov 28 3 days
Business Continuity, Quality and Risk Management
Implement prioritized identity and access improvements, including MFA for remote and privileged access, privileged account controls, joiner-mover-leaver procedures, and access recertification
Dec 17 – Dec 27 9 days
IT Infrastructure and Application Owners
Design and deploy an IT/OT network segmentation pilot covering production zones, engineering workstations, enterprise services, vendor access, and required communication paths
Dec 17 – Dec 28 10 days
OT/Production Engineering and IT Infrastructure
Create and approve production-safe firewall rule sets, network diagrams, exception records, rollback procedures, and plant change windows
Dec 31 – Jan 8 7 days
OT/Production Engineering and Plant Management
Implement controlled remote maintenance access with named accounts, approval workflows, time-limited access, session logging, MFA, and supplier accountability
Dec 28 – Jan 7 7 days
IT Infrastructure and Application Owners
Establish risk-based vulnerability and patch management for IT and OT, including asset ownership, vendor advisories, testing requirements, emergency patching, and compensating controls for unsupported systems
Dec 17 – Dec 26 8 days
CISO / IT Security Manager
Design and implement backup improvements for critical IT and production-support systems, including offline or immutable copies, backup monitoring, retention, and restoration priorities
Dec 17 – Dec 27 9 days
IT Infrastructure and Application Owners
Deploy or improve endpoint protection, centralized logging, alerting, and monitoring coverage for corporate endpoints, servers, engineering workstations, and critical OT support systems
Dec 17 – Dec 27 9 days
IT Infrastructure and Application Owners / SOC or MSSP
Harden baseline configurations for operating systems, network devices, administrator workstations, remote access gateways, and security appliances
Dec 17 – Dec 24 6 days
IT Infrastructure and Application Owners
Document secure change-management procedures for IT/OT security changes, including production impact assessment, testing, approval, rollback, and post-change verification
Dec 17 – Dec 20 4 days
OT/Production Engineering and Plant Management
Review email, web, malware, removable-media, and administrator workstation protections against identified ransomware and malware propagation paths
Dec 17 – Dec 20 4 days
CISO / IT Security Manager
Conduct a controlled pilot of the priority controls at one production area and one corporate IT environment, recording performance, incidents, and user feedback
Jan 9 – Jan 17 7 days
OT/Production Engineering and IT Infrastructure
Roll out approved controls to remaining in-scope environments according to the remediation roadmap and production change calendar
Jan 18 – Feb 1 11 days
IT Infrastructure and Application Owners
Validate control operation, update residual risks, and record exceptions, compensating controls, implementation evidence, and outstanding technical dependencies
Feb 4 – Feb 8 5 days
CISO / IT Security Manager
Define incident severity levels and reporting criteria for early warnings within 24 hours, incident notifications within 72 hours, and final reports within the applicable regulatory deadline
Dec 24 – Dec 28 5 days
Legal, Compliance and Data Protection Officer / Incident Response Team
Establish the 24/7 or agreed-hours escalation model, duty roster, management contacts, production contacts, supplier contacts, and authority communication responsibilities
Dec 24 – Dec 27 4 days
Incident Response Team / SOC or MSSP
Create incident response playbooks for ransomware, OT malware, compromised credentials, supplier compromise, data breach, production disruption, and loss of critical services
Dec 24 – Jan 4 10 days
Incident Response Team / SOC or MSSP
Develop authority notification templates, decision trees, contact records, evidence requirements, approval steps, and secure submission procedures
Dec 31 – Jan 4 5 days
Legal, Compliance and Data Protection Officer
Integrate security alerts from endpoint, network, identity, backup, firewall, remote access, and OT-monitoring sources into the incident triage process
Dec 24 – Jan 2 8 days
IT Infrastructure and Application Owners / SOC or MSSP
Define evidence preservation, forensic readiness, chain-of-custody, log retention, system isolation, and legal-hold procedures
Dec 24 – Dec 28 5 days
Incident Response Team / SOC or MSSP
Create supplier incident-escalation requirements, including notification channels, time limits, evidence expectations, and coordination with affected production sites
Dec 24 – Dec 27 4 days
Procurement and Supplier Quality Management
Define crisis communication procedures for management, employees, customers, regulators, insurers, law enforcement, and key suppliers
Dec 24 – Dec 27 4 days
Managing Director / Management Board
Establish incident metrics, post-incident review criteria, corrective-action tracking, and evidence retention requirements
Jan 7 – Jan 9 3 days
CISO / IT Security Manager
Classify suppliers by business criticality, access to IT/OT environments, data handled, production dependency, geographic exposure, and incident impact
Dec 31 – Jan 7 6 days
Procurement and Supplier Quality Management
Create a supplier cybersecurity questionnaire and evidence checklist covering governance, vulnerability management, incident reporting, access control, business continuity, subcontractors, and security certifications
Dec 31 – Jan 4 5 days
CISO / IT Security Manager
Identify and assess the highest-risk suppliers, including automation vendors, remote maintenance providers, software suppliers, cloud providers, and managed service providers
Jan 8 – Jan 17 8 days
Procurement and Supplier Quality Management
Update supplier contract templates with NIS2-relevant security requirements, 24/72-hour incident escalation expectations, audit rights, vulnerability disclosure, subcontractor controls, and recovery obligations
Dec 31 – Jan 8 7 days
Legal, Compliance and Data Protection Officer
Integrate cybersecurity due diligence, approval gates, risk exceptions, and evidence retention into procurement and supplier onboarding procedures
Dec 31 – Jan 4 5 days
Procurement and Supplier Quality Management
Review and restrict supplier remote access to production and corporate environments using named accounts, MFA, time-limited approvals, logging, and session review
Dec 31 – Jan 7 6 days
IT Infrastructure and Application Owners / OT Engineering
Establish recurring supplier reviews, reassessment triggers, performance indicators, certificate monitoring, and remediation escalation procedures
Jan 18 – Jan 24 5 days
Procurement and Supplier Quality Management
Document unresolved supplier risks, compensating controls, management decisions, contract status, and target dates for closure
Jan 25 – Jan 30 4 days
CISO / IT Security Manager
Complete a role-based training needs analysis for management, IT, OT, production supervisors, procurement, incident response, HR, and general employees
Jan 7 – Jan 10 4 days
HR and Learning & Development
Deliver and record management training covering NIS2 duties, cyber risk oversight, incident decisions, risk acceptance, funding, reporting, and accountability
Jan 7 – Jan 8 2 days
CISO / IT Security Manager and Legal, Compliance and DPO
Develop technical training for IT, OT, and engineering personnel covering privileged access, secure remote access, patching, backups, logging, segmentation, and production-safe changes
Jan 7 – Jan 14 6 days
CISO / IT Security Manager and OT/Production Engineering
Develop role-specific training for procurement, supplier quality, HR, business continuity, plant management, and incident response personnel
Jan 15 – Jan 21 5 days
HR and Learning & Development
Deliver general workforce awareness covering phishing, ransomware, removable media, password security, incident reporting, social engineering, and production continuity
Jan 7 – Jan 16 8 days
HR and Learning & Development
Track attendance, assessment results, overdue training, remedial actions, and evidence of completion in the learning management system
Jan 7 – Jan 10 4 days
HR and Learning & Development
Conduct a management tabletop exercise covering a ransomware event that spreads from corporate IT into production and requires business, legal, supplier, and authority coordination
Feb 11 – Feb 12 2 days
Incident Response Team / SOC or MSSP
Run a timed incident-reporting exercise validating detection, escalation, early warning, 72-hour notification, evidence collection, management approval, and final-report preparation
Feb 11 – Feb 13 3 days
Legal, Compliance and Data Protection Officer / Incident Response Team
Test restoration of critical backups for selected IT services, production-support systems, engineering workstations, and essential business applications
Feb 11 – Feb 19 7 days
IT Infrastructure and Application Owners
Validate network segmentation, firewall rules, remote access controls, MFA, privileged access, and logging through controlled technical tests
Feb 20 – Mar 1 8 days
IT Infrastructure and Application Owners / OT Engineering
Perform vulnerability and configuration verification against critical assets, including unsupported OT systems and approved compensating controls
Feb 11 – Feb 18 6 days
CISO / IT Security Manager
Conduct a supplier incident exercise with at least one critical automation, maintenance, software, or managed-service provider
Feb 11 – Feb 14 4 days
Procurement and Supplier Quality Management
Commission an independent readiness review of NIS2 governance, registration evidence, risk management, controls, incidents, supplier assurance, training, and testing records
Feb 11 – Feb 20 8 days
External Assurance Specialists
Sample evidence for policy approvals, access reviews, patch records, backup tests, incident logs, supplier assessments, risk decisions, and training completion
Feb 11 – Feb 15 5 days
CISO / IT Security Manager
Present test results, control failures, residual risks, and required remediation decisions to the management board
Mar 4 – Mar 5 2 days
CISO / IT Security Manager
Create and prioritize the final validation remediation backlog with owners, deadlines, compensating controls, and retest requirements
Mar 6 – Mar 11 4 days
CISO / IT Security Manager
Close or formally risk-accept all critical and high-priority findings from the gap analysis, risk register, technical testing, supplier reviews, and independent readiness assessment
Mar 25 – Apr 4 9 days
CISO / IT Security Manager
Complete retesting of remediated controls, update residual risks, and attach operating evidence to each closed finding
Apr 5 – Apr 11 5 days
External Assurance Specialists / CISO
Obtain formal management approval for the cybersecurity policy suite, risk acceptance decisions, incident reporting process, supplier requirements, and ongoing governance model
Apr 12 – Apr 15 2 days
Managing Director / Management Board
Confirm authority registration records, security contacts, incident contacts, reporting channels, and change-notification responsibilities
Apr 12 – Apr 15 2 days
Legal, Compliance and Data Protection Officer
Transfer operational ownership of risk reviews, access recertification, vulnerability management, backups, monitoring, incident response, supplier reviews, and training tracking to permanent process owners
Apr 12 – Apr 18 5 days
CISO / IT Security Manager
Finalize the NIS2 evidence pack containing registration records, policies, risk register, control evidence, exercise results, supplier records, training logs, approvals, and exception decisions
Apr 19 – Apr 26 6 days
CISO / IT Security Manager
Establish the continuous compliance calendar with monthly operational checks, quarterly management reviews, annual exercises, supplier reassessments, policy reviews, and regulatory change monitoring
Mar 25 – Mar 28 4 days
Business Continuity, Quality and Risk Management
Open in the app: Phases

Timeline

Timeline 10 PhasesStart: Oct 1, 2026
Phase / Task
Oct 2026
Nov 2026
Dec 2026
Jan 2027
Feb 2027
Mar 2027
Apr 2027
W 1Oct 1
W 4Oct 22
W 7Nov 12
W 10Dec 3
W 13Dec 24
W 16Jan 14
W 19Feb 4
W 22Feb 25
W 25Mar 18
W 28Apr 8
Applicability, Scope and Project MobilizationOct 1 – Oct 21 · 3 wk · 0/5
Applicability, Scope and Project Mobilization
Current-State Assessment and Gap AnalysisOct 22 – Nov 25 · 5 wk · 0/9
Current-State Assessment and Gap Analysis
Governance Design and Authority RegistrationOct 29 – Nov 25 · 4 wk · 0/7
Governance Design and Authority Registration
Cybersecurity Risk Management FrameworkNov 26 – Jan 6 · 6 wk · 0/9
Cybersecurity Risk Management Framework
IT/OT Security Controls and Remediation RoadmapDec 17 – Feb 10 · 8 wk · 0/13
IT/OT Security Controls and Remediation Roadmap
Incident Detection, Response and ReportingDec 24 – Feb 3 · 6 wk · 0/9
Incident Detection, Response and Reporting
Supply Chain Security and Supplier ManagementDec 31 – Feb 3 · 5 wk · 0/8
Supply Chain Security and Supplier Management
Management, Workforce and Role-Based TrainingJan 7 – Feb 3 · 4 wk · 0/6
Management, Workforce and Role-Based Training
Testing, Exercises and Compliance ValidationFeb 11 – Mar 24 · 6 wk · 0/10
Testing, Exercises and Compliance Validation
Remediation Closeout and Operational HandoverMar 25 – Apr 28 · 5 wk · 0/7
Remediation Closeout and Operational Handover
PlannedIn progressCompletedBlockedMilestones
Open in the app: Timeline

Budget

Budget: €378,000
Internal Personnel · €154,300External Consulting and Assurance · €122,300Software and Security Infrastructure · €55,000Management Training and Workforce Awareness · €28,000Supplier Assurance and Operational Workshops · €18,400
Internal Personnel€154,300
ItemQtyUnit priceTotal
Cybersecurity Program Manager35 Person days€900€31,500
CISO / IT Security Manager50 Person days€950€47,500
IT Infrastructure and Application Owners35 Person days€750€26,250
OT / Production Engineering Specialists30 Person days€800€24,000
Legal, Compliance and Data Protection Officer18 Person days€850€15,300
Procurement, HR, Business Continuity and Quality Support15 Person days€650€9,750
External Consulting and Assurance€122,300
ItemQtyUnit priceTotal
NIS2 Applicability, Legal Interpretation and Authority Registration Consultant18 Person days€1,200€21,600
IT/OT Current-State Assessment and Risk Analysis Consultant35 Person days€1,100€38,500
Incident Response and Regulatory Reporting Consultant22 Person days€1,150€25,300
Supply Chain Cybersecurity Consultant18 Person days€1,050€18,900
Independent NIS2 Readiness Review and Compliance Assurance15 Person days€1,200€18,000
Software and Security Infrastructure€55,000
ItemQtyUnit priceTotal
GRC, Risk Register and Compliance Evidence Platform12 Person days€1,000€12,000
OT Asset Discovery and Network Visibility License1 Flat rate€14,000€14,000
MFA and Privileged Access Management Licenses350 Person days€50€17,500
Immutable Backup and Recovery Enhancement1 Flat rate€8,000€8,000
SIEM and Centralized Security Logging Onboarding1 Flat rate€3,500€3,500
Management Training and Workforce Awareness€28,000
ItemQtyUnit priceTotal
Management Board Cybersecurity Accountability Workshops16 Person days€375€6,000
Role-Based IT, OT, Incident Response and Procurement Training80 Person days€150€12,000
Organization-Wide Security Awareness E-Learning350 Person days€20€7,000
Training Administration, Completion Tracking and Communications Materials1 Flat rate€3,000€3,000
Supplier Assurance and Operational Workshops€18,400
ItemQtyUnit priceTotal
Critical Supplier Cybersecurity Assessments12 Person days€800€9,600
Supplier Contract and Security-Requirement Workshops16 Person days€250€4,000
On-Site IT/OT and Production Security Workshops4 Person days€1,200€4,800
Open in the app: Budget

Risks

High

Incorrect NIS2 Applicability or Registration Scope

If the national transposition law or competent authority confirms a different sector classification, entity size threshold, registration scope, or reporting channel after Week 3, the project may implement the wrong obligations or miss a required registration deadline.

Countermeasure: Legal, Compliance and the DPO, supported by the CISO, will issue a documented applicability opinion and obtain authority clarification by Week 3; the project charter and registration data will be formally reapproved by Management by Week 8.
High

Incomplete IT/OT Asset and Dependency Inventory

If undocumented PLCs, HMIs, engineering workstations, legacy operating systems, remote-access routes, or production dependencies remain unidentified by the end of Week 8, the risk assessment and remediation plan will exclude critical manufacturing assets.

Countermeasure: IT Infrastructure and OT/Production Engineering will perform passive discovery, owner interviews, and production-dependency mapping, with Plant Management validating the inventory by Week 8 and revalidating it before Week 25 testing.
High

Production Disruption During Security Remediation

If segmentation, patching, MFA, endpoint monitoring, or authentication changes are deployed without plant testing and rollback procedures before Week 19, manufacturing availability, safety, or validated production processes could be affected.

Countermeasure: OT/Production Engineering and Plant Management will approve a controlled change process, test changes in a representative environment, schedule maintenance windows, and document rollback procedures before each production deployment, with priority controls completed by Week 19.
High

Ransomware or Malware Propagation into Production

If IT/OT segmentation, privileged-access controls, remote-access restrictions, endpoint protection, or offline backup restoration are not validated by Week 19, malware could spread from corporate IT or suppliers into production systems and cause extended downtime.

Countermeasure: IT Infrastructure Owners and OT Engineering will implement segmented network zones, MFA for remote and privileged access, controlled jump hosts, and offline or immutable backups by Week 19; recovery restoration will be tested during Phase 9 by Week 25.
High

Failure to Meet Incident Reporting Timelines

If an incident remains unassigned, evidence is unavailable, or a supplier does not notify the company promptly, the organization may fail to issue an early warning within 24 hours or an incident notification within 72 hours of becoming aware of a significant incident.

Countermeasure: The Incident Response Team and SOC/MSSP will establish a 24/7 escalation roster, severity criteria, authority-reporting templates, evidence-preservation procedures, and legal review steps by Week 18; a timed reporting exercise will be completed by Week 25.
High

Insufficient Supplier Visibility and Contractual Leverage

If critical automation, software, maintenance, logistics, or remote-support suppliers are not classified and assessed by Week 18, or refuse updated cybersecurity and incident-notification clauses, material third-party exposure may remain unmanaged.

Countermeasure: Procurement and Supplier Quality Management will identify critical suppliers by Week 16, complete priority assessments and contract negotiations by Week 18, restrict non-compliant remote access, and obtain Management-approved risk acceptance or alternative supplier controls before Week 25.
High

Unsupported Legacy OT Systems and Vulnerability Exposure

If legacy controllers, industrial PCs, or vendor-supported-but-unpatchable systems are identified during Phase 5 without compensating controls by Week 19, exploitable vulnerabilities may remain in production networks.

Countermeasure: The CISO, OT Engineering, and Plant Management will create a vulnerability exception register by Week 14, apply network isolation, allowlisting, restricted administration, virtual patching, and enhanced monitoring by Week 19, and document replacement or residual-risk decisions by Week 30.
Medium

Management Accountability and Training Non-Compliance

If the management body has not completed NIS2 cybersecurity training or formally approved risk acceptance, policies, and funding by Week 18, the organization may lack evidence of required management oversight and accountability.

Countermeasure: The Managing Director and HR/Learning & Development will schedule management training by Week 15, achieve completion by Week 18, and obtain documented approvals for the risk methodology, priority residual risks, and security program by Week 30.
Medium

Insufficient Resources, Budget, or Audit Evidence

If remediation effort exceeds the EUR 420,000 budget, internal security capacity is unavailable, or operating evidence is not captured as controls are implemented by Week 25, priority gaps may remain open and the company may be unable to demonstrate compliance.

Countermeasure: The CISO and Project Manager will maintain a weekly risk, budget, and evidence dashboard from Week 4, engage an MSSP or specialist support by Week 8 where required, preserve the EUR 42,000 reserve for approved exceptions, and complete an evidence review before Week 30.
Open in the app: Risks

Stakeholders

MB

Management board/Managing Director

Owns NIS2 accountability, risk acceptance, funding, and formal approval of the security program

Involve: Phase 1
CO

CISO or IT Security Manager

Leads implementation, defines controls, manages the risk register, and coordinates evidence

Involve: Phase 1
II

IT Infrastructure and Application Owners

Provide inventories and implement technical controls for identity, monitoring, backup, and vulnerability processes

Involve: Phase 2
OP

OT/Production Engineering and Plant Management

Protect manufacturing continuity, assess industrial dependencies, and approve operational changes

Involve: Phase 2
LC

Legal, Compliance and Data Protection Officer

Interprets NIS2 obligations, reviews policies and contracts, and supports authority communications

Involve: Phase 1
IR

Incident Response Team, SOC or Managed Security Service Provider

Defines detection, escalation, containment, evidence preservation, and reporting capabilities

Involve: Phase 2
PA

Procurement and Supplier Quality Management

Implements supplier classification, due diligence, contractual requirements, and ongoing supplier assurance

Involve: Phase 2
HA

HR and Learning & Development

Coordinates management training, role-based training, completion tracking, and employee communications

Involve: Phase 3
BC

Business Continuity, Quality and Risk Management

Aligns cybersecurity controls with continuity, recovery, quality management, and operational risk processes

Involve: Phase 2
WC

Works council or employee representatives, if applicable

Reviews workforce-impacting monitoring, training, and process changes where required by local employment law

Involve: Phase 3
CN

Competent national authority and external assurance specialists

Provide registration guidance, clarify reporting expectations, and independently validate readiness where needed

Involve: Phase 1
Open in the app: Stakeholders

Compliance

Required 5

Determine whether the machinery manufacturer is within scope of the applicable national NIS2 legislation, document the legal basis, identify the competent authority, and complete required entity registration or notification.

Legal, Compliance and Data Protection Officer; Managing Director; CISO Weeks 1–8, with updates when national guidance changes
Required
Rule from the compliance library
NIS2 Directive(EU 2022/2555)
  • Documented IT risk management reviewed annually
  • Business continuity plan and disaster recovery tested
  • Multi-factor authentication (MFA) for critical systems
  • Encryption of all sensitive data (at rest + in transit)
  • Supplier security reviews (supply chain security)
  • Annual cybersecurity training for all employees

If breached: Fines up to €10 million or 2% of global annual revenue. Personal liability of management for gross negligence.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note

Establish and operate cybersecurity risk-management measures covering governance, asset and risk management, access control, vulnerability handling, incident prevention, business continuity, backups, crisis management, and recovery for IT and OT environments.

CISO; IT Infrastructure Owners; OT/Production Engineering; Business Continuity and Risk Management Design Weeks 4–14; implementation Weeks 12–30; ongoing thereafter
Required
Rule from the compliance library

There is no matching rule in the library for this obligation. In PathHub you can link a rule from the library if needed.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note

Implement significant-incident reporting processes supporting an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month where required by the applicable NIS2 regime.

Incident Response Team; SOC/MSSP; Legal and Compliance Design Weeks 13–18; exercise and validation Weeks 20–25; ongoing thereafter
Required
Rule from the compliance library
NIS2 Directive(EU 2022/2555)
  • Documented IT risk management reviewed annually
  • Business continuity plan and disaster recovery tested
  • Multi-factor authentication (MFA) for critical systems
  • Encryption of all sensitive data (at rest + in transit)
  • Supplier security reviews (supply chain security)
  • Annual cybersecurity training for all employees

If breached: Fines up to €10 million or 2% of global annual revenue. Personal liability of management for gross negligence.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note

Maintain an incident response capability with escalation ownership, evidence preservation, authority contacts, reporting templates, forensic readiness, and tested communication procedures.

Incident Response Team; SOC/MSSP; CISO Weeks 13–25; ongoing thereafter
Required
Rule from the compliance library

There is no matching rule in the library for this obligation. In PathHub you can link a rule from the library if needed.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note

Ensure the management body approves the cybersecurity program, receives appropriate training, oversees risk decisions, and formally accepts or funds residual risks.

Managing Director; Management Board; HR/Learning & Development Training and approvals Weeks 15–18; formal closeout by Week 30; ongoing oversight
Required
Rule from the compliance library

There is no matching rule in the library for this obligation. In PathHub you can link a rule from the library if needed.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note
Important 1

Use an industrial cybersecurity framework such as IEC 62443 for OT zoning, conduits, secure remote access, system hardening, and lifecycle controls, and align the information-security management system with ISO/IEC 27001 where proportionate.

CISO; OT/Production Engineering; IT Infrastructure Owners Design Weeks 4–14; implementation and validation Weeks 12–30
Important
Rule from the compliance library
ISO 27001 (Information Security)(ISO 27001:2022)
  • Information security management system (ISMS) defined
  • Risk assessment and treatment documented
  • Statement of Applicability (SoA) with Annex A controls
  • Internal audit and management review annually

If breached: Voluntary standard but de facto mandatory for enterprise/government clients. Loss terminates business relationships.

Evidence

No evidence yet. In PathHub you attach evidence to each obligation, e.g. minutes, a certificate or a link to the document, and export everything as a PDF evidence report.

File Link Note
Open in the app: Compliance

Milestones

  1. Week 3

    Approved NIS2 applicability decision, project charter, scope statement, governance structure, and 12-month implementation plan

    Depends on: Phase 1 completion
  2. Week 8

    Management-approved current-state assessment, validated IT/OT inventory, NIS2 gap register, and prioritized remediation backlog

    Depends on: Phase 2 completion
  3. Week 8

    NIS2 registration submitted or accepted, management accountability charter approved, governance forums established, and evidence repository operational

    Depends on: Phase 3 completion
  4. Week 14

    Approved NIS2 risk methodology, populated risk register, prioritized treatment plan, and documented risk acceptance process

    Depends on: Phase 4 completion
  5. Week 18

    Approved incident response framework, playbooks, escalation roster, authority reporting templates, and tested evidence-preservation process

    Depends on: Phase 6 completion
  6. Week 18

    Critical supplier register, completed priority supplier assessments, updated contract clauses, controlled supplier access, and ongoing supplier assurance process

    Depends on: Phase 7 completion
  7. Week 18

    Management training completed, role-based courses delivered, workforce awareness launched, and auditable completion records available

    Depends on: Phase 8 completion
  8. Week 19

    Priority IT/OT controls deployed or formally risk-accepted, with tested change records, updated diagrams, implementation evidence, and residual-risk decisions

    Depends on: Phase 5 completion
  9. Week 25

    Completed exercises and technical tests, validated reporting timelines, independent readiness review, and approved final remediation backlog

    Depends on: Phase 9 completion
  10. Week 30

    Priority gaps closed or approved, policies and risks formally approved, complete evidence pack delivered, operational owners assigned, and continuous NIS2 compliance calendar activated

    Depends on: Phase 10 completion
Open in the app: Milestones

How this plan was created

This plan was created by PathHub AI from a single description: “Implement the NIS2 requirements in a mid-sized machinery manufacturer with 350 employees: registration with the authority, risk management, incident reporting processes, supply chain security and management training within 12 months.” Without company context. With your departments, approval processes and compliance requirements it becomes much more precise.

After the project

Obligations that remain after the implementation

Once the project is done, operations begin. These items continue in PathHub afterwards, with evidence and reminders. Not legal advice.

Approval by management

German law requires management to approve the measures. You request the approval right on the obligation, and the decision is recorded with name and date in the history and the evidence report.

Yearly review and training

Review risk management, test the emergency plan, train management: in the compliance calendar with interval, person in charge and reminders 30 and 7 days ahead.

Status for management

The compliance overview shows all initiatives with a traffic light and creates the PDF report “Compliance status”, for example for management or an audit.

How approvals, the compliance calendar and the overview work →

Frequently asked questions

How long does a NIS2 implementation take?
In the example plan, a NIS2 implementation takes 30 weeks in 10 phases, of which 5 phases partly run in parallel. The actual duration depends on company size, starting point and available resources, with your company context PathHub adjusts the schedule accordingly.
What does a NIS2 implementation cost?
The example plan estimates about €378,000, split into 23 budget line items with quantity and unit price. The largest items are Internal Personnel, External Consulting and Assurance. This is an AI estimate as a starting point, not a quote.
What are the risks of a NIS2 implementation?
The plan lists 9 risks with countermeasures. Rated highest: Incorrect NIS2 Applicability or Registration Scope; Incomplete IT/OT Asset and Dependency Inventory; Production Disruption During Security Remediation.
Who needs to be involved in a NIS2 implementation?
Among others, the plan includes these people: Management board/Managing Director, CISO or IT Security Manager, IT Infrastructure and Application Owners, OT/Production Engineering and Plant Management, Legal, Compliance and Data Protection Officer, Incident Response Team, SOC or Managed Security Service Provider. For each role it states why and from when to involve them.
Can I adapt the plan to my company?
Yes. Open the plan in PathHub without signing up, adjust phases and tasks or describe your own initiative: with company context (departments, approval processes, works council, compliance requirements) every further plan gets more precise.

More project plan examples

Project plan: CRM rollout

11 weeks · 6 phases · 28 tasks

Project plan: Office move

11 weeks · 6 phases · 30 tasks

Project plan: ISO 27001 certification

34 weeks · 10 phases · 67 tasks

Project plan: Time-tracking rollout

15 weeks · 6 phases · 36 tasks

Adapt this plan to your company

Open the plan in PathHub: no sign-up. Or describe your own initiative and get a complete plan in minutes.

Open plan →