NIS2

NIS2 Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex NIS2 scenarios: cross-border supervision, scope edge cases, and integrating NIS2 with DORA and ISO 27001 programmes.

10 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

A group operates critical infrastructure across multiple Member States. How does NIS2 generally expect cross-border supervisory cooperation to work?

Each Member State acts in complete isolation with no information sharingOnly the European Commission may ever be contacted, with no national authority involvementThrough mechanisms for cooperation and information exchange among competent authorities and CSIRTs, including at EU level (e.g. the NIS Cooperation Group)Cross-border entities are automatically exempt from NIS2

Question 2 of 10

A financial entity is subject to both NIS2 and DORA. How do the two frameworks generally interact?

NIS2 always overrides DORA in every respect for financial entitiesThey are entirely duplicative and one can simply be ignoredNeither framework applies to financial entitiesDORA is generally treated as sector-specific (lex specialis) for financial entities regarding ICT risk and incident reporting, taking precedence over the equivalent NIS2 provisions in overlapping areas

Question 3 of 10

Which factors help determine whether an entity falls within the 'essential' versus 'important' entity category under NIS2's size-cap approach?

Select all that apply.

The entity's preferred office locationSpecific inclusion criteria for certain entities regardless of size (e.g. sole providers of a critical service)Whether the entity meets medium or large enterprise size thresholdsThe entity's sector (e.g. Annex I vs Annex II activities)

Question 4 of 10

What is a key challenge for a group with subsidiaries that individually fall below NIS2 size thresholds but collectively present systemic importance?

NIS2 only ever applies to the ultimate parent companyMember States can still designate certain entities as in-scope regardless of size where they play a critical role (e.g. sole provider of an essential service), so entities should assess criticality, not just headcount/turnoverGroup structures are entirely irrelevant to NIS2 scopeNo challenge exists — size thresholds always apply strictly per legal entity with no other consideration

Question 5 of 10

How should a NIS2 in-scope entity approach the interaction between its incident reporting obligations under NIS2 and any separate breach notification duty under the GDPR (where an incident involves personal data)?

GDPR notification automatically satisfies NIS2 with no further action neededThe two obligations are mutually exclusive — only one can ever applyNIS2 always overrides and cancels any GDPR notification dutyBoth may apply in parallel to the same incident, requiring coordinated (though separately addressed) notifications to the relevant NIS2 authority/CSIRT and the data protection supervisory authority

Question 6 of 10

Under NIS2, competent authorities can, as an enforcement measure of last resort for essential entities in serious cases, seek to have a natural person exercising managerial responsibility temporarily prohibited from holding managerial functions.

TrueFalse

Question 7 of 10

A cloud service provider is itself an in-scope 'important entity' and also a supplier to essential entities. What layered NIS2 exposure does this create?

Cloud providers are categorically excluded from NIS2Only the provider's customers face any NIS2 exposureThe provider must meet its own direct NIS2 obligations as an important entity, while also being subject to its customers' supply-chain security expectations under their own Article 21 obligationsNone — being a supplier has no additional bearing on NIS2 exposure

Question 8 of 10

What is the significance of NIS2 empowering the European Commission and ENISA to support coordinated vulnerability disclosure and a European vulnerability database?

It only applies to vulnerabilities discovered by government agenciesIt supports a more harmonised, EU-wide approach to identifying and responding to vulnerabilities that could affect multiple entities/Member States simultaneouslyIt has no practical significanceIt replaces the need for entities to patch their own systems

Question 9 of 10

When designing a combined NIS2 + ISO 27001 + DORA (where applicable) compliance programme, which of the following is a sound integration strategy?

Select all that apply.

Map each framework's specific obligations onto a shared underlying risk-management and control structure to avoid duplicated effortUse ISO 27001 Annex A controls as a common technical baseline referenced by both NIS2 and DORA-driven risk assessmentsMaintain a single incident register capable of tagging which regulatory reporting obligations a given incident triggersAssume the frameworks never overlap and build three fully separate, disconnected programmes

Question 10 of 10

Why might 'proportionality' in Article 21 still result in materially different expectations for two essential entities in the same sector?

Proportionality is purely theoretical and never affects actual expectationsProportionality only applies to important entities, never essential onesBecause the appropriateness of measures is assessed against the entity's own risk exposure, size, cost of implementation, and the severity of potential incidents, which vary even within a sectorAll entities in the same sector face identical obligations with zero variation

0 of 10 answered