NIS2

NIS2 Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Applying NIS2 governance, risk-management, and incident-reporting duties in practice, including supply chain security.

12 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 12

Under Article 21(2), which of the following are examples of the minimum measures entities must include in their cybersecurity risk-management approach?

Select all that apply.

Incident handlingPolicies on risk analysis and information system securityThe entity's choice of office furniture supplierSupply chain security, including security-related aspects of relationships with direct suppliers

Question 2 of 12

What multi-stage reporting process does Article 23 establish for significant incidents?

A single annual report covering the whole yearOnly a verbal report to a colleagueA single report only, with no intermediate stepsAn early warning within 24 hours, an incident notification within 72 hours, and a final report

Question 3 of 12

Under Article 20, what training obligation is placed on management bodies?

No training obligation existsOnly IT staff require training, never managementMembers of management bodies must follow training to gain sufficient knowledge to identify and assess cybersecurity risks and management practicesTraining is required only once, at company formation, with no refreshers

Question 4 of 12

What is the significance of NIS2's approach to supply chain security under Article 21?

Entities must consider the security practices of their direct suppliers and service providers as part of their own risk managementOnly government suppliers are consideredSupply chain risk is explicitly out of scopeSupply chain security only applies to hardware, never software or services

Question 5 of 12

Under NIS2, an entity can, in certain cases, be required to inform the recipients of its services about significant threats and possible mitigation measures.

TrueFalse

Question 6 of 12

Article 32's enforcement and supervisory measures for essential entities are generally understood to be, relative to those for important entities, what?

Non-existent — essential entities face no supervisionIdentical, with no distinction between essential and important entitiesMore stringent/proactive, given essential entities' higher-risk profileApplied only retroactively, never proactively

Question 7 of 12

What role do national cybersecurity strategies and competent authorities play under NIS2?

Only the European Commission handles all oversight directly, with no national roleNo role — NIS2 is self-executing with no national implementationMember States must adopt national cybersecurity strategies and designate competent authorities/CSIRTs responsible for oversight and coordinationThey only apply to non-EU entities

Question 8 of 12

An in-scope entity outsources part of its IT infrastructure to a cloud provider. What does NIS2 suggest about the entity's residual responsibility?

Outsourcing fully transfers all responsibility to the cloud providerOnly the cloud provider can ever be held accountable, never the entityThe entity remains responsible for managing risks related to its supply chain, including outsourced/cloud services, even though it has delegated operationsNIS2 does not apply once services are outsourced

Question 9 of 12

Which of the following factors are relevant to whether an incident is 'significant' and therefore reportable under Article 23?

Select all that apply.

It has affected or is capable of affecting other persons by causing considerable material or non-material damageIt has caused or is capable of causing severe operational disruption or financial lossThe incident occurred outside normal business hoursThe scale and duration of the incident

Question 10 of 12

What is the general rationale for NIS2 empowering national authorities to hold management bodies personally accountable for compliance failures?

Because technical staff cannot legally be held responsible for anythingTo drive genuine board-level ownership of cybersecurity risk rather than treating it purely as a technical, delegated issueTo increase paperwork with no substantive purposeIt has no rationale — it is a drafting error

Question 11 of 12

NIS2 harmonises minimum requirements across the EU, but Member States may maintain or introduce provisions ensuring a higher level of cybersecurity, subject to conditions.

TrueFalse

Question 12 of 12

What is a practical benefit of aligning an organisation's cybersecurity risk-management measures under NIS2 with a recognised standard like ISO/IEC 27001?

ISO 27001 replaces the need to comply with NIS2 entirelyThere is no benefit — the two are unrelatedISO 27001's structured ISMS approach can help demonstrate many of the 'appropriate and proportionate' measures NIS2 requires, easing the compliance burdenISO 27001 only addresses physical security, which is irrelevant to NIS2

0 of 12 answered