How to use the NIS2 Frameworks in Modulos

Modulos has two Frameworks for NIS2, Directive (EU) 2022/2555. Each of the two Frameworks has the name NIS2:

• OFF-15 at the Organization level, on your organization AI System.
• MFF-15 at the AI System level, on each AI System that your entity uses for its services.

This section tells you which decisions to make before you add the NIS2 Frameworks, and which steps Modulos recommends. It also gives the Requirement for each provision, and the work that the Frameworks do not hold. Here, "you" is the entity that uses Modulos. "This Directive is addressed to the Member States" (Article 46), and your entity has obligations in the national law that transposes NIS2 (Article 41(1)). First, examine if NIS2 applies to your entity. See Who NIS2 applies to.

The two NIS2 Frameworks

In Modulos, NIS2 has two Frameworks at two levels. The two levels are the structure of Modulos, and NIS2 does not have this structure.

AI System	Framework	Directive (EU) 2022/2555	Implementing Regulation (EU) 2024/2690
The organization AI System	OFF-15 (Organization level)	Articles 2 to 4, 6(8), 20, 21, 23(1) to (4) and (11), 26(1)(b), 26(2) to (4), 27, 28, 29(4), 30, 32, and 33	Articles 1 to 4, 15, and 16, and the Annex
Each AI System that the entity uses for its services	MFF-15 (AI System level)	Articles 21, and 23(1) to (4) and (11)	Articles 1 to 14 and the Annex

• Article 20 is in OFF-15 only, and Articles 21 and 23 are in the two Frameworks. NIS2 does not divide these Articles by level. Article 20(1) connects the management bodies to the measures of the entity "in order to comply with Article 21". Article 21(1) applies to the "network and information systems which those entities use for their operations or for the provision of their services".
• Articles 2 to 4, 26 to 30, 32, and 33 are in OFF-15 only. These Requirements are about the entity, not about one AI System.
• Each AI System gets all Requirements of its Framework. The two Frameworks do not select Requirements for an AI System. To remove a Requirement from the scope, see step 4 of Steps that Modulos recommends.

Organization AI Systems

Frameworks at the Organization level, for example OFF-15, attach to your organization AI System, which has the Type Organization in the AI Registry. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos before you add Frameworks at the Organization level.

Decisions before you add the Frameworks

Before you add the NIS2 Frameworks, make these six decisions. NIS2 sets no sequence for them, and Modulos recommends this sequence. You make decisions 1 to 5 for the entity, not for each AI System. Each decision gives information on the law.

1. Examine if the entity is in the scope of NIS2 (Article 2).
   • Examine Article 2(1) to (5). Also examine Article 2(7) to (10), which remove some entities or obligations from the scope on their conditions.
   • Examine the national law that transposes NIS2 in each Member State where the entity is in the scope. See the Article 2 scope test.
2. Identify if the entity is an essential entity, an important entity, or an entity providing domain name registration services (Article 3).
   • Essential and important entities have the same obligations in Articles 21 and 23. Their supervision, some enforcement measures, and their fine levels are different.
   • See Article 3.
3. Examine if a sector-specific Union legal act applies (Article 4).
   • If the requirements of that legal act are "at least equivalent in effect", "the relevant provisions of this Directive" do not apply to the entities of that legal act (Article 4(1)). For financial entities, DORA can be such a legal act (DORA Article 1(2)).
   • See Article 4 and NIS2 and DORA.
4. Examine if the entity is a relevant entity in Implementing Regulation (EU) 2024/2690 (Article 1).
   • A relevant entity is an essential or important entity of a type in Article 1 of that Regulation, for example a cloud computing service provider.
   • See Article 21(5).
5. Identify the Member State that has jurisdiction (Article 26).
   • For an Article 26(1)(b) entity that "is not established in the Union, but offers services within the Union", this decision includes the representative in the Union (Article 26(3)).
   • See Article 26.
6. Select the AI Systems that get MFF-15.
   • Modulos recommends MFF-15 for each AI System that the entity uses for its services.
   • If an AI system that the entity uses for its services has no AI System in Modulos, make one in the AI Registry.

NIS2 tags

In Modulos, the Requirements of OFF-15 and MFF-15 have NIS2 tags of three types:

• NIS2 Domain gives the area of the measures or obligations of the Requirement. Examples are one point of Article 21(2), Article 20, and Article 23. Each Requirement has this tag.
• NIS2 Basis gives the source of the obligation: an Article of the Directive, or Implementing Regulation (EU) 2024/2690, which applies to relevant entities only. Each Requirement has this tag, and some Requirements have the two sources.
• NIS2 Scope gives the type of entity or the condition for which the obligation applies. Examples are a trust service provider and a relevant entity. Some Requirements have this tag.

The NIS2 tags put the Requirements into groups. To remove a Requirement from the scope, follow step 4 of Steps that Modulos recommends.

Modulos wants to use the NIS2 Scope tags in a new release. Then Modulos can remove a Requirement from the scope when the entity is not of the type, or not in the condition, of that Requirement.

Steps that Modulos recommends

To use the NIS2 Frameworks, Modulos recommends the eight steps below, in this sequence. NIS2 sets no sequence. Each step gives information on the law and the Requirements for each provision.

1. Record decisions 1 to 3.
   • Record each decision and the facts that you used for it.
   • Modulos recommends this record, and Articles 2 to 4 do not make it an obligation.
2. Do the work of Articles 3(4) and 26 to 28 that applies to the entity.
   • Send the Article 3(4) information for the list of entities. Notify changes in the time limit of Article 3(4).
   • For an entity of a type in Article 27(1), also send the Article 27(2) information. Notify changes in the time limit of Article 27(3).
   • For an Article 26(1)(b) entity, identify its main establishment in the Union (Article 26(2)).
   • Where Article 26(3) applies, designate a representative in the Union.
   • For a TLD name registry or an entity providing domain name registration services, do the work of Article 28.
   • See Articles 3(3), 3(4), and 27, Article 26, and Article 28.
3. Add the Frameworks. Add OFF-15 to your organization AI System. Add MFF-15 to each AI System that you selected in decision 6.
4. Mark as out of scope each Requirement with an obligation that does not apply to the entity.
   • In a comment on the Requirement, write the facts that show that the obligation does not apply.
   • An example is the Requirement on Article 28 for an entity that is not a TLD name registry and not an entity providing domain name registration services.
   • A different example is a Requirement on Implementing Regulation (EU) 2024/2690 only, for an entity that is not a relevant entity. Decisions 1 to 3 show if the Requirements on Articles 21 and 23 stay in the scope.
   • A different example is the Requirement on Article 23(4), second subparagraph, for an entity that is not a trust service provider.
   • A scope decision does not make a Requirement fulfilled.
5. Do the work of Article 20. See Article 20.
6. Do the work of Article 21 at the two levels.
   • For a relevant entity, also do the work of the Annex of Implementing Regulation (EU) 2024/2690, and "document its reasoning" where its Article 2(2) applies.
   • See Article 21(1) and Article 21(5).
7. Do the work of Article 23 and Article 29(4). If the entity sends voluntary notifications, also do the work of Article 30.
   • See Article 23(4) and Articles 29 and 30.
8. Prepare for the supervisory and enforcement measures of the competent authorities.
   • Article 32 gives these measures for essential entities, and Article 33 gives them for important entities.
   • See Supervision and enforcement.

Reviews in Modulos

In Modulos, you do the work of each NIS2 Requirement in its Controls. You change the status of a Control directly, and you write a comment that Modulos records on the Control. No approval by a different person is necessary.

When all Controls of a Requirement have a "final status", Modulos shows that the Review of the Requirement can start. In the Review, the Requirement Owner examines the completed Controls and marks the Requirement as fulfilled. If the obligation of a Requirement does not apply, the Requirement gets the status out of scope, not fulfilled. A comment on the Requirement can give the facts that show this. Only Assets have a procedure to request a Review. See Reviews & Statuses.

Requirements of the NIS2 Frameworks

OFF-15 and MFF-15 give Requirements for the provisions below. Each row gives the Requirement name and level in Modulos. It also gives the provisions in the Directive and in Implementing Regulation (EU) 2024/2690, with information on the law.

Requirement	Level	Directive (EU) 2022/2555 Articles	Implementing Regulation (EU) 2024/2690	Information on the law
ORF-333 NIS2 Scope and Entity Classification	Organization	2, 3(1) to (3), 4	None	Article 2, Article 3, Article 4
ORF-334 Entity Listing Data Submission and Update Duty	Organization	3(3), 3(4)	None	Articles 3(3), 3(4), and 27
ORF-335 Sector-Specific Union Legal Acts: Equivalence and Residual Duties	Organization	4(1) to (3)	None	Article 4
ORF-336 Management Body Approval and Oversight	Organization	20(1)	None	Article 20
ORF-337 Management Body Cybersecurity Training	Organization	20(2)	None	Article 20
ORF-338 Risk Analysis and Security Policy Governance	Organization	21(1), 21(2)(a)	Articles 1, 2, and 16, Annex points 1.1–1.2 and 2.1–2.3	Article 21(1), Article 21(2)(a)
ORF-339 Incident Handling Governance	Organization	6(8), 21(2)(b)	Articles 1, 2, 15, and 16, Annex points 3.1–3.6	Article 21(2)(b)
ORF-340 Continuity, Backup, Disaster Recovery, and Crisis Governance	Organization	21(2)(c), (e), and (i)	Articles 1 and 2, Annex points 4.1–4.3 and 13.1–13.3	Article 21(2)(c)
ORF-341 Supply Chain Security Governance	Organization	21(2)(d), 21(3)	Articles 1 and 2, Annex points 5.1–5.2	Article 21(2)(d), Article 21(3)
ORF-342 Secure Acquisition, Development, and Maintenance Governance	Organization	21(2)(e)	Articles 1 and 2, Annex points 6.1–6.10	Article 21(2)(e)
ORF-343 Cybersecurity Measure Effectiveness Governance	Organization	21(2)(f)	Articles 1 and 2, Annex points 2.3 and 7.1–7.3	Article 21(2)(f)
ORF-344 Cyber Hygiene and Cybersecurity Training Governance	Organization	21(2)(g)	Articles 1 and 2, Annex points 8.1–8.2	Article 21(2)(g)
ORF-345 Cryptography and Encryption Governance	Organization	21(2)(h)	Articles 1 and 2, Annex points 9.1–9.3	Article 21(2)(h)
ORF-346 HR Security, Access Control, and Asset Governance	Organization	21(2)(i)	Articles 1 and 2, Annex points 10.1–10.4, 11.1–11.5, and 12.1–12.5	Article 21(2)(i)
ORF-347 MFA and Secured Communications Governance	Organization	21(2)(j)	Articles 1 and 2, Annex points 11.6–11.7	Article 21(2)(j)
ORF-348 Cybersecurity Non-Compliance Corrective Action	Organization	21(4)	None	Article 21(4)
ORF-349 NIS2 Implementing-Act Applicability Governance	Organization	21(5), 23(11)	Articles 1, 2(2), and 16	Article 21(5)
ORF-350 Significant Incident Determination Governance	Organization	23(1), 23(3)	Articles 3 and 4, Annex point 3.4.2(b)	Article 23(3)
ORF-351 Recipient Incident and Threat Communication	Organization	23(1), 23(2)	None	Article 23(1), Article 23(2)
ORF-352 24-Hour Early Warning Procedure	Organization	23(4)(a)	None	Article 23(4)
ORF-353 72-Hour Incident Notification Procedure	Organization	23(4)(b), 23(4) second subparagraph	None	Article 23(4)
ORF-354 Intermediate, Final, and Progress Reporting Procedure	Organization	23(4)(c) to (e)	None	Article 23(4)
ORF-355 Jurisdiction and EU Representative Management	Organization	26(1)(b), 26(2) to (4)	None	Article 26
ORF-356 Article 27 Registry Submission and Update Duty	Organization	27(1) to (5)	None	Articles 3(3), 3(4), and 27
ORF-357 Domain Registration Data Governance and Disclosure	Organization	28(1) to (6)	None	Article 28
ORF-358 Information-Sharing Arrangement Notification Duty	Organization	29(4)	None	Articles 29 and 30
ORF-359 Voluntary Notification Governance	Organization	30(1), 30(2)	None	Articles 29 and 30
ORF-360 Supervisory Cooperation and Enforcement Response	Organization	32, 33	None	Articles 32 and 33
MRF-275 AI-Service Risk Analysis and Security Policies	AI System	21(1), 21(2)(a)	Article 2, Annex points 1.1–1.2 and 2.1–2.2	Article 21(1), Article 21(2)(a), Article 21(5)
MRF-276 AI-Service Incident Handling	AI System	21(2)(b)	Article 2, Annex points 3.1–3.6	Article 21(2)(b)
MRF-277 AI-Service Continuity, Backup, and Crisis Operations	AI System	21(2)(c), (e), and (i)	Articles 1 and 2, Annex points 4.1–4.3 and 13.1–13.3	Article 21(2)(c)
MRF-278 AI-Service Supply Chain Security	AI System	21(2)(d), 21(3)	Article 2, Annex points 5.1–5.2	Article 21(2)(d), Article 21(3)
MRF-279 Secure Acquisition, Development, and Maintenance	AI System	21(2)(e)	Article 2, Annex points 6.1–6.10	Article 21(2)(e)
MRF-280 Cybersecurity Measure Effectiveness Assessment	AI System	21(2)(f)	Article 2, Annex points 7.1–7.3	Article 21(2)(f)
MRF-281 Operational Cyber Hygiene and Role-Based Training	AI System	21(1), 21(2)(g)	Article 2, Annex points 8.1–8.2	Article 21(2)(g)
MRF-282 Cryptography and Encryption Controls	AI System	21(2)(h)	Articles 1 and 2, Annex points 9.1–9.3	Article 21(2)(h)
MRF-283 HR Security, Access Control, and Asset Management	AI System	21(2)(i)	Articles 1 and 2, Annex points 10.1–10.4, 11.1–11.5, and 12.1–12.5	Article 21(2)(i)
MRF-284 MFA and Secured Communications	AI System	21(2)(j)	Article 2, Annex points 11.6–11.7	Article 21(2)(j)
MRF-285 Cybersecurity Non-Compliance Corrective Action Workflow	AI System	21(4)	None	Article 21(4)
MRF-286 Significant Incident Detection and Impact Assessment	AI System	23(1), 23(3)	Articles 1 and 3 to 14, Annex point 3.4.2(b)	Article 23(3)
MRF-287 Recipient Notification and Threat Communication Workflow	AI System	23(1) first subparagraph second sentence, 23(2)	None	Article 23(1), Article 23(2)
MRF-288 24-Hour Early Warning Workflow	AI System	23(4)(a)	None	Article 23(4)
MRF-289 72-Hour Incident Notification Workflow	AI System	23(4)(b), 23(4) second subparagraph	None	Article 23(4)
MRF-290 Intermediate, Final, and Progress Reporting Workflow	AI System	23(4)(c) to (e)	None	Article 23(4)
MRF-291 Implementing-Regulation Significant Incident Criteria Execution	AI System	21(5), 23(11)	Articles 1 and 3 to 14, Annex point 3.4.2(b)	Article 23(3), Article 21(5)
MRF-292 Trust Service 24-Hour Notification Workflow	AI System	23(4) second subparagraph	None	Trust service providers

No Requirement holds Articles 24, 25, 31, or 34 to 37. See Work that the Frameworks do not hold.

Work that the Frameworks do not hold

For these items, the NIS2 Frameworks OFF-15 and MFF-15 have no Requirement. Some items are obligations of your entity in national law or other EU law. Some items are tasks of Member States and authorities. Some items are not law.

• National law. NIS2 is a directive, and the national law of each Member State gives more rules. Member States can keep or use provisions that give "a higher level of cybersecurity", if these provisions agree with their obligations in Union law (Article 5). Member States identify some entities in Article 2(2), points (b) to (e). They designate the competent authorities and the CSIRTs (Articles 8 and 10). They can also make "national mechanisms for entities to register themselves" (Article 3(4)). See Dates and transposition of NIS2.
• Tasks of the authorities. The CSIRTs, the competent authorities, and the single points of contact have the tasks of Article 23(5) to (10). The fines and penalties are in Articles 34 to 36. See Administrative fines and other penalties.
• Certification and standards. Member States "may require" essential and important entities to use ICT products, ICT services and ICT processes "certified under European cybersecurity certification schemes" (Article 24(1)). Examine the national law for this requirement. Member States also "encourage the use of European and international standards and technical specifications" (Article 25(1)). See Articles 24 and 25.
• Article 22(1). The Cooperation Group, with the Commission and ENISA, can do coordinated security risk assessments of critical supply chains. The Frameworks have no Requirement for this work of the Cooperation Group. The Frameworks include the obligation of the entity about the results. See Article 21(3) and the Requirements.
• Guidelines and guidance. The Commission guidelines on Articles 3(4) and 4 are not law. The NIS Cooperation Group "Reference document on security measures for entities under NIS2" (June 2026) and the ENISA Technical Implementation Guidance (June 2025) are also not law. These guidelines and this guidance add no obligations. See Guidance and other sources.
• Proposals to change NIS2. The Commission proposal COM(2026) 13 of 20 January 2026 is a proposal to change NIS2 "as regards simplification measures". As of October 2026, the proposal COM(2026) 13 is not law. Article 6 of the Digital Omnibus proposal COM(2025) 837 of 19 November 2025 has a new Article 23a, a "single-entry point for incident reporting" at ENISA. As of October 2026, the Digital Omnibus proposal is also not law. See the proposals.
• Other EU reporting obligations. The Cyber Resilience Act, the GDPR, and DORA have different reporting obligations. See NIS2 and other EU reporting obligations.

Other Frameworks on the same AI Systems

Modulos also has Frameworks for DORA, ISO/IEC 27001, and the Cyber Resilience Act. These Frameworks can apply together with the NIS2 Frameworks:

• For DORA: OFF-16 and MFF-16, with the name DORA. See DORA in Modulos.
• For ISO/IEC 27001: OFF-9 and MFF-9, with the name ISO 27001. See ISO/IEC 27001 in Modulos.
• For the Cyber Resilience Act: OFF-26 and MFF-26, with the name Cyber Resilience Act. See Cyber Resilience Act in Modulos.

OFF-16, OFF-9, and OFF-26 attach to the same organization AI System as OFF-15. MFF-16, MFF-9, and MFF-26 attach to AI Systems, and these can be the same AI Systems that have MFF-15. For the Controls that are in the NIS2 Frameworks and also in other Frameworks, see Control overlap.

For financial entities, DORA can be the sector-specific Union legal act of NIS2 Article 4 (DORA Article 1(2)). See decision 3 in Decisions before you add the Frameworks. ISO/IEC 27001:2022 is a standard, and conformity with it is optional. An ISO/IEC 27001:2022 certificate does not replace compliance with the obligations of NIS2. See Articles 24 and 25.

Where to go next

NIS2 overview

Dates, structure, guidance, and the proposals to change NIS2

Supervision and enforcement

Articles 31 to 37: supervision, enforcement, and administrative fines

Scope and applicability

Articles 2 to 4 and 26 to 28: scope, the types of entity, jurisdiction, and domain name registration data

Cybersecurity measures

Articles 20 and 21, Implementing Regulation (EU) 2024/2690, and Articles 24 and 25

Incident reporting

Significant incidents, the reports of Article 23(4), and Articles 29 and 30

Reviews & Statuses

How the status of a Control changes, and how the Requirement Owner does the Review of a Requirement

Sources

• NIS2, Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 "on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)" (EUR-Lex).
  • OJ L 333, 27.12.2022, p. 80.
  • Articles 2 to 6, 8, 10, 20 to 37, 41, and 46.
• Implementing Regulation (EU) 2024/2690 of the Commission of 17 October 2024, OJ L, 2024/2690, 18.10.2024: Articles 1 to 16 and the Annex (EUR-Lex).
• DORA, Regulation (EU) 2022/2554: Article 1(2) (EUR-Lex).
• COM(2026) 13 of 20 January 2026, proposal of the Commission for a directive "amending Directive (EU) 2022/2555 as regards simplification measures" (EUR-Lex).
• Digital Omnibus proposal, COM(2025) 837 of 19 November 2025: Article 6 (EUR-Lex).

Disclaimer

This page gives general information only. It is not legal advice.

The obligations come from the national law that transposes NIS2 in each Member State and, for relevant entities, from Implementing Regulation (EU) 2024/2690. Modulos recommends the sequence of the steps above, and NIS2 does not set this sequence. The obligations in the steps stay obligations in the national law that transposes NIS2 and, for relevant entities, in Implementing Regulation (EU) 2024/2690. For the law that applies to your entity, refer to EUR-Lex, to the national law, and to a person who can give legal advice.