<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1","L2/L3 → NIS2 links: implements, explains"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":5,"total":5,"capped":false,"cap":2000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/nis2/map","url":"https://www.headlesslaw.com/nis2/map","title":"Map of the law — NIS2","work_id":"nis2","date_state":"current","as_of":"2026-11-02"},"act":{"work_id":"nis2","name":"NIS2","path":"/nis2","title":"Directive (EU) 2022/2555","celex":"32022L2555"},"select":null,"counts":{"articles_with_links":5,"l2_nodes":1,"l3_nodes":3,"edges":5,"act_level_edges":0,"undated_edges":1,"not_in_force_sources":0}} -->
# Map of the law — NIS2

All links as a table (5)

| Article | Level | Document | Link type | From | Until |
|---|---|---|---|---|---|
| [Article 3](https://www.headlesslaw.com/nis2/articles/3) | Level 3 | [C(2023) 6070 — Guideline — Entity lists [final]](https://www.headlesslaw.com/nis2/level-3/guidelines/commission-c-2023-6070-article-3-4-entity-lists) · not legislation | Explains | 13 Sep 2023 | — |
| [Article 4](https://www.headlesslaw.com/nis2/articles/4) | Level 3 | [C(2023) 6068 — Guideline — Sector-specific acts [final]](https://www.headlesslaw.com/nis2/level-3/guidelines/commission-c-2023-6068-article-4-sector-specific-acts) · not legislation | Explains | 13 Sep 2023 | — |
| [Article 21](https://www.headlesslaw.com/nis2/articles/21) | Level 2 | [2024/2690 — Implementing act — Cybersecurity risk-management measures [in force]](https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures) · binding | Implements | 7 Nov 2024 | — |
| [Article 23](https://www.headlesslaw.com/nis2/articles/23) | Level 2 | [2024/2690 — Implementing act — Cybersecurity risk-management measures [in force]](https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures) · binding | Implements | 7 Nov 2024 | — |
| [Article 28](https://www.headlesslaw.com/nis2/articles/28) | Level 3 | [NIS Cooperation Group — Guideline — Recommendations for implementing NIS2 Article 28 [final]](https://www.headlesslaw.com/nis2/level-3/guidelines/nis-cg-2024-article-28-domain-registration) · not legislation | Explains | No start date held | — |