Does SOC-CMM certify NIS2?

No. SOC-CMM does not certify NIS2 compliance. It helps evidence operational maturity and prioritize improvements, and prepares the evidence an auditor or legal advisor will need in a NIS2 conversation.

Who has to comply with NIS2?

Broadly, medium and large public or private entities providing services or carrying out activities in the EU across the 18 sectors listed in Annexes I and II of the directive. Exemptions by entity or size are set in each Member State's transposition law.

Yes for entities within scope. The directive entered into force on 16 January 2023 and required transposition into national law before 17 October 2024. Some Member States completed transposition later, which creates practical timing differences; obligations apply from the date set by each country's transposition.

When does NIS2 take effect in Spain?

NIS2 has been in force at EU level since 16 January 2023. Material application in Spain depends on the national transposition; INCIBE-CERT publishes the schedule, competent authorities and operational deadlines. For a SOC, the date that matters is the one fixing material obligations (technical measures, notification, supervision) in the Spanish text.

Which are the NIS2 essential entities?

Essential entities are medium and large organizations in the most critical sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, B2B ICT service management, public administration and space. Important entities cover postal and courier services, waste management, chemicals, food, critical manufacturing, digital providers and research. The practical difference lies in supervision (proactive vs. reactive) and the ceiling of fines.

How does NIS2 connect to ENS in Spain?

The Spanish Esquema Nacional de Seguridad (Royal Decree 311/2022) offers a common language and a catalog of measures that many entities already apply and that can be used as partial evidence for NIS2. CCN publishes a specific compliance profile for NIS2-scoped entities (PCE-NIS2). It is not equivalent to NIS2 certification, but it accelerates the conversation.

What is the maximum NIS2 fine for an essential entity?

Up to 10 million euros or 2% of worldwide annual turnover of the previous fiscal year, whichever is higher. For important entities the ceiling is 7 million euros or 1.4%. There is also personal liability of the management body and possible temporary suspensions.

What is the deadline to notify a significant incident under NIS2?

24 hours for the early warning, 72 hours for the notification with initial assessment and 1 month for the final report. The CSIRT may request an intermediate report at any time. SOC-CMM measures whether that chain has verifiable evidence, not only whether it exists as a procedure.

How many sectors are covered by NIS2?

18 sectors, split between essential entities (energy, transport, banking, financial markets, health, water, digital infrastructure, public administration, space) and important entities (postal, waste, chemicals, food, critical manufacturing, digital providers, research).

What does NIS2 require from the management body?

Approving risk-management measures, overseeing implementation and receiving training to understand cyber risk. The directive contemplates personal liability and, in some Member States, possible temporary disqualifications if non-compliance is severe or repeated.

SOC-CMM and NIS2: SOC maturity evidence

How SOC-CMM supports SOC capability, gaps and continuous improvement conversations around NIS2 requirements.

Request a SOC-CMM assessment View assessment

Abstract NIS2 architecture rendered in frosted-glass shapes with glowing royal-blue accents on a near-white background

The SOC angle inside NIS2

NIS2 is broad. The SOC-CMM angle is specific: evidencing that the SOC can detect, respond, report and improve with measurable capabilities.

Evidence that usually matters

Playbooks, incident traceability, monitoring coverage, reporting, escalation paths, service reviews and continuous improvement mechanisms.

Evidence	NIS2 reading	SOC-CMM use
Playbooks and escalation	Organized response capability.	Processes and Services.
Incident traceability	Record of decisions and accountability.	Technology, Processes and Business.
Executive reporting	Governance and oversight.	Business and Services.
Service reviews	Demonstrable continuous improvement.	Services and Business.

Operational maturity versus formal compliance

SOC-CMM does not certify legal compliance, but it helps sustain operational conversations with auditors, regulators and boards. For financial entities, DORA adds specific operational-resilience and TLPT obligations that share the same SOC maturity evidence base.

Sectors covered by NIS2

NIS2 distinguishes essential and important entities across 18 sectors. The directive expanded the perimeter substantially compared with NIS1, adding public administration, healthcare, space, food, manufacturing of critical products and digital service providers. The actionable read for a SOC is not the list itself but mapping which supported services fall into each category, because obligations, fines and deadlines differ.

Category	Example sectors	NIS2 treatment
Essential entities	Energy, transport, banking, financial markets, health, water, digital infrastructure, public administration, space.	Proactive supervision and higher fines.
Important entities	Postal services, waste management, chemicals, food, critical manufacturing, digital providers, research.	Reactive supervision after incident or complaint.
Exceptions	Small local public administration, defence and national security per Member State transposition.	Verify each Member State's transposition.

Fines and personal liability of management bodies

NIS2 raises fines and, crucially, shifts part of the responsibility to the management body. Essential entities can face administrative fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. Important entities, up to 7 million euros or 1.4%. In addition, the management body must approve risk management measures, oversee implementation and receive training to understand cyber risk; Member States may temporarily suspend certifications, authorizations or executive responsibilities in cases of repeated non-compliance.

Incident notification deadlines

The directive sets a three-step notification chain with verifiable milestones. The SOC must demonstrate the chain runs with evidence: timestamp, content, escalation, approval. SOC-CMM places that evidence inside Incident management (Services) and Reporting (Process).

Milestone	Deadline	Minimum content
Early warning	24 hours from awareness of a significant incident	Suspected malicious cause, cross-border impact, affected scope.
Incident notification	72 hours from awareness	Initial severity assessment, impact, indicators of compromise.
Intermediate report	Upon request by CSIRT or authority	Response status and impact update.
Final report	1 month from notification	Root cause, measures adopted, definitive cross-border impact.

Mapping NIS2 obligations to SOC-CMM domains

Article 21 lists minimum risk-management measures. A serious SOC-CMM assessment ties each obligation to concrete evidence in one or more domains. This table is a starting guide for conversations with auditor or legal counsel.

NIS2 obligation (Art. 21)	Primary SOC-CMM domain	Typical evidence
Risk analysis and information system security policies	Business	Risk register, charter, drivers, stakeholders documented.
Incident handling	Services	Playbooks, records, post-mortems, notification chain.
Business continuity and crisis management	Business + Services	Tested BCP/DR plans, RTO/RPO agreed with business.
Supply chain security	Business + Services	Critical vendor inventory, log coverage, contractual clauses.
Security in acquisition and development	Process + Technology	SDLC processes, vulnerability management, hardening.
Encryption, cryptography and MFA policies	Technology	MFA coverage, key management, encrypted transport.
Basic hygiene and cybersecurity training	People	Training programme, coverage metrics, phishing tests.
Vulnerability management	Services	Remediation SLA by criticality, follow-up evidence.
Effectiveness review of measures	Process + Business	SOC-CMM reassessment, continuous improvement metrics.

2026 context worth including in scope

The WEF Global Cybersecurity Outlook 2026 (804 leaders, 92 countries) describes a landscape where 65% of large enterprises name third-party and supply chain risks as the biggest resilience obstacle, up from 54% the prior year. Uneven NIS2 transposition across Member States and geopolitical pressure (91% of the largest companies adjusting cyber posture) make the SOC central to the conversation. A SOC-CMM assessment separates what is already demonstrable from what needs investment, and translates it into actionable language for the board.

NIS2 in Spain: National Security Framework and Royal Decree 311/2022

In Spain, the Esquema Nacional de Seguridad (ENS, Royal Decree 311/2022) has become a practical lever for evidencing many of the obligations NIS2 transposes to the corporate perimeter. CCN-CERT publishes a specific compliance profile for entities in scope of NIS2 that reuses ENS language. For the SOC this changes the assessment conversation: in addition to the SOC-CMM domain scoring, it is worth mapping the ENS technical measures the SOC already supports (monitoring, incident handling, logging) against those that require reinforcement before presenting the matrix to the board or regulator.

Frequently asked questions

Independent by design

Primedefence assesses against the SOC-CMM and nothing else. The model is free, open and cited by MITRE, the NCSC and ENISA. The assessment is delivered by an external third party with no stake in the result and no SOC operation of its own, so the finding answers to your interest alone.

Request a SOC-CMM assessment

Keep reading

SOC-CMM complete SOC-CMM guide independent SOC-CMM assessment 2026 SOC-CMM statistics talk to a SOC-CMM consultant