An EU subsidiary may have direct NIS2 obligations. Meeting them may require support from your U.S. security team, especially where systems and services are shared. That does not automatically put your entire corporate group directly in scope.
A customer’s security questionnaire is a different matter. It may reflect the customer’s obligations rather than your own.
For U.S. pharmaceutical and life sciences companies, separating those situations is the first useful step. Before building a compliance plan, establish what applies, to which entity, and why.
NIS2 expressly includes certain pharmaceutical manufacturing activities and research and development of medicinal products. Other life sciences businesses need to check the category that matches their actual activities. Applicability generally depends on the entity’s activities, size, and relevant national law, with some exceptions regardless of size.
Having an EU office alone does not settle the question. Neither does looking only at that office’s headcount: corporate-group relationships may affect the size assessment.
Bring Legal and Security together early. Legal can interpret applicability and national requirements. Security and operations can explain how the business works, including the shared infrastructure supporting EU operations.
Map each relevant EU legal entity to its activities, then assess the applicable national requirements. Document which entities have direct obligations and where other teams need to provide operational support.
An EU customer’s NIS2 obligations do not automatically become yours. However, NIS2’s supply-chain security requirements can lead customers to request stronger security evidence or introduce contractual requirements for suppliers.
A questionnaire requests evidence. A contract may create an obligation. Neither, by itself, establishes that your company is directly in scope.
Keep those distinctions visible in your roadmap. Your team should be able to explain whether work addresses a legal requirement, a contractual commitment, or a customer request.
NIS2 requires management bodies to approve cybersecurity risk-management measures and oversee implementation. Their members must also receive training. Liability provisions need to be understood under the applicable national law.
Make the leadership conversation specific. Identify where funding is needed, who owns a shared service, and which unresolved dependency could interrupt operations.
Incident reporting deserves its own rehearsal. For significant incidents, NIS2 generally requires an early warning within 24 hours of awareness and an incident notification within 72 hours, both without undue delay. Both clocks run from awareness, not from the previous submission. A final report is generally due within one month after the incident notification, with provisions for ongoing incidents.
Agree who determines reportability and who submits notifications. Test those handoffs before an incident forces the issue.
Side note: if this is when you realize you have Incident Response Plan gaps to fill, we can help.
Supply-chain security is part of NIS2’s risk-management requirements, including security-related relationships with direct suppliers and service providers.
Start with suppliers whose failure could interrupt a critical operation, such as manufacturing or laboratory work.
An assessment may describe a supplier’s controls. Your team still needs to understand what happens if the service becomes unavailable. Identify recovery dependencies and test whether the fallback will work.
A completed questionnaire is useful evidence. It is not a recovery plan.
Before opening another compliance workstream, compare your existing security program with the requirements applicable to each entity.
Use existing NIST CSF 2.0 or ISO/IEC 27001 work to organize the assessment, rather than treating a framework mapping as the compliance conclusion.
Some findings may require new controls. Others may reveal unclear ownership or recovery plans nobody has tested. Build the roadmap around those findings so leadership can see what needs funding now and what can follow.
The goal is readiness you can demonstrate when operations are under pressure.
Reveal Risk can help your security team work with Legal to clarify NIS2 exposure and turn the findings into a practical readiness roadmap that builds on your existing program.