NIS2 and NCCC: A Practical Compliance Mapping for Ukrainian Tech Companies

Ukraine is simultaneously building its own national cybersecurity framework — the National Cybersecurity Coordination Centre (NCCC) mandatory requirements — while preparing for EU membership, which will require transposing NIS2. For companies that operate in both regulatory spaces, the good news is that roughly two-thirds of the control requirements overlap. The bad news is that the remaining third diverges in ways that have real budget and operational implications.

This guide provides a practical mapping of the two frameworks, identifies the highest-value shared controls, and explains where to make targeted investments to satisfy both simultaneously.

What Each Framework Covers

NIS2 (EU Directive 2022/2555)

NIS2 replaced the original NIS Directive in January 2023 and became enforceable across EU member states by October 2024. It applies to essential and important entities across 18 sectors — including energy, transport, health, digital infrastructure, and "manufacturing of critical products." The threshold for inclusion is roughly 50+ employees or €10M+ annual turnover, though member states may extend scope further.

Key features: 10 minimum security measures under Article 21, 24-hour/72-hour incident reporting obligations, personal liability for management board members, maximum fines of €10M or 2% of global turnover for essential entities.

Ukraine's NCCC Framework

Ukraine's NCCC mandatory security requirements apply to critical infrastructure operators and state information systems under Law 2163-IX (July 2022) and subsequent Cabinet decrees. The framework categorises subject systems into three classes: I (highest criticality, state/military systems), II (critical infrastructure, energy, finance, transport), and III (significant public impact systems).

Requirements are structured around a mandatory security baseline, continuous monitoring obligations, incident notification to the State Centre for Cyber Defence (SCCD), and annual audits for Class I/II systems.

The Shared Control Foundation

Both frameworks require the same foundational capabilities. If you have already implemented these for NIS2, you satisfy the corresponding NCCC requirement with minimal additional work:

| Control Domain | NIS2 Article 21 Ref. | NCCC Section | Gap | |---|---|---|---| | Risk assessment and policy | Art. 21(2)(a) | §4.1–4.3 | None | | Incident handling procedures | Art. 21(2)(b) | §6.1–6.4 | Reporting timelines differ | | Business continuity and backup | Art. 21(2)(c) | §5.2–5.3 | RPO/RTO thresholds differ | | Supply chain security | Art. 21(2)(d) | §7.1–7.4 | NCCC is more prescriptive | | Vulnerability handling | Art. 21(2)(e) | §8.1 | None | | Access control and MFA | Art. 21(2)(i) | §3.3–3.5 | None | | Encryption in transit and at rest | Art. 21(2)(h) | §3.6 | Algorithm requirements differ | | Security awareness training | Art. 21(2)(g) | §9.1 | Frequency requirements differ | | Network segmentation | Art. 21(2)(f) | §3.8–3.9 | None | | Asset inventory | Art. 21(2)(e) | §2.1 | None |

A well-scoped ISO 27001 implementation covers approximately 80% of both frameworks' technical control requirements.

Where NIS2 Goes Further

Management accountability. Article 20 of NIS2 makes management bodies personally liable for compliance failures. Board members must approve cybersecurity risk management measures and undergo regular training. NCCC has no equivalent personal liability mechanism — the obligation rests with the organisation, not individuals.

Cross-border incident coordination. NIS2 requires essential entities to notify their national CSIRT and, for incidents with cross-border impact, coordinate through ENISA's CyCLONe network. NCCC notification flows are purely domestic (to SCCD and sector-specific authorities).

Penetration testing obligations. NIS2's implementing regulation (under development) will mandate threat-led penetration testing (TLPT) for essential entities — similar to TIBER-EU. NCCC currently requires vulnerability scanning but does not mandate adversarial testing at the TLPT standard.

Where NCCC is More Prescriptive

Cryptographic standards. NCCC mandates specific Ukrainian national cryptographic standards (DSTU 4145, DSTU 7564) for certain government-interfacing systems. NIS2 references "state of the art" encryption without prescribing specific algorithms. Companies that need government system integration in Ukraine must implement DSTU-compliant modules even if their NIS2 programme uses standard AES/RSA.

Supply chain incident reporting. NCCC §7.3 requires organisations to report supply chain incidents to SCCD within 4 hours of detection — faster than NIS2's 24-hour initial notification window. For Class I systems, NCCC also mandates pre-approval of critical software suppliers.

Continuous monitoring. NCCC Class I and II systems must maintain continuous security monitoring with logs forwarded to state infrastructure. NIS2 requires monitoring capability but does not mandate log forwarding to a government entity.

Annual external audits. NCCC Class I/II organisations face mandatory annual external audits by accredited Ukrainian firms. NIS2 allows self-assessment for important entities with third-party audits only required when regulators request them.

A Dual-Compliance Strategy That Works

The most efficient path to satisfying both frameworks simultaneously uses the following structure:

Phase 1 — Shared Foundation (Months 1–3)

Build once, apply to both:

• ISO 27001-aligned information security management system (ISMS)
• Asset inventory with criticality classification
• Risk assessment and treatment plan
• Access control policy (MFA, privileged access management)
• Incident response plan and playbook
• Business continuity and disaster recovery plan
• Security awareness training programme

This phase satisfies the overlapping requirements and provides audit evidence for both regulators.

Phase 2 — NIS2-Specific (Months 4–5)

Targeted additions:

• Board training documentation and approval records (Article 20 compliance)
• Update incident notification workflow to ENISA/national CSIRT procedures
• Supply chain security register with risk ratings per third-party supplier
• Penetration testing programme (prepare for TLPT requirements)

Phase 3 — NCCC-Specific (Months 5–7)

Targeted additions:

• DSTU cryptographic library integration for state-interfacing systems
• 4-hour supply chain incident reporting workflow to SCCD
• SIEM log forwarding to state monitoring infrastructure (for Class I/II)
• External audit scoping and auditor selection

Ongoing Operations

• Quarterly vulnerability scanning and annual penetration test
• 24-hour (NIS2) / 4-hour (NCCC supply chain) incident notification capability
• Annual board review and sign-off (NIS2 Article 20)
• Annual external audit (NCCC Class I/II)

The Cost of Running Them Separately

Organisations that treat NIS2 and NCCC as separate compliance projects typically spend 40–60% more time and budget than those that architect a unified control set first. The most common failure patterns are:

Duplicate documentation. Maintaining two sets of security policies, one calibrated to NIS2 language and one to NCCC language, creates version control problems and introduces genuine compliance drift over time.

Separate incident response procedures. Maintaining two incident notification workflows (with different timelines, different recipients, and different evidence requirements) is operationally dangerous. A single workflow that satisfies both — 4-hour SCCD notification for supply chain incidents, 24-hour NIS2 notification for significant incidents — is more reliable.

Siloed audits. Commissioning separate NIS2 gap assessments and NCCC compliance audits means two teams reviewing the same infrastructure independently. A single audit that maps evidence to both frameworks costs roughly 60% of the combined price.

Practical Next Steps

If you are starting from a low baseline, the 90-day readiness checklist in our NIS2 buyer's guide and NCCC buyer's guide provide a sequenced task list. The guides also cover the specific documentation artefacts that regulators request during audits.

If you are already ISO 27001 certified, the gap to NIS2 + NCCC dual compliance is typically 3–5 months of focused effort, primarily in the areas of management accountability documentation, incident notification workflows, and NCCC-specific cryptographic requirements.

AmonSul's compliance advisory team runs dual-compliance projects from gap assessment through audit readiness. Contact us to discuss your specific scope.