Who NIS2 covers, what management must personally do, the ten minimum security measures, and the 24-hour incident-reporting ladder — cited to the Directive article by article.