Regelefterlevnad · Compliance
Everything we deliver
is NIS2-ready.
Not as a badge on a brochure. The technical and organisational measures Article 21 asks for are built into how we work by default — and, more to the point, the evidence for them is generated as a by-product rather than reconstructed the week before an audit.
- Directive
- (EU) 2022/2555
- In force since
- 17 October 2024
- Measures
- Article 21(2), (a)–(j)
- Reporting
- 24 h · 72 h · 1 month
NIS2 is the EU's network and information security directive, and its significant change is that it made management personally accountable.
Directive (EU) 2022/2555 replaced the original NIS directive, widened the sectors in scope, and required member states to transpose it into national law by 17 October 2024. Where its predecessor was largely advisory, NIS2 attaches supervisory powers, administrative fines, and obligations that fall on the management body rather than on the IT department.
Two parts of it drive most of the work. Article 21 sets out ten categories of risk-management measure that in-scope entities must take. Article 23 sets reporting deadlines that are short enough to be an architecture problem rather than a paperwork one: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within a month.
A 24-hour clock is not something you satisfy with a policy document. You satisfy it with logging, monitoring and a runbook that a real person can follow at three in the morning — which is why this belongs on an infrastructure company's website at all.
Kartläggning · The mapping
Article 21(2), measure
by measure.
The ten categories the directive names, and what is already in place when we hand a system over. This is the table we walk clients through, and the one their assessor usually wants.
The evidence checklist — what an assessor asks to see for each measure
| Article 21(2) | What the directive asks for | How our delivery answers it |
|---|---|---|
| (a) | Risk analysis and information system security policies | Architecture documented in the repository; the threat model and its decisions are written down and reviewable, not folklore |
| (b) | Incident handling | Monitoring, alerting and log retention specified up front, with runbooks in plain language and an on-call path that has been rehearsed |
| (c) | Business continuity, backup management, disaster recovery | Nightly encrypted backups to a second European region, restore-tested monthly with the evidence sent to you; a machine is a file, so recovery is a rebuild rather than an archaeology exercise |
| (d) | Supply chain security | Open-source components with named upstreams, pinned by hash in Nix; a dependency set that can actually be enumerated, which is the part most estates cannot do |
| (e) | Security in acquisition, development and maintenance; vulnerability handling | Everything through code review, reproducible builds, and a patch path that is a commit — so applying a fix is not a change-management project |
| (f) | Policies to assess the effectiveness of the measures | Restore tests, link and budget checks in CI, and firewall rules reviewed as code — measures that produce evidence on a schedule rather than on request |
| (g) | Cyber hygiene and training | Handover pairing, written runbooks, and the hackathon and workshop practice we have run since 2015 |
| (h) | Cryptography and encryption | WireGuard between every site and host, TLS terminated by us, full-disk encryption on the laptops, keys held by you |
| (i) | Human resources security, access control, asset management | SSO against your directory, enforced 2FA, per-device revocation, and an asset inventory that is the Nix configuration itself |
| (j) | Multi-factor authentication and secured communications | MFA enforced on everything we deploy; internal traffic on a private mesh rather than the public internet |
Varför det hänger ihop · Why it fits
The evidence is a by-product,
not a project.
The expensive part of any compliance regime is rarely the controls. It is demonstrating them — reconstructing, months later, what a system looked like, who changed it, and whether the backup anybody was relying on has ever actually been restored.
A declarative estate answers those questions from history rather than from memory. That is not something we added for NIS2; it is a consequence of choices we would make anyway, and it happens to be exactly what an assessor asks for.
- NixOS — what a server ran on any given day is a
git log, not a guess - pf and WireGuard — network policy reviewed as code, with an author and a rationale per rule
- Nix — dependencies pinned by hash, so the supply chain can be enumerated
- EU hosting — data residency and jurisdiction stated as fact, not argued
- Local models — no prompt leaves the perimeter, so AI adoption does not reopen the question
# "What was running on this host # on 14 March, and who approved it?" $ git log --since="2026-03-13" \ --until="2026-03-15" \ -- hosts/you/ commit a3f19c4 Author: "K. Lindqvist" Date: 2026-03-14 09:12 +0100 Approved-by: "M. Petrescu" pf: restrict admin SSH to wg0 $ nix path-info -r /run/current-system \ | wc -l 412 # the complete dependency set # Answered in two commands. # That is the whole argument.
Ärligt talat · Honestly
What “NIS2-ready” does not mean.
We are an engineering studio, and it would be easy to let this page imply more than it should. So, precisely:
- It is not a certification. NIS2 has no certificate to hold up. Any vendor selling you one is selling you something else.
- It does not tell you whether you are in scope. Whether you are an essential or important entity depends on your sector, your size and your national transposition — which differs between member states. That is a legal determination, not an engineering one.
- It covers what we build, not all of you. We can make the systems we deliver defensible. Your HR processes, your supplier contracts, your training programme and your management-body governance are outside that boundary.
- Measures are not the same as an assessment. Having the controls and having someone competent verify them against the directive are different exercises, and the second is not one we should mark our own homework on.
- The clock needs people. A 24-hour early warning requires somebody rostered to notice. We build the alerting; who answers the phone is your decision.
What we do claim is narrower and, we think, more useful: the systems we hand over already implement the technical measures in Article 21, and they produce the evidence for them continuously rather than on demand.
Nästa steg · The compliance side
For the assessment itself,
talk to Chen.ist.
Chenborg is the SaaS and infrastructure arm of Chenist Cyber Security. We build the systems; the compliance practice next door does the part we deliberately do not — scoping analysis, controls assessment, gap identification and a compliance roadmap, plus CISO as a service where you need the role rather than the report.
If you are working out whether NIS2 applies to you, or what a gap analysis would find, that is the conversation to have first. It will also tell you which parts of this page are relevant to you and which are not.