Regelefterlevnad · Compliance
Everything we deliver
is NIS2-ready.
The technical and organisational measures Article 21 asks for are built into how we work by default, and the evidence for them is generated as we go instead of being reconstructed the week before an audit.
- Directive
- (EU) 2022/2555
- In force since
- 17 October 2024
- Measures
- Article 21(2), (a)–(j)
- Reporting
- 24 h · 72 h · 1 month
NIS2 is the EU's network and information security directive. Its biggest change is that it made management personally accountable.
Directive (EU) 2022/2555 replaced the original NIS directive, widened the sectors in scope, and required member states to transpose it into national law by 17 October 2024. Where its predecessor was largely advisory, NIS2 attaches supervisory powers, administrative fines, and obligations that fall on the management body rather than on the IT department.
Two parts of it drive most of the work. Article 21 sets out ten categories of risk-management measure that in-scope entities must take. Article 23 sets reporting deadlines short enough that meeting them depends on how the systems are built: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within a month.
A policy document will not get you through a 24-hour clock. Logging, monitoring and a runbook that a person can follow at three in the morning will, which is why an infrastructure company has a page about NIS2.
Kartläggning · The mapping
Article 21(2), measure
by measure.
The ten categories the directive names, and what is already in place when we hand a system over. This is the table we walk clients through, and the one their assessor usually wants.
The evidence checklist: what an assessor asks to see for each measure
| Article 21(2) | What the directive asks for | How our delivery answers it |
|---|---|---|
| (a) | Risk analysis and information system security policies | Architecture documented in the repository; the threat model and its decisions are written down and can be reviewed |
| (b) | Incident handling | Monitoring, alerting and log retention specified up front, with runbooks in plain language and an on-call path that has been rehearsed |
| (c) | Business continuity, backup management, disaster recovery | Nightly encrypted backups to a second European region, restore-tested monthly with the evidence sent to you; a machine is defined in a file, so recovery is a rebuild from that file |
| (d) | Supply chain security | Open-source components with named upstreams, pinned by hash in Nix; the full dependency set can be enumerated, which most estates cannot do |
| (e) | Security in acquisition, development and maintenance; vulnerability handling | Everything through code review, reproducible builds, and a patch path that is a single commit, so applying a fix does not need a change-management project |
| (f) | Policies to assess the effectiveness of the measures | Restore tests, link and budget checks in CI, and firewall rules reviewed as code, all producing evidence on a schedule rather than on request |
| (g) | Cyber hygiene and training | Handover pairing, written runbooks, and the hackathon and workshop practice we have run since 2015 |
| (h) | Cryptography and encryption | WireGuard between every site and host, TLS terminated by us, full-disk encryption on the laptops, keys held by you |
| (i) | Human resources security, access control, asset management | SSO against your directory, enforced 2FA, per-device revocation, and an asset inventory that is the Nix configuration itself |
| (j) | Multi-factor authentication and secured communications | MFA enforced on everything we deploy; internal traffic on a private mesh rather than the public internet |
Varför det hänger ihop · Why it fits
The evidence is a by-product,
not a project.
The expensive part of any compliance regime is rarely the controls themselves. It is demonstrating them: reconstructing, months later, what a system looked like, who changed it, and whether the backup everyone was relying on has ever been restored.
A declarative estate answers those questions from history rather than from memory. We did not add this for NIS2. It follows from choices we would make anyway, and it happens to be what an assessor asks for.
- NixOS: what a server ran on any given day is in the
git log - pf and WireGuard: network policy reviewed as code, with an author and a rationale per rule
- Nix: dependencies pinned by hash, so the supply chain can be enumerated
- EU hosting: data residency and jurisdiction are stated as facts
- Local models: no prompt leaves the perimeter, so AI adoption does not reopen the question
the assessor's question
# "What was running on this host # on 14 March, and who approved it?" $ git log --since="2026-03-13" \ --until="2026-03-15" \ -- hosts/you/ commit a3f19c4 Author: "K. Lindqvist" Date: 2026-03-14 09:12 +0100 Approved-by: "M. Petrescu" pf: restrict admin SSH to wg0 $ nix path-info -r /run/current-system \ | wc -l 412 # the complete dependency set # Answered in two commands.
Nackdelar · The downsides
What “NIS2-ready” does not mean.
We are an engineering studio, and this page should not imply more than that. Specifically:
- It is not a certification. NIS2 has no certificate to hold up, so any vendor selling you one is selling you something else.
- It does not tell you whether you are in scope. Whether you are an essential or important entity depends on your sector, your size and your national transposition, which differs between member states. That is a legal determination, not an engineering one.
- It covers what we build, not your whole organisation. We can make the systems we deliver defensible. Your HR processes, your supplier contracts, your training programme and your management-body governance are outside that boundary.
- Measures are not the same as an assessment. Having the controls and having someone competent verify them against the directive are different exercises, and we should not be the ones marking our own homework on the second.
- The clock needs people. A 24-hour early warning requires somebody rostered to notice. We build the alerting; who answers the phone is your decision.
What we do claim is narrower and, we think, more useful. The systems we hand over already implement the technical measures in Article 21, and they produce the evidence for them continuously rather than on demand.
Nästa steg · The compliance side
For the assessment itself,
talk to Chen.ist.
Chenborg is the SaaS and infrastructure arm of Chenist Cyber Security. We build the systems. The compliance practice next door does the part we do not: scoping analysis, controls assessment, gap identification and a compliance roadmap, plus CISO as a service where you need the role rather than the report.
If you are working out whether NIS2 applies to you, or what a gap analysis would find, that is the conversation to have first. It will also tell you which parts of this page are relevant to you and which are not.