How do I achieve NIS2 compliance with software?
By HodeitekPublished
For security and compliance leads of essential or important entities who ask which part of NIS2 can be automated and which part remains the work of people.
Software helps organise the NIS2 work: it records measures and evidence, watches suppliers and counts the incident notification deadlines. It does not replace decisions. Risk analysis, management approval of the measures, the training of staff and the filing with the authority stay with you.
What NIS2 requires and from whom
Directive (EU) 2022/2555 applies, under Article 2, to entities in the sectors of its annexes that are at least medium-sized, and to some regardless of size. Article 3 splits them into essential and important entities. Each Member State transposes it into national law: check the law and the authority that apply to you.
The maximum fines in Article 34 are, at least, 10 million euros or 2 % of total worldwide annual turnover for essential entities, and 7 million or 1.4 % for important ones, whichever is higher.
Article 21: risk-management measures
Article 21 asks for appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach. Paragraph 2 lists ten areas, among them risk analysis, incident handling, continuity, supply chain security, cryptography and access control.
What software can do
- Keep each measure with its owner, status and evidence, and warn when the evidence expires.
- Keep a risk register and a policy library with versions.
- Reuse the same evidence across frameworks when a mapping between controls exists.
- Produce reports for management and for an audit.
What software cannot do
The measures must be proportionate to your risk, and you decide that proportionality. A tool does not configure your network, does not train your staff and does not make a measure effective just because it is recorded.
What stays the work of people
- Deciding which risks you accept and which measure is proportionate.
- Implementing the technical and organisational controls.
- Training staff and management.
- Proving that the measures work, not only that they are documented.
Source: Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23 and 34, on EUR-Lex (opens in a new tab)
Article 21(2)(d): supply chain security
Article 21(2)(d) covers the security aspects of the relationship with each direct supplier or service provider, and 21(3) asks you to take into account the vulnerabilities specific to each one and the overall quality of their products and cybersecurity practices. This is also how a company outside the direct scope can end up with NIS2 requirements in its contracts.
Software helps with the inventory, the evidence and the follow-up per supplier. It does not replace the decision to hire, keep or drop a supplier.
What the tool should do
- A supplier inventory with criticality, owner and contract.
- Evidence per supplier with a validity date, and several ways to obtain it.
- Tracking of known vulnerabilities and breaches of each supplier.
- Tracking of the clauses on incident notification towards you.
Source: Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23 and 34, on EUR-Lex (opens in a new tab); Implementing Regulation (EU) 2024/2690, technical and methodological requirements, on EUR-Lex (opens in a new tab)
Article 23: incident notification
For a significant incident, Article 23(4) sets three milestones. An early warning without undue delay and in any event within 24 hours of becoming aware. An incident notification within 72 hours. A final report no later than one month after the notification. If the authority asks, an intermediate report as well.
For the entity types it covers, Implementing Regulation (EU) 2024/2690 details what counts as a significant incident.
What software can do
- Record the incident once and count the deadlines from the moment of awareness.
- Propose a classification with its criteria and prepare drafts for each notification.
- Keep a record of who decided what and when.
Source: Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23 and 34, on EUR-Lex (opens in a new tab); Implementing Regulation (EU) 2024/2690, technical and methodological requirements, on EUR-Lex (opens in a new tab)
Article 20: management accountability
Article 20 requires the management body to approve the risk measures, oversee their application and answer for infringements, and to follow training. No software takes on that responsibility. It can give management clear data and a record of what it approved.
Source: Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23 and 34, on EUR-Lex (opens in a new tab)
How to evaluate a tool
Tools come in several types: GRC suites, incident management platforms, third-party risk platforms and integrated platforms. HodeiShield is one of the integrated ones and one option among others. According to its documentation, it classifies an incident against NIS2, DORA and GDPR with the criteria, on-screen deadline countdowns and a downloadable draft per authority, and you do the filing. It has a multi-framework crosswalk, in which one answer propagates to the equivalent controls in other frameworks, and a portal where the supplier answers through a single-use link, with no account. It measures NIS2 as coverage against its controls, not as certification.
For any tool, these are the tests worth running.
What to check in a demo
- That each Article 21 measure has an owner, a status and evidence with a validity date.
- That the supplier module covers inventory, evidence and follow-up, not only a questionnaire.
- That the 24-hour, 72-hour and one-month deadlines count on their own and the draft is editable.
- That filing with the authority stays in your hands and the tool says so clearly.
- That there is a change log and export of your data.
- That it explains where data is hosted and what it does not cover.
Frequently asked questions
- Can software make me NIS2 compliant?
- Not by itself. It can organise measures, evidence and deadlines. Management approval, risk analysis and the implementation of controls belong to the entity.
- What deadlines does NIS2 set for notifying an incident?
- An early warning within 24 hours, a notification within 72 hours and a final report no later than one month after the notification (Article 23(4)). If the authority asks, an intermediate report too.
- Does NIS2 affect me if I am neither an essential nor an important entity?
- Not directly, but if you supply an entity that is, it may require it of you by contract to meet its supply chain obligation under Article 21.
- Is an ISO/IEC 27001 certificate enough?
- The Directive does not say that a certificate shows compliance with Article 21 on its own. It works as evidence for some measures, together with the rest.
- Who files the notification with the authority?
- The entity. A tool can prepare the draft and count the deadlines, but filing through the channel set by your national authority is yours.
Related guide
How do I evaluate TPRM platforms for my sector?To compare third-party risk platforms under DORA, NIS2, ENS, HIPAA, CMMC 2.0 and SAMA or ECC, read the guide to evaluation by sector.
Sources
See how it would look with your data
In a demo we go through incident classification, deadlines and supplier follow-up with sample data, and tell you what it does not cover. A person from Hodeitek answers you.