HodeiShield®

NIS2 asks for supply-chain security: show it, supplier by supplier.

For the CISO of an essential or important entity with many ICT suppliers: HodeiShield scores the ten Article 21 measures, measures each supplier's exposure and leaves the evidence ready for whoever asks for it.

Request a demoRead the documentation (opens in a new tab)
  • Control-by-control scoring verified for NIS2
  • Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path

What NIS2 requires, in brief

NIS2 requires proportionate technical, operational and organisational measures to manage cybersecurity risk, and the notification of significant incidents.

Informational summary, not legal advice. Whether it applies to you, and on what timeline, depends on your national transposition law.

Ten minimum measures
Article 21(2) lists ten areas, from incident handling to cryptography. One of them is supply-chain security, including aspects of the relationship with each direct supplier.
Look at each supplier
Article 21(3) asks entities to take into account the vulnerabilities specific to each direct supplier and the overall quality of their products and cybersecurity practices.
Notify on time
An early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Article 23).
Management answers for it
Management bodies approve and oversee the measures and can be held liable for infringements (Article 20).

The ten measures of Article 21(2)

HodeiShield scores all ten from the evidence you supply. On the highlighted ones the platform also does work of its own.

  1. a)

    Risk analysis and information-system security

    Exposure in euros per supplier and a risk register.

    Partial
  2. b)

    Incident handling

    A single register with 24 h and 72 h deadlines calculated.

    Partial
  3. c)

    Business continuity and crisis management

    Organisational measure: evidence and tracking.

  4. d)

    Supply-chain security

    Graph, questionnaires, periodic scanning, CVEs and SBOMs for each supplier.

    Direct
  5. e)

    Acquisition, development and vulnerability handling

    Daily CVE sync and SBOMs checked against OSV.dev.

    Partial
  6. f)

    Assessing the effectiveness of measures

    Posture per framework and evidence with a validity date.

    Partial
  7. g)

    Cyber hygiene and training

    Organisational measure: evidence and tracking.

  8. h)

    Cryptography and encryption

    Technical measure in your environment: evidence and tracking.

  9. i)

    Human resources, access control and assets

    Organisational measure: evidence and tracking.

  10. j)

    Multi-factor authentication and secure communications

    Technical measure in your environment: evidence and tracking.

Measures without a mark are scored from the evidence you upload; implementing them is your organisation's job.

From each NIS2 obligation to a HodeiShield capability

With the phase of the cycle and the real scope of each one.

Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.

  • Obligation:

    Supply-chain security

    Art. 21(2)(d)

    What HodeiShield does:

    A dependency graph with 3-hop propagation and HHI concentration, token-based questionnaires with reminders and periodic external scanning of each supplier.

    Docs · Core concepts (opens in a new tab)
    PhaseSENSEPREDICT
    ScopeDirect
  • Obligation:

    Vulnerabilities and quality of practices of each direct supplier

    Art. 21(3)

    What HodeiShield does:

    A 0 to 100 risk score per supplier combining scan, questionnaire and known CVEs, with a register of decisions about the supplier.

    Docs · Risk engine (opens in a new tab)
    PhaseSENSEPREDICT
    ScopeDirect
  • Obligation:

    Vulnerability handling and disclosure

    Art. 21(2)(e)

    What HodeiShield does:

    Daily CVE sync (NVD, CISA KEV and EPSS, the likelihood of exploitation) and supplier SBOMs checked against OSV.dev. Coordinated disclosure of your own vulnerabilities is not part of it.

    Docs · SBOM, CVE and alert chain (opens in a new tab)
    PhaseSENSE
    ScopePartial
  • Obligation:

    Risk analysis

    Art. 21(2)(a)

    What HodeiShield does:

    FAIR ALE in euros as a point estimate, with a simulated uncertainty band (uncalibrated), and a deterministic scenario simulator.

    Docs · Risk engine (opens in a new tab)
    PhasePREDICT
    ScopePartial
  • Obligation:

    Early warning within 24 h and notification within 72 h

    Art. 23

    What HodeiShield does:

    Records the incident once, classifies it and calculates the deadlines. You send the notification to the authority or CSIRT.

    Demo · incident register
    PhaseOutside the cycle
    ScopePartial
  • Obligation:

    Approval and oversight by management

    Art. 20

    What HodeiShield does:

    An executive dashboard and PDF reports with posture, obligations and the remediation roadmap.

    Docs · Compliance (opens in a new tab)
    PhasePREDICT
    ScopePartial
  • Obligation:

    Organisational and technical measures in the remaining points

    Art. 21(2)(c)(f)(g)(h)(i)(j)

    What HodeiShield does:

    Evidence with owner, validity and status, a policy library and a prioritised roadmap. The platform scores; it does not implement the measure.

    Docs · Compliance (opens in a new tab)
    PhaseSENSEPREDICT
    ScopePartial
  • Obligation:

    Show your status to a customer or an authority

    Art. 21

    What HodeiShield does:

    A Trust Center with public or restricted access (NDA / manual review), and an ATTEST attestation of the band per framework. It proves integrity and origin, not that the evidence is true.

    Docs · ATTEST verifier (opens in a new tab)
    PhaseATTEST
    ScopePartial

What HodeiShield does not do with NIS2

Explicit limits.

  • It does not determine whether you are essential or important

    That depends on your sector, size and national law. Your organisation decides it with legal advice.

  • It does not implement the measures or notify for you

    It scores the measures and calculates deadlines. Applying the cryptography or sending the early warning is still yours.

  • It does not monitor suppliers continuously

    Supplier scans are periodic, via external sources, and the agent reports per cycle. It is not real-time.

  • The score is not a conformity

    It guides your work. It does not replace an assessment by the competent authority and does not guarantee compliance.

Questions about NIS2

What is most often asked before a demo.

What does NIS2 ask about my suppliers?

It lists supply-chain security among the minimum measures (Article 21(2)(d)) and asks you to consider the vulnerabilities of each direct supplier and the quality of their cybersecurity practices (Article 21(3)).

Does NIS2 apply to me?

It depends on your sector (Annexes I and II), your size and national transposition. HodeiShield does not determine it; your legal counsel pins it down from the current law.

How does it help with the 24 and 72 hour deadlines?

You record the incident once, classify it and the platform calculates the applicable deadlines. Sending the notification to the competent authority is up to you.

Does HodeiShield make me NIS2-compliant?

No. It measures your posture against the ten measures, measures your suppliers and organises the evidence. Complying means implementing the measures and having evidence that backs them.

Is supplier scoring continuous?

No. Scans are periodic through external sources, suppliers answer the questionnaires themselves and the CVE sync is daily.

Related solutions

Other use cases

Put your suppliers in order before the next request

In the demo we walk through Article 21 with a sample case: from the supplier with a CVE in KEV to the evidence you can show.

No commitment. Sample data, never from other customers.

Request a demoRead the documentation (opens in a new tab)