EU NIS2 Directive

Network and information system security: supply chain measures, vulnerability management.


Short name	NIS2
Region	Europe
Country or scope	European Union
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NIS2

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for NIS2.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NIS2 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NIS2-21.2D` Supply Chain Security	Risk-management measures must address supply chain security including the security aspects of relationships with direct suppliers, presupposing known suppliers for software components (NIS2 Art. 21(2)(d))	Scan
`NIS2-21.2E` Vulnerability Handling and Disclosure	Measures must cover security in acquisition, development and maintenance including vulnerability handling, which requires components identifiable against vulnerability data (NIS2 Art. 21(2)(e))	Scan
`NIS2-21.2A` Risk Analysis Foundation	Policies on risk analysis and system security presuppose an inventory of the software components comprising network and information systems (NIS2 Art. 21(2)(a))	Scan
`NIS2-23` Incident Reporting Readiness	Significant incidents must be reported within tight deadlines (24h early warning), which requires knowing the versions of affected software to assess impact quickly (NIS2 Art. 23)	Scan
`NIS2-CVD-CONTACT` Coordinated Disclosure Contact	NIS2 promotes coordinated vulnerability disclosure, which requires a reachable contact for the software's producer in its documentation (NIS2 Art. 12 and Art. 21(2)(e), coordinated vulnerability disclosure provisions)	Scan
`NIS2-INTEGRITY` System Integrity Measures	Measures protecting the security of network and information systems include verifying the integrity of the software deployed, supported by component hashes (NIS2 Art. 21(2), security measures)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NIS2-ART20`	Establish Cybersecurity Governance at Management Level
`NIS2-ART21A`	Implement Policies on Risk Analysis and Information System Security
`NIS2-ART21B`	Implement Incident Handling Procedures
`NIS2-ART21C`	Implement Business Continuity and Disaster Recovery
`NIS2-ART21D`	Manage Supply Chain Security
`NIS2-ART21E`	Implement Secure Network and Information Systems Acquisition and Development
`NIS2-ART21F`	Implement Policies and Procedures to Assess Cybersecurity Measures Effectiveness
`NIS2-ART21G`	Implement Cybersecurity Hygiene and Training
`NIS2-ART21H`	Implement Cryptographic and Encryption Policies
`NIS2-ART21I`	Implement Human Resources Security and Access Control
`NIS2-ART21J`	Use Multi-Factor Authentication and Secure Communications
`NIS2-ART23`	Report Significant Incidents to CSIRT Within 24/72 Hours
`NIS2-ART22`	Establish Vulnerability Coordination and Disclosure

Policy templates

Written for NIS2:

NIS2 Cybersecurity Risk Management Policy
NIS2 Significant Incident Reporting Policy
NIS2 Supply Chain Cybersecurity Policy

And 22 from the standard set, adapted to NIS2.