NIS2 Directive Compliance Automation
NIS2 Article 21,continuously satisfied.
CISGuard automates the cybersecurity risk-management measures NIS2 Article 21 requires of EU Essential and Important Entities, with continuous evidence the national supervisory authorities expect.
- Directive
- EU 2022/2555 (transposed by 17 Oct 2024)
- Primary article
- Article 21: Cybersecurity risk-management measures
- Categories
- Essential Entities + Important Entities
- Sectors
- 11 essential + 7 important sectors
- Penalty exposure
- Up to €10M or 2% of global turnover (essential entities)
- National supervisors
- BSI (Germany), ANSSI (France), CCN-CERT (Spain), AGID (Italy), and others
Overview
What is NIS2?
NIS2 (EU Directive 2022/2555 on the Security of Network and Information Systems), transposed into national law by 17 October 2024, designates two categories of in-scope organizations: Essential Entities (energy, transport, banking, financial market, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space) and Important Entities (digital providers, manufacturing, postal services, waste management, chemicals, food, research). Article 21 mandates cybersecurity risk management measures including incident handling, supply chain security, vulnerability handling, and effectiveness assessment. National supervisors (e.g., BSI Germany, ANSSI France, CCN Spain) inspect and impose substantial penalties for non-compliance.
How CISGuard automates NIS2 evidence
NIS2 supervisors are stricter than the original NIS Directive on evidence quality and continuous proof. The "appropriate technical measures" in Article 21 must be evidenced not assumed. CISGuard's continuous CIS benchmark scanning produces the operational evidence supervisors expect, particularly for Article 21(2)(g) cyber hygiene baselines: CIS benchmarks are the de-facto cyber hygiene reference. CISGuard satisfies NIS2 Article 21 evidence needs across Kubernetes, Docker, and server estates, producing audit-ready packages well ahead of CCN-CERT engagements.
Control mapping
NIS2 Article 21 measures CISGuard automates.
Each CIS control is tagged with its framework reference. One scan produces the per-framework coverage report, with satisfied, partially satisfied and not-met status for every control.
| Control area | Controls | Mapped by |
|---|---|---|
| Article 21(2)(a) Policies on risk analysis + information system security | Documented technical controls | Continuous CIS benchmark scanning |
| Article 21(2)(b) Incident handling | Detection, response, recovery | Drift detection + SIEM integration |
| Article 21(2)(d) Supply chain security | Third-party ICT controls | Multi-tenant deployment for supplier evidence |
| Article 21(2)(e) Security in acquisition, dev, maintenance | Configuration baseline enforcement | Continuous CIS scanning of new + existing assets |
| Article 21(2)(f) Effectiveness assessment | Periodic evaluation of controls | Continuous posture trend + framework coverage reports |
| Article 21(2)(g) Cyber hygiene practices | Basic cyber hygiene baselines | CIS benchmark baselines = cyber hygiene reference |
| Article 21(2)(j) MFA, encrypted comms, encrypted endpoints | Authentication and encryption | CIS Authentication + Cryptography benchmarks |
Auditor evidence
Evidence artifacts CISGuard generates.
Auditor-grade outputs in PDF, HTML, JSON, CSV and SARIF. No spreadsheets, no screenshots, no manual cross-referencing.
- NIS2 Article 21 measure-by-measure coverage report
- Continuous cyber hygiene baseline evidence (CIS benchmark adherence)
- Incident detection events with timestamps for Article 21(2)(b)
- Supply chain provider evidence for Article 21(2)(d) audit
- Effectiveness assessment data via historical posture trend
- Container and Kubernetes scanning for 5G/digital infrastructure entities
Frequently asked
NIS2 questions, answered directly.
Is my organization in scope for NIS2?
NIS2 covers Essential Entities (11 sectors including energy, transport, banking, health, water, digital infrastructure, public administration) and Important Entities (7 sectors including digital providers, manufacturing, postal, waste). Size thresholds apply; essential entities have stricter requirements. Member state transposition adds national specifics. National competent authorities maintain in-scope registers.
How does CISGuard satisfy NIS2 Article 21 cyber hygiene requirements?
Article 21(2)(g) requires "basic cyber hygiene practices." The CIS Benchmarks are the international reference standard for cyber hygiene baselines. CISGuard's continuous CIS scanning provides the direct operational evidence Article 21(2)(g) demands. Other Article 21 measures (MFA, encryption, incident detection) map similarly to CIS technical controls.
Does CISGuard support Kubernetes and container scanning for NIS2?
Yes. Digital infrastructure entities (telecom 5G cores, cloud providers, ICT service management) typically run containerized workloads with no native CIS visibility. CISGuard scans Kubernetes (CIS Kubernetes Benchmark), Docker (CIS Docker Benchmark), AKS, EKS, and OpenShift against CIS controls, closing the critical infrastructure container security gap.
How does CISGuard help with NIS2 supply chain security (Article 21(2)(d))?
Multi-tenant deployment lets ICT third-party providers furnish per-customer compliance evidence to their NIS2-regulated customers without exposing other customers' data. Each customer's security team sees their own dedicated dashboard. This is the standard contractual artifact for Article 21(2)(d) supply chain reviews.
Does CISGuard cover the Spanish ENS framework alongside NIS2?
Yes. ENS (Esquema Nacional de Seguridad, Royal Decree 311/2022) at HIGH category overlaps significantly with NIS2 technical requirements for Spanish public sector and supply chain. CISGuard's NIST 800-53 mapping covers both; ENS references NIST controls in its technical security measures. A Spanish telco achieved ENS HIGH + NIS2 evidence with one deployment.
NIS2 readiness, on request.
Our compliance engineers have helped organizations achieve regulatory readiness through a seamless, fully managed deployment.