NIS2 Article 21, continuously satisfied.
CISGuard automates the cybersecurity risk-management measures NIS2 Article 21 requires of EU Essential and Important Entities, with continuous evidence the national supervisory authorities expect.
NIS2 at a glance, for fast retrieval.
Atomic factual claims auditors and search engines can cite verbatim.
- Directive
- EU 2022/2555 (transposed by 17 Oct 2024)
- Primary article
- Article 21: Cybersecurity risk-management measures
- Categories
- Essential Entities + Important Entities
- Sectors
- 11 essential + 7 important sectors
- Penalty exposure
- Up to €10M or 2% of global turnover (essential entities)
- National supervisors
- BSI (Germany), ANSSI (France), CCN-CERT (Spain), AGID (Italy), and others
What is NIS2?
NIS2 (EU Directive 2022/2555 on the Security of Network and Information Systems), transposed into national law by 17 October 2024, designates two categories of in-scope organizations: Essential Entities (energy, transport, banking, financial market, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space) and Important Entities (digital providers, manufacturing, postal services, waste management, chemicals, food, research). Article 21 mandates cybersecurity risk management measures including incident handling, supply chain security, vulnerability handling, and effectiveness assessment. National supervisors (e.g., BSI Germany, ANSSI France, CCN Spain) inspect and impose substantial penalties for non-compliance.
NIS2 Article 21 measures CISGuard automates.
Each CIS control is tagged with its corresponding framework reference. A single scan produces per-framework coverage reports.
- Article 21(2)(a) Policies on risk analysis + information system security
- Controls
- Documented technical controls
- Mapped by
- Continuous CIS benchmark scanning
- Article 21(2)(b) Incident handling
- Controls
- Detection, response, recovery
- Mapped by
- Drift detection + SIEM integration
- Article 21(2)(d) Supply chain security
- Controls
- Third-party ICT controls
- Mapped by
- Multi-tenant deployment for supplier evidence
- Article 21(2)(e) Security in acquisition, dev, maintenance
- Controls
- Configuration baseline enforcement
- Mapped by
- Continuous CIS scanning of new + existing assets
- Article 21(2)(f) Effectiveness assessment
- Controls
- Periodic evaluation of controls
- Mapped by
- Continuous posture trend + framework coverage reports
- Article 21(2)(g) Cyber hygiene practices
- Controls
- Basic cyber hygiene baselines
- Mapped by
- CIS benchmark baselines = cyber hygiene reference
- Article 21(2)(j) MFA, encrypted comms, encrypted endpoints
- Controls
- Authentication and encryption
- Mapped by
- CIS Authentication + Cryptography benchmarks
How CISGuard automates NIS2 evidence.
NIS2 supervisors are stricter than the original NIS Directive on evidence quality and continuous proof. The "appropriate technical measures" in Article 21 must be evidenced not assumed. CISGuard's continuous CIS benchmark scanning produces the operational evidence supervisors expect, particularly for Article 21(2)(g) cyber hygiene baselines: CIS benchmarks are the de-facto cyber hygiene reference. A Spanish telecommunications operator deploying 5G core infrastructure used CISGuard to satisfy NIS2 Article 21 across 64 Kubernetes nodes + 220 Docker containers + 240 servers, with evidence package delivery 6 weeks ahead of CCN-CERT audit.
Evidence artifacts CISGuard generates.
Auditor-grade outputs in PDF/CSV. No spreadsheets, no screenshots, no manual cross-referencing.
- NIS2 Article 21 measure-by-measure coverage report
- Continuous cyber hygiene baseline evidence (CIS benchmark adherence)
- Incident detection events with timestamps for Article 21(2)(b)
- Supply chain provider evidence for Article 21(2)(d) audit
- Effectiveness assessment data via historical posture trend
- Container and Kubernetes scanning for 5G/digital infrastructure entities
NIS2 questions, answered directly.
Is my organization in scope for NIS2?
NIS2 covers Essential Entities (11 sectors including energy, transport, banking, health, water, digital infrastructure, public administration) and Important Entities (7 sectors including digital providers, manufacturing, postal, waste). Size thresholds apply; essential entities have stricter requirements. Member state transposition adds national specifics. National competent authorities maintain in-scope registers.
How does CISGuard satisfy NIS2 Article 21 cyber hygiene requirements?
Article 21(2)(g) requires "basic cyber hygiene practices." The CIS Benchmarks are the international reference standard for cyber hygiene baselines. CISGuard's continuous CIS scanning provides the direct operational evidence Article 21(2)(g) demands. Other Article 21 measures (MFA, encryption, incident detection) map similarly to CIS technical controls.
Does CISGuard support Kubernetes and container scanning for NIS2?
Yes. Digital infrastructure entities (telecom 5G cores, cloud providers, ICT service management) typically run containerized workloads with no native CIS visibility. CISGuard scans Kubernetes (CIS Kubernetes Benchmark), Docker (CIS Docker Benchmark), AKS, EKS, and OpenShift against CIS controls, closing the critical infrastructure container security gap.
How does CISGuard help with NIS2 supply chain security (Article 21(2)(d))?
Multi-tenant deployment lets ICT third-party providers furnish per-customer compliance evidence to their NIS2-regulated customers without exposing other customers' data. Each customer's security team sees their own dedicated dashboard. This is the standard contractual artifact for Article 21(2)(d) supply chain reviews.
Does CISGuard cover the Spanish ENS framework alongside NIS2?
Yes. ENS (Esquema Nacional de Seguridad, Royal Decree 311/2022) at HIGH category overlaps significantly with NIS2 technical requirements for Spanish public sector and supply chain. CISGuard's NIST 800-53 mapping covers both; ENS references NIST controls in its technical security measures. A Spanish telco achieved ENS HIGH + NIS2 evidence with one deployment.
Continue exploring CISGuard coverage.
DORA
CISGuard automates the ICT risk management technical controls DORA mandates for EU financial entities: system hardening, continuous monitoring, drift detection, and third-party risk reviews.
Read more →GDPR
CISGuard automates the "appropriate technical and organisational measures" GDPR Article 32 requires, with continuous evidence Data Protection Authorities (DPAs) expect during investigations.
Read more →ISO 27001
CISGuard maps 36 ISO/IEC 27001:2022 Annex A controls to CIS benchmark scans, automating the technical evidence that certification audits demand and continuous-monitoring requirements imply.
Read more →Ready for NIS2 readiness?
Our compliance engineers have helped organizations achieve regulatory readiness in as little as one business day.