NIS2 does not ask for a binder. It asks essential and important entities to take appropriate measures and to report significant incidents on a clock. Automate the evidence that systems generate by themselves, such as inventories, scan results and access logs, and keep human judgment for risk decisions and sign-off.
Safeguard does not certify you under NIS2. This post explains the text so you can plan evidence. Your national law and regulator decide the details.
What does the Directive require?
Article 21 says entities must take appropriate and proportionate technical, operational and organisational measures. The measures must follow an all-hazards approach and include at least ten items:
- risk analysis and information system security policies
- incident handling
- business continuity, backup, disaster recovery and crisis management
- supply chain security, including relationships with direct suppliers
- security in acquisition, development and maintenance, including vulnerability handling and disclosure
- policies to assess whether the measures work
- basic cyber hygiene and training
- cryptography and encryption policies
- human resources security, access control and asset management
- multi-factor authentication or continuous authentication where appropriate
Article 20 adds that management bodies must approve the measures, oversee them and can be held liable for infringements, and must follow training.
Which evidence can a system produce for you?
Map each Article 21 item to something a machine can regenerate on demand.
Asset management and supply chain. A software inventory, ideally an SBOM per product, answers "what do we run and what is in it." Article 21(3) says entities should take into account each direct supplier's vulnerabilities and secure development practices, so keep supplier records beside the inventory.
Vulnerability handling. Scan history with dates, severity, owner and fix date. The trail matters more than any single report.
Access and authentication. Exports of MFA enrolment, role assignments and joiner and leaver events from your identity provider.
Backup and recovery. Logs of backup jobs and the date of the last restore test.
Training. Completion records for staff and for management bodies.
Which evidence still needs a person?
Risk analysis, the decision to accept a risk, the review of supplier quality and the effectiveness assessment in item six all need a named human and a date. A tool can prompt the review and store the result. It cannot make the call.
What does the reporting clock demand?
Article 23 sets a staged process for significant incidents. An incident is significant if it caused or can cause severe operational disruption or financial loss, or affected others with considerable damage. The stages are:
- An early warning within 24 hours of becoming aware.
- An incident notification within 72 hours, with an initial assessment and indicators of compromise where available.
- An intermediate report if the authority asks.
- A final report within one month of the notification, covering description, root cause, mitigation and cross-border impact.
Evidence collection supports this directly. If your logs and inventory are searchable, the 24 hour warning is a lookup, not a hunt.
What to do
- Decide whether you are an essential or important entity under your national law.
- Map Article 21 items one to ten to an evidence source and an owner.
- Automate exports for inventory, scans, access and backups on a schedule.
- Date-stamp everything and keep it for the period your regulator expects.
- Write the 24, 72 hour and one month report templates now.
- Schedule the management approval and training Article 20 asks for.
- Run a tabletop exercise against the clock.
Quick check
How fast is the first NIS2 report?
An early warning is due within 24 hours of becoming aware of a significant incident, followed by a notification within 72 hours.
Can management delegate all responsibility?
Article 20 says management bodies approve and oversee the measures and can be held liable for infringements, so sign-off stays with them.
Sources
Last reviewed: 18 October 2026.
