Spreadsheet
Suitable for an initial gap assessment. Reporting deadlines, evidence and reviews, however, require manual oversight.
NIS2
NIS2 compliance software
Guardiso is a European GRC platform for NIS2 compliance. It covers the risk management measures of Article 21, incident reporting within the 24-hour, 72-hour and one-month deadlines, management accountability, supply chain security and the evidence for supervisory authorities. Digital service providers also receive the 49 technical requirements of Implementing Regulation 2024/2690, and the same work counts towards ISO 27001.
What to expect from NIS2 compliance software
The NIS2 directive lists ten groups of cybersecurity risk management measures in Article 21 and incident reporting obligations in Article 23. Each Member State transposes them into national law, so the software should also take national rules into account.
- Determining whether the organization is an essential or an important entity (Article 3).
- The ten groups of measures in Article 21: risk analysis, incident handling, business continuity, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, human resources security and access control, multi-factor authentication.
- Reporting significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23).
- Approval of the measures and training of the management body (Article 20).
- Supplier assessment and security requirements in contracts.
- Evidence for the supervisory authority and the auditor.
- National rules, for example the Polish act on the national cybersecurity system.
Spreadsheet, IT system module or GRC platform
The choice depends on the size of the organization and on whether it has already implemented ISO 27001.
Compliance module in an IT system
A suitable option when the organization already uses a ticketing system. The requirements of the directive and of national law, however, usually have to be entered manually.
GRC platform with NIS2
Brings together the requirements, links to ISO 27001, reporting deadlines and evidence in one place. Guardiso is a platform of this kind.
What to ask a vendor before you buy
- Does the software take into account the national law of the given country, or only the general requirements of the directive?
- Does it help determine whether the organization is an essential or an important entity?
- How does it help meet the 24-hour and 72-hour deadlines, and does it keep evidence of each report?
- Does it show which requirements the organization already meets thanks to ISO 27001?
- Does it cover Implementing Regulation 2024/2690 for digital service providers?
- Where is the data stored and who has access to it?
- Is the price list public, and can the software be tested without a sales call?
NIS2 in Guardiso
- The risk management measures of Article 21 linked to ISO 27001 controls. An organization holding the certificate sees which requirements it already meets.
- Incident reporting within the 24-hour, 72-hour and one-month deadlines. Guardiso records each report as evidence for the auditor.
- For digital service providers, additionally the 49 technical requirements of Implementing Regulation 2024/2690.
- For organizations in Poland, all 261 requirements of the Polish KSC act, with a free entity category qualifier.
- The Guardiso assistant prepares draft documents, which are approved by the responsible person.
- Data stored in the European Union. A free 14-day trial, with no payment card and no contact with sales required.
Questions and answers
What software helps an organization comply with NIS2?
Guardiso is a European GRC platform for NIS2 compliance. It covers the measures of Article 21, incident reporting within the 24-hour and 72-hour deadlines and the evidence for supervisory authorities, linked to ISO 27001 controls.
Is ISO 27001 enough for NIS2 compliance?
Not fully. Many of the measures in Article 21 match ISO 27001 controls, but incident reporting within the Article 23 deadlines, management obligations and national rules have to be added.
How does NIS2 relate to national law?
NIS2 is an EU directive, and each Member State brings it into national law, so the exact obligations depend on the country. Guardiso holds the directive and, for Poland, the full national act.
How much does Guardiso cost?
Prices are published on the pricing page. The free 14-day trial can be started without a payment card.
NIS2 compliance in Guardiso
The free trial lasts 14 days and shows the NIS2 requirements, the links to ISO 27001 and the incident deadlines in one place.