Map all 10 Article 21(2) requirements to automated controls. Real-time governance heatmap, continuous verification, and audit-ready evidence for essential and important entities.
The NIS-2 Directive (Directive 2022/2555) is the European Union's updated framework for cybersecurity risk management. Replacing the original NIS Directive from 2016, NIS-2 significantly expands the scope of regulated entities, strengthens security requirements, and introduces stricter enforcement with substantial penalties including personal liability for management.
NIS-2 applies to essential entities (energy, transport, banking, healthcare, digital infrastructure, public administration) and important entities (postal services, waste management, manufacturing, chemicals, food, digital providers, research). Both categories must implement the cybersecurity risk management measures defined in Article 21.
Article 21(2) defines ten mandatory cybersecurity measures. The table below maps each requirement to specific CYFAX and PREVENT capabilities with verification method.
| Art. 21(2) | Requirement | CYFAX + PREVENT Capability | Verification |
|---|---|---|---|
| (a) | Risk analysis and information system security policies | Compliance Cockpit maps risk posture to governance heatmap. AI reviews uploaded security policies for fitness-for-purpose. | CYFAX + Upload |
| (b) | Incident handling | PREVENT NDR detects incidents in real time. CYFAX tracks Article 23 reporting timelines (24h/72h/1mo). AI reviews incident response plans. | PREVENT Auto |
| (c) | Business continuity and crisis management | PREVENT validates backup configs, encryption status, and recovery readiness. Compliance Cockpit tracks BCP documentation. | PREVENT Auto |
| (d) | Supply chain security | TPRM module scores every vendor. Tier 1–3 supply chain visibility. No vendor cooperation required. | CYFAX Auto |
| (e) | Network and information systems security, including vulnerability handling | PREVENT scans vulnerabilities with CVSS/KEV. CYFAX EASM identifies exposed infrastructure, misconfigs, and DNS vulnerabilities. | PREVENT Auto |
| (f) | Policies to assess effectiveness of risk management measures | Continuous BAS testing validates controls work. Governance heatmap provides real-time effectiveness scoring. | PREVENT Auto |
| (g) | Basic cyber hygiene practices and cybersecurity training | PREVENT validates endpoint hygiene across 60+ controls. Upload training records for AI compliance review. | PREVENT + Upload |
| (h) | Policies regarding cryptography and encryption | PREVENT validates encryption enforcement: TLS config, certificate management, disk encryption status. | PREVENT Auto |
| (i) | Human resources security, access control, and asset management | PREVENT tests access controls and credential hygiene. CYFAX monitors credential exposure across 20,000+ criminal sources. | CYFAX + PREVENT |
| (j) | Multi-factor authentication and secured communications | PREVENT validates MFA enforcement. CYFAX validates email security (SPF, DKIM, DMARC). | CYFAX + PREVENT |
Article 23 establishes a three-stage incident reporting obligation. CYFAX tracks these timelines automatically, and PREVENT's detection capabilities ensure significant incidents are identified quickly enough to meet the 24-hour early warning requirement.
Whichever is higher. Energy, transport, banking, financial infrastructure, healthcare, drinking water, digital infrastructure, ICT, public admin, and space sectors.
Whichever is higher. Postal services, waste management, manufacturing, chemicals, food, digital providers, and research organizations.
NIS-2 Article 20 requires management bodies to approve and oversee cybersecurity risk management measures. Member states must ensure management bodies can be held personally liable for infringements. Board members and senior executives face personal consequences for inadequate cybersecurity governance — a significant escalation from the original NIS Directive.
Interactive compliance heatmap with control-level status mapped to Article 21 requirements. Framework dropdown supports NIS-2, NIST CSF, and 350+ directives simultaneously in a single view.
Upload evidence documents (PDF, DOC, XLSX, PNG, JPG — up to 10 files per attestation). AI reviews each artifact for fitness-for-purpose against NIS-2 requirements.
Article 21(2)(d) compliance through automated vendor risk scoring. Upload vendor domains via CSV, receive scorecards within hours. Continuous monitoring with alert-driven status changes.
Optional endpoint agent validates 60+ internal controls against CIS/MITRE. Continuous BAS providing ongoing proof controls work — satisfying Article 21(2)(f).
AI predicts breach probability 6–21 weeks in advance. For NIS-2 entities, this transforms incident handling from reactive to proactive.
All platform activity produces timestamped, immutable evidence. When the competent authority requests proof, documentation is available on demand.
Give us your domain. In 60 minutes, we will show you exactly where you stand against every Article 21(2) requirement — with zero installation and zero risk to your network.