NIS2 Directive — Directive (EU) 2022/255518 critical sectors
The NIS2 Directive establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU. It requires you to manage the risk to your network and information systems — and, months later, to show an auditor that you did. Quanovio collects the traces your systems already produce, checks them every day against the numbered requirements of the Directive's implementing regulation, and writes the record you hand over. A cyber security breach, personal data leaving the organisation, files anyone on the internet can open, accounts nobody has closed — found, reported, and followed until they are provably gone.
This site refers to Directive (EU) 2022/2555 and to the technical and methodological requirements set out in the Annex to Commission Implementing Regulation (EU) 2024/2690. Point numbers and requirement titles are reproduced from those texts, in the language you are reading. Figures we measured ourselves are marked as such. Directive (EU) 2022/2555·CIR (EU) 2024/2690
Sectors in scopeAnnex I
Annex I names eleven sectors of high criticality, drawn here. Annex II names seven more. The obligations do not change by sector; the systems that evidence them do.
Size and sector together determine whether an entity is essential or important, and Member States may designate others. Classification affects supervision and the level of penalty, not which measures apply.
The short versionFour questions
If you are a medium or large organisation in energy, transport, health, water, food, manufacturing, waste, post, chemicals, digital services, research or public administration, almost certainly yes. The law is called NIS2, it applies across all 27 EU countries, and it reached thousands of organisations that had never been regulated on security before. Many of them still do not know.
Fines reach €10 million or 2% of worldwide annual turnover, whichever is larger. Directors can be held personally responsible, and regulators can suspend a manager from their duties. In practice the first thing that happens is simpler: a customer, an insurer or a bank asks for your evidence, and you do not have any.
Two things, and the second is the one people miss. First, the watching itself: Quanovio connects to the systems you already run and examines them continuously — who signed in and from where, what left the organisation, what changed on a server, what your firewall let through, what your cloud accounts did. When something looks like a break-in attempt, an account taken over, or data moving where it should not, you are told straight away and not in tomorrow's summary, because the law counts in hours. Second, the record that the watching produces: one report every morning, each line tied to the numbered part of the law it answers.
Fix the things it finds. We never touch your systems — we cannot, and that is deliberate. We tell you what is wrong and in what order to deal with it; your own people or your IT supplier do the work, and the next morning's report says whether it worked.
The idea the whole thing rests onTwo different jobs
Think of the fire extinguishers in your building. Having them is not enough. Someone signs a sheet every month to say they were checked, and that sheet is what an inspector asks for. Security now works the same way. The law does not only ask whether you are watching — it asks you to produce the record. Most organisations are doing far more than they can show.
One page. Below is a real example, shortened. The number on the left is the part of the law each line answers; you do not need to understand it, but the person who inspects you will.
| Annex point | Requirement | Observation | Status | |
|---|---|---|---|---|
| 11.2 | Management of access rights | A sharing link created in March remains active on a document restricted on 28 August. The document is retrievable by any holder of the link, without authentication. | Recurring previously verified closed on 2 September | |
| 6.7 | Network security | A firewall rule permits inbound connections from any address to the finance server. | Open | |
| 3.4 | Event assessment and classification | A workstation sent 4.2 GB to an address it had never contacted before, between 01:00 and 04:00. | Open | |
| 11.7 | Multi-factor authentication | Four accounts with administrative privileges authenticate with a password only. | Open first recorded 14 September | |
| 11.3 | Privileged accounts and system administration accounts | The administrator account for the HR system is used by two people. | Open | |
| 6.8 | Network segmentation | The workstation network can reach the server network directly, with no filtering between them. | Open | |
| 12.4 | Asset inventory | Three servers are running that do not appear in the inventory. | Open | |
| 11.5 | Identification | A shared mailbox in the finance department signs in with a generic account that nobody owns. | Open | |
| 3.2 | Monitoring and logging | A server stopped sending records at 02:14 and was silent for fourteen hours. | Verified closed | |
| 6.9 | Protection against malicious and unauthorised software | Malicious software was blocked on a workstation in the finance department. | Verified closed | |
| 10.3 | Termination or change of employment procedures | Your HR system records a leaving date of 18 August; the account was still active thirty-one days later. | Verified closed | |
| 6.10 | Vulnerability handling and disclosure | Three vulnerabilities rated critical were remediated; their absence was confirmed on the following collection. | Verified closed confirmed 19 September |
Each row comes from a different part of your organisation. Sign-ins, files and accounts from your office suite; servers, firewalls and network traffic from the systems themselves; a leaving date from your HR or ERP system. The record is assembled from all of them, which is why it reads as one document rather than as several tools' output.
Point numbers and requirement titles are reproduced from the Annex to Commission Implementing Regulation (EU) 2024/2690. The observations above are an illustration, not the data of any entity. Remediation is carried out by the entity’s own administrators; this record states only what was observed. CIR (EU) 2024/2690 · Annex
Connectors request read scopes exclusively. A credential returned with write permission is rejected at connection time rather than retained.
Identical software, deployed in your own network or operated on your behalf within the European Union. Self-hosted deployments transmit nothing externally.
Each finding includes a remediation plan executed by your administrators. Subsequent collections record the outcome as closed, unresolved, or recurring.
The screenExample
The report is what you hand over. The screen is where the work happens between reports: what changed, what is trending the wrong way, what needs attention today, and every report ever produced, ready to send.
Illustration. The figures are an example, like the record above.
Figures marked as measured are our own count against the openly published Wazuh ruleset on the date shown, not a figure from any EU source.
Approximately one third of the numbered controls in CIR (EU) 2024/2690 are evidenced by telemetry. The remainder — risk methodology, supply chain assessment, cryptographic policy, training, physical security — are documentary and are reported as open, with the evidence an assessor will request. Coverage claims that exceed what a monitoring system can observe do not survive an audit.
One page out of the same report. Eight of the numbered controls, the number of detections behind each, and whether that was enough to evidence it. The last row is the useful one: where nothing is connected, the report says so instead of leaving the line blank.
| Ref | Control | Detections | Evidenced | |
|---|---|---|---|---|
| 11.6 | Authentication | 302 | Yes | |
| 3.2 | Monitoring and logging | 167 | Yes | |
| 6.9 | Protection against malicious and unauthorised software | 155 | Yes | |
| 11.2 | Management of access rights | 140 | Yes | |
| 3.4 | Event assessment and classification | 135 | Yes | |
| 6.7 | Network security | 70 | Yes | |
| 11.3 | Privileged accounts and system administration accounts | 30 | Partial | |
| 11.7 | Multi-factor authentication | 2 | Requires an identity source |
An example, not the data of any entity. Reference numbers and control titles are reproduced from the Annex to CIR (EU) 2024/2690.
ReferencesEUR-Lex · ENISA
Every figure, deadline and requirement title on this site is taken from the texts below. Where this site quotes, it quotes the official language version you are reading it in.
Tell us what your organisation runs — five lines is enough — and we will tell you which parts of the law you could prove today and which you could not. Written, free, and no call required.
See your coverage