Running a NIS2 compliance program: the checklist and roadmap, risk assessment, required policies, evidence for supervisors, groups operating in several Member States, ENISA's technical guidance, and the open-source and self-hosted tools that produce the evidence.
A step-by-step NIS2 checklist with the evidence behind each step: scope and classification, registration, management approval and training, the ten measures, documented proportionality decisions, incident reporting readiness, supplier controls and corrective action.
How a NIS2 program is usually sequenced and what each phase produces: scope and registration deadlines, governance, gap analysis, policies and measures, incident reporting, suppliers and annual review cycles, with the dates already passed and those pending.
How to run the risk assessment NIS2 expects: the all-hazards approach, proportionality factors, documented assessments and treatment plans reviewed at least annually, who accepts residual risk, asset classification and how results drive the measures.
The documented policies behind NIS2 compliance: the information system security policy and its annual management review, the ten topic-specific policies ENISA identifies, incident handling, supply chain and cryptography policies, and documentation retention.
What a competent authority can ask to see and how to keep it ready: documented policies, audit results and underlying evidence, ENISA's evidence examples for logging, backups, configuration, testing and privileged access, and independent review records.
How NIS2 works for corporate groups: national jurisdiction versus the main establishment rule, registering in several countries, the SME calculation for subsidiaries, EU representatives for non-EU providers, differing national laws and the proposed simplification.
What ENISA's June 2025 guidance is and how to use it: who it applies to, its non-binding status, evidence examples per requirement, the mapping to ISO 27001, NIST CSF and other frameworks, the ten required policies, and why following it does not prove compliance.
Which open-source tools cover NIS2 measures that produce the most evidence (logging and detection, multi-factor authentication, vulnerability handling, backups, secrets and cryptography, incident handling, GRC), their licenses and edition limits, and what each produces.
Tracking NIS2 measures, risks, suppliers and evidence in a self-hosted GRC tool: what CISO Assistant and eramba Community do, NIS2 framework content, licenses (open core AGPL versus a free but not open-source license) and features held back for paid editions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.