Skip to content

NIS2 · Directive (EU) 2022/2555

Turn NIS2 measures into a programme you can show.

NIS2 asks management bodies to approve and oversee cybersecurity risk-management measures, and asks every entity in scope to report significant incidents fast. ILSERIS links the measures, the suppliers, the continuity plans and the incidents, so you can show what is in place and who owns it.

Request a demoHow ILSERIS maps

Requirements

What NIS2 asks of you

NIS2 applies to essential and important entities in sectors listed in the directive, through the national law of each member state. In broad terms, it covers six areas.

  • Scope and registration

    Determine whether you are an essential or important entity and register with the national authority where your member state requires it.

    ILSERIS modules

  • Governance and accountability

    Management bodies approve the cybersecurity risk-management measures, oversee their implementation, follow training and can be held liable.

    ILSERIS modules

  • Cybersecurity risk-management measures

    Take appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach, from risk analysis to incident handling.

    ILSERIS modules

  • Incident reporting

    For significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

    ILSERIS modules

  • Supply chain security

    Address security in the relationships with your direct suppliers and service providers, taking their practices and vulnerabilities into account.

    ILSERIS modules

  • Business continuity and crisis management

    Cover backup management, disaster recovery and crisis management as part of your measures.

    ILSERIS modules

Mapping

How ILSERIS maps to NIS2

Five steps, each in a module you already use, all on the same records.

  1. Step 01

    Set up NIS2 as a framework

    Record NIS2, or your national transposition, in Govern's frameworks and set which obligations apply.

  2. Step 02

    Map measures to controls

    Link each measure to the controls, policies and owners that meet it, and see where the gaps are.

  3. Step 03

    Link risks, suppliers and plans

    Connect controls to the risks in the register, the suppliers you depend on and the continuity and recovery plans of your critical services.

  4. Step 04

    Handle incidents and crises

    Detect, triage and escalate incidents, run the crisis in a war room and draft regulatory notifications for review.

  5. Step 05

    Test, audit and report

    Exercise your plans, run NIS2 audit engagements, follow findings to corrective actions and report coverage per measure.

Outputs

What you can show

To your management body, your auditors and the competent authority.

  • Coverage per NIS2 measure, with the controls, owners and open gaps behind each one.
  • Incident records with drafts of regulatory notifications, reviewed and approved by a person.
  • Supplier tiering, questionnaires and periodic screening per third party.
  • A management view of critical services, RTO gaps, overdue corrective actions and live incidents.

ILSERIS supports your compliance programme. It does not provide legal advice or certify compliance.

See ILSERIS in action.

A focused walkthrough, built around your regulatory landscape and operating model.

Request a demoContact us