SchildmarkNIS2
NIS2: the technical measures, and the evidence that you took them
NIS2 asks essential and important entities to manage cyber risk with appropriate measures and to report significant incidents within 24 hours. Schildmark handles the detection, response, patching and logging part of that work, and keeps the record an auditor or authority will ask for.
What NIS2 asks for on the technical side
Article 21(2) of Directive (EU) 2022/2555 lists ten areas of measures, from risk analysis to multi-factor authentication. These are the ones where detection and response does real work. Article 23 sets the reporting clock.
- Art. 21(2)(b) Incident handling
- Detect incidents, assess them, contain them and recover from them.
- Art. 21(2)(e) Vulnerability handling
- Part of security in acquiring, developing and maintaining systems: vulnerability handling and disclosure. Know which vulnerabilities you have, and fix them.
- Art. 21(2)(f) Assessing effectiveness
- Policies and procedures to check that your risk-management measures actually work.
- Art. 21(2)(g) Basic cyber hygiene
- Basic cyber hygiene practices and cybersecurity training. Patched, soundly configured machines are the core of the first half.
- Art. 23 Reporting
- For a significant incident: an early warning without undue delay and within 24 hours of becoming aware of it; an incident notification within 72 hours with an initial assessment and, where available, indicators of compromise; a final report no later than one month after the notification.
Who is in scope
Entities in the sectors of Annexes I and II, from energy, transport, banking, health and digital infrastructure to manufacturing, food, chemicals and digital providers, that have 50 or more staff, or an annual turnover and balance sheet total each above EUR 10 million. Some are in scope whatever their size, such as providers of public electronic communications, trust service providers, top-level domain registries and DNS service providers.
Large entities in the Annex I sectors are generally essential entities; most others are important entities. The technical measures are the same; supervision and fines differ.
Germany and France
- Germany
- The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) has applied since December 2025 and rewrote the BSI Act (BSIG): § 30 lists the measures, § 32 the 24-hour, 72-hour and one-month reports, and § 38 makes management responsible for implementing and overseeing them, with regular training. Under § 33, entities register with the BSI; the BSI says the statutory deadline has passed and that entities not yet registered should register in the BSI portal now.
- France
- The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS2, was adopted by the Senate in March 2025 and, as of November 2026, has not been finally adopted. ANSSI says the obligations will apply once the law and its implementing texts are published.
Requirement, what Schildmark does, and the evidence
Every row is something the product does today. The evidence pack is one ZIP of CSV files for the period you choose.
| Requirement | What Schildmark does | Evidence it produces |
|---|---|---|
| Incident handling | Alerts from Windows, macOS and Linux machines, network sensors, firewalls, Microsoft 365, AWS and Google Cloud in one list, with one severity scale. Block the attacking address on your own firewall from the alert, a rule or the analyst; rules can wait for a person’s approval. | Each alert with its rule, MITRE technique, machines and time; every block with who, when and why in the audit log; audit_trail.csv. |
| 24-hour and 72-hour reports | The facts the reports need: when the first alert arrived, which machines, which source addresses, what was blocked. Ask the analyst to sum it up in plain language. Schildmark does not decide whether an incident is significant and does not file the report. | Alert detail with the log line; source addresses as indicators of compromise; the audit trail for the period. |
| Vulnerability handling | Vulnerable packages corroborated against vendor and NVD data, known-exploited ones first. Each fix rehearsed on the machine, approved, installed in the exact version, and counted as done only when the vulnerability is confirmed fixed. A fix you cannot install becomes an accepted risk with owner, reason and expiry. | vulnerabilities_fixed.csv with the verification’s proof; patch_activity.csv with approvals, rejections and runs. |
| Effectiveness and cyber hygiene | CIS configuration checks on every machine, read again every 10 minutes, and a warning when logs are kept for less time than a framework expects. | configuration_scores.csv, configuration_checks.csv, and the retention shortfall in README.txt. |
The compliance page has no NIS2 tab of its own: the evidence pack holds the same records whichever framework you report on. More on detection, verified patching, the compliance page and evidence pack, and in the documentation: Compliance, Patching.
What Schildmark does not cover
NIS2 is mostly an organisational duty. These parts stay with you, your ISMS or a consultant.
- Risk analysis and policies
- The risk analysis and security policies of 21(2)(a), and deciding which measures are proportionate.
- Continuity and backup
- Business continuity, backup of your systems, disaster recovery and crisis management. Schildmark backs up its own stack, not yours.
- Supply chain
- Assessing suppliers and service providers, and the security terms in their contracts.
- People and access
- Training, HR security, access control and asset policies, cryptography, multi-factor authentication for your users, and a vulnerability disclosure policy.
- Management and authorities
- Management approval, oversight, training and liability, registration with the authority, and filing the reports.
How a rollout looks
Usually days, not months. Nothing needs to be installed on your firewalls.
Choose where it runs
Hosted by us, or on one or two of your own Linux servers. Either way, you get a stack of your own.
Enrol the machines
One command per machine on Windows, macOS and Linux, or an MSI for Intune, Configuration Manager or Group Policy.
--patchingadds patching.Connect the rest
Firewall logs, Microsoft 365, AWS and Google Cloud, and the firewalls you block on, set up in the console.
Set retention, then report
Set how long logs are kept, and export the evidence pack for the period your report or audit covers.
Questions people ask
Does NIS2 require a SOC?
No. The directive names no SOC and no product. It requires appropriate and proportionate measures, including incident handling, and the reporting of significant incidents within 24 hours. In practice you have to notice an incident quickly and reconstruct what happened, with your own team, a service provider or a platform such as Schildmark.
Is EDR enough for NIS2?
No single tool is enough. Endpoint detection covers part of incident handling. NIS2 also expects vulnerability handling, checks that the measures work, business continuity, supply chain security, training, cryptography, access control and multi-factor authentication, overseen by management. Schildmark covers detection, response, verified patching and the evidence; the rest belongs in your ISMS.
How quickly must a significant incident be reported under NIS2?
An early warning without undue delay and at the latest within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. If the incident is still ongoing by then, a progress report is due instead, and the final report follows once the incident has been handled.
Who has to comply with NIS2?
Entities in the sectors of Annexes I and II of the directive with at least 50 staff, or an annual turnover and balance sheet total above EUR 10 million, and some entities regardless of size, such as DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications. National law sets the details; in Germany the BSI offers an online check.
Does Schildmark make us NIS2 compliant?
No product does. Schildmark carries out and records the technical measures for incident handling, vulnerability handling and effectiveness checks, and exports the evidence for a period. Whether your measures are appropriate is judged against your own risk analysis, by you and by your supervisory authority.
Preparing for NIS2?
Tell us your sector, your machines and your firewalls. We will show you which measures Schildmark covers in your environment and which stay with your ISMS. Priced per protected machine.