Who is affected by NIS2?

NIS2, Directive (EU) 2022/2555, replaces the 2016 NIS Directive and covers essential and important entities in 18 sectors, as a rule of thumb from 50 employees or EUR 10 million annual turnover. Besides energy, transport, health and digital infrastructure this includes manufacturing, food, chemicals, postal services and IT service providers. In Austria it is transposed through the NISG, in Germany through the NIS2UmsuCG; in both cases the technical requirements come from Article 21. When in doubt, have your legal department check whether your company is covered.

What is the difference between essential and important entities?

Essential entities are mainly large companies in sectors of high criticality listed in Annex I, plus some particularly critical providers regardless of size. They are subject to proactive supervision and fines of up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher. Important entities are medium-sized companies in Annex I and companies in the other critical sectors of Annex II; they are supervised reactively, with fines of up to EUR 7 million or 1.4 percent. The technical minimum measures under Article 21 apply to both.

Which ten minimum measures does Article 21(2) list?

Article 21(2) lists: (a) risk analysis and information system security policies, (b) incident handling, (c) business continuity with backup management, disaster recovery and crisis management, (d) supply chain security, (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure, (f) assessing effectiveness, (g) cyber hygiene and training, (h) cryptography and encryption, (i) human resources security, access control and asset management, (j) multi-factor authentication and secured communications. blacklens.io provides evidence mainly for (a), (b), (d), (e) and (f); for (h), (i) and (j) it shows TLS certificates, privileged accounts and identities without MFA. Backups and training themselves need other tools.

Which reporting obligations apply under Article 23?

For significant incidents, Article 23 requires an early warning to the CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after the notification. blacklens.io is not a reporting tool, but it provides the information a notification needs: affected assets, time of first detection, affected identities and the timeline in the activity log.

Is an annual pentest enough for NIS2?

No. Article 21 requires vulnerability handling and the assessment of its effectiveness as an ongoing process. An annual pentest is a valuable building block but describes only one day of the year. The combination of continuous scanning, retest and a documented finding lifecycle is what auditors consider appropriate.

What evidence does a NIS2 audit require for vulnerability management?

Typically a current asset inventory, a documented scan cadence, the handling of every vulnerability with time of detection, assessment and closure, the prioritisation logic and proof that fixed vulnerabilities were rechecked. blacklens.io generates this evidence continuously; the vulnerability report and the activity log are the usual attachments.

Does NIS2 apply to our suppliers too?

Directly only if the supplier is itself an affected entity. Indirectly almost always: Article 21 requires affected companies to consider the security of their supply chain, which is why requirements are passed on contractually. With the supplier watchlist and its CSV import you evidence ongoing monitoring.

Does blacklens.io replace an ISMS?

No. An ISMS comprises policies, roles, risk register, training and reporting procedures. blacklens.io is the technical data source from which the ISMS draws its evidence for inventory, vulnerabilities, threats and supply chain, via report, CSV export or API. For management, which approves and oversees the measures under Article 20, the executive report and the exposure score trend provide an understandable basis without reading individual findings.

Compliance

Implementing NIS2 risk management technically

NIS2 requires ongoing risk management: handle vulnerabilities, secure the supply chain, manage incidents. blacklens.io delivers the technical evidence, continuously rather than once a year.

Start free trial Book a demo

NIS2 evidenceas PDF

Asset inventory and exposure scoreNIS2 Art. 21 (2) acontinuous

Supplier watchlistNIS2 Art. 21 (2) dabout every 30 min

Vulnerability reportNIS2 Art. 21 (2) emonthly

Executive report with trendNIS2 Art. 21 (2) fweekly

What NIS2 requires

Directive (EU) 2022/2555 applies to essential and important entities. These four points shape the technical implementation.

Art. 20

Management is accountable

Management bodies approve the measures, oversee their implementation and undergo training.

Art. 21(2)

Ten minimum measures

From risk analysis and vulnerability handling to MFA, as an ongoing process.

Art. 23

Report in 24 h, 72 h, 1 month

Early warning, incident notification and final report for significant incidents.

Annexes I and II

18 sectors

Rule of thumb: from 50 employees or EUR 10 million turnover. Suppliers often by contract.

Technical guidance, not legal advice. Which obligations apply to you is for your legal department, auditor or supervisory authority to confirm.

Article 21 mapped to blacklens.io

For each measure with a technical core, the capability that provides the evidence. The remaining measures are covered in the FAQ.

Art. 21(2)(a)

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

Art. 21(2)(e)

Fix firstsorted by risk

1CVE-2024-21762vpn.beispiel-gmbh.atKEV

2CVE-2024-21410mail.beispiel-gmbh.atKEV

3TLS 1.0 enabledshop.beispiel-gmbh.atMedium

Art. 21(2)(d)

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Art. 21(2)(b)

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

Art. 21(2)(f)

Reportsscheduled by email

PDFExecutive reportWeekly, Monday 07:00

PDFVulnerability reportMonthly

PDFPentest reportAfter every test

Management, head of IT

Visuals show sample data.

Four steps to continuous evidence

1
Define the scope
Add domains, IP ranges and cloud accounts. Scope suggestions show what is still missing.
2
Scan outside and inside
The external attack surface is tracked automatically, Sentry scans the internal network on schedule.
3
Add suppliers
Import your supplier list as CSV; leak site matching then runs automatically.
4
Schedule the evidence
Executive and vulnerability reports go to management, ISMS and auditor on schedule.

Example from practice

Critical infrastructure operator prepares for a NIS2 audit

A critical infrastructure company had to implement NIS2 technically and prove it in an audit. With blacklens.io, attack surface and vulnerabilities were monitored continuously, prioritised and documented in automated reports.

Result
In the audit, the technical protection of the external systems was rated "exemplary and consistently documented".

Remediationone workflow for every source

12Open

5In progress

2Risk accepted

48Closed

CVE-2024-21762

Assigned to IT operations
Update installed
Re-scan confirmed: closed automatically

Visuals show sample data.

Frequently asked questions

: NIS2, Directive (EU) 2022/2555, replaces the 2016 NIS Directive and covers essential and important entities in 18 sectors, as a rule of thumb from 50 employees or EUR 10 million annual turnover. Besides energy, transport, health and digital infrastructure this includes manufacturing, food, chemicals, postal services and IT service providers. In Austria it is transposed through the NISG, in Germany through the NIS2UmsuCG; in both cases the technical requirements come from Article 21. When in doubt, have your legal department check whether your company is covered.
: Essential entities are mainly large companies in sectors of high criticality listed in Annex I, plus some particularly critical providers regardless of size. They are subject to proactive supervision and fines of up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher. Important entities are medium-sized companies in Annex I and companies in the other critical sectors of Annex II; they are supervised reactively, with fines of up to EUR 7 million or 1.4 percent. The technical minimum measures under Article 21 apply to both.
: Article 21(2) lists: (a) risk analysis and information system security policies, (b) incident handling, (c) business continuity with backup management, disaster recovery and crisis management, (d) supply chain security, (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure, (f) assessing effectiveness, (g) cyber hygiene and training, (h) cryptography and encryption, (i) human resources security, access control and asset management, (j) multi-factor authentication and secured communications. blacklens.io provides evidence mainly for (a), (b), (d), (e) and (f); for (h), (i) and (j) it shows TLS certificates, privileged accounts and identities without MFA. Backups and training themselves need other tools.
: For significant incidents, Article 23 requires an early warning to the CSIRT or competent authority within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after the notification. blacklens.io is not a reporting tool, but it provides the information a notification needs: affected assets, time of first detection, affected identities and the timeline in the activity log.
: No. Article 21 requires vulnerability handling and the assessment of its effectiveness as an ongoing process. An annual pentest is a valuable building block but describes only one day of the year. The combination of continuous scanning, retest and a documented finding lifecycle is what auditors consider appropriate.
: Typically a current asset inventory, a documented scan cadence, the handling of every vulnerability with time of detection, assessment and closure, the prioritisation logic and proof that fixed vulnerabilities were rechecked. blacklens.io generates this evidence continuously; the vulnerability report and the activity log are the usual attachments.
: Directly only if the supplier is itself an affected entity. Indirectly almost always: Article 21 requires affected companies to consider the security of their supply chain, which is why requirements are passed on contractually. With the supplier watchlist and its CSV import you evidence ongoing monitoring.
: No. An ISMS comprises policies, roles, risk register, training and reporting procedures. blacklens.io is the technical data source from which the ISMS draws its evidence for inventory, vulnerabilities, threats and supply chain, via report, CSV export or API. For management, which approves and oversees the measures under Article 20, the executive report and the exposure score trend provide an understandable basis without reading individual findings.

Compliance & audit

Overview of NIS2, ISO 27001, TISAX, DORA and critical infrastructure.

CTEM

The cycle that generates NIS2 evidence continuously.

Supply chain monitoring

Evidence supply chain security under Article 21.

ISO 27001

Evidence Annex A controls with the same data.

NIS2 evidence that is ready before the audit

Start with your domains and see how inventory, findings and reports come together. Or discuss your NIS2 implementation with us in a demo.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings