NIS2 and network visibility: what DENIS can and cannot contribute

What NIS2 asks for, in short

Directive (EU) 2022/2555, known as NIS2, applies to medium and large organisations in the sectors it lists, and to some smaller ones that member states designate. Manufacturing of, for example, machinery, electrical equipment, vehicles and computer and electronic products is among the listed sectors. Member states have to transpose it into national law; the national law and your competent authority decide whether and how it applies to you.

Article 21 requires appropriate and proportionate technical, operational and organisational measures to manage the risks to network and information systems. The measures listed include risk analysis and information system security policies, incident handling, business continuity, supply chain security, security in the acquisition, development and maintenance of systems including vulnerability handling, assessment of the effectiveness of the measures, basic cyber hygiene and training, cryptography, human resources security, access control policies and asset management, and multi-factor authentication. Article 23 sets out the reporting of significant incidents, starting with an early warning within 24 hours.

For some kinds of digital service provider, including managed service providers, Commission Implementing Regulation (EU) 2024/2690 sets out the technical and methodological requirements in more detail.

Why network visibility matters for risk management

A risk analysis needs to know what exists. Incident handling needs to notice an incident and reconstruct what happened. Asset management needs a current list of assets. On a network with IT, IoT and industrial devices, much of that knowledge is missing until somebody observes the network itself.

What DENIS can contribute

• Asset management: an inventory of the networked devices DENIS can observe, with owners, locations, criticality, history and a review queue for new devices.
• Detection for incident handling: per-device baselines, rules and industrial control-command alerts, grouped into incidents with a timeline, and an audit trail of who acknowledged or resolved what.
• Vulnerability handling as context: known-exploited vulnerabilities and end-of-support software matched against what devices reveal, and imported scanner results.
• Evidence: a Compliance page that maps your current visibility to frameworks including NIS2, CIS Controls v8 and IEC 62443-3-3, and exports to a SIEM or ticketing system.
• Exposure: a connection opened from the internet to one of your devices raises an alert, where traffic accounting is on.

What DENIS does not solve

• It does not make an organisation compliant with NIS2, and no certificate or attestation comes with it. Compliance is a matter of governance, management responsibility, policies and processes.
• It does not report incidents to a CSIRT or authority, and it does not decide whether an incident is significant.
• It does not cover business continuity, backups, cryptography, training, HR security or supplier contracts.
• It only knows the devices and traffic it can observe, so the inventory is not a complete record of all assets.
• It is not a legal or compliance service. Check the national law that applies to you and, where needed, ask a qualified adviser.