Whether your business is in scope or sells to companies that are, you will be asked to show documented risk analysis and vulnerability handling. CyberRiskGuru builds that record as you work — and is honest about what it does not cover.
Generally medium and large companies — 50 or more employees, or over €10 million turnover — in the sectors listed in the directive's annexes. Article 21 requires risk-management measures you can document.
Supply chain security is one of the mandatory Article 21 measures, so covered companies must assess their suppliers. Expect security questionnaires and contract clauses — even if you are too small to be in scope yourself.
General information, not legal advice. Whether and how NIS2 applies to you depends on your sector, your size and how your country implements the directive.
The ten minimum measures in Article 21(2), and where CyberRiskGuru gives you evidence. The rest is policy and process work — yours, or your consultant's.
| Measure | Evidence | What you get |
|---|---|---|
| (a)Risk analysis and information system security policies | Covered | A threat model per application: assets, attack surface, design weaknesses (MITRE CWE), attack methods (CAPEC) and your risk posture over time. |
| (b)Incident handling | Partly | Incidents logged against the attack vectors in your model. Your incident response procedure itself is yours to write. |
| (c)Business continuity, backup and crisis management | Not covered | Policy and process work. |
| (d)Supply chain security | Partly | An inventory of the third-party software in your stack, with versions, monitored for vulnerabilities. Assessing your suppliers is not covered. |
| (e)Security in acquisition, development and maintenance, including vulnerability handling | Covered | Nightly matching against the exact versions you run, known-exploited (CISA KEV) first — each finding verified, mitigated or dismissed, with dates. |
| (f)Assessing the effectiveness of the measures | Covered | Controls and their status, maturity level and residual risk tracked over time — a dated trail, not a one-off report. |
| (g)Basic cyber hygiene and training | Not covered | The in-app mentor videos help, but they are not training records. |
| (h)Cryptography and encryption | Not covered | Policy work. |
| (i)HR security, access control and asset management | Not covered | Your model's asset and user-role profile supports this work, but is not an HR or access-control process. |
| (j)Multi-factor authentication and secured communications | Not covered | Policy and configuration work. |
Pick what fits — it tells us how to help. Every option starts with a free account.