NIS2 compliance built into your operations
The NIS2 Directive requires organisations to demonstrate continuous vulnerability management, documented risk analysis and cryptographic controls, and to report significant incidents within 24 and 72 hours. Secuno scores the Article 21 measures per client and drafts the Article 23 notifications when an attack is confirmed.
Six obligations. Direct Secuno coverage.
Each card maps one NIS2 Article 21 obligation to the Secuno capability that fulfils it. No bolt-ons, no manual exports.
Risk analysis and information security policies
Secuno correlates 350,000+ CVEs against every device in scope daily. Each finding carries a deterministic risk score (0-100) based on CVSS, CISA KEV membership, EPSS exploit probability, internet exposure, and device criticality. Custom risk rules enforce your own security policies automatically.
Security in network and information systems acquisition, development and maintenance
After every inventory, the platform verifies that software linked to closed vulnerabilities is actually gone. If it has returned, the risk reopens automatically before the next review cycle. Software inventory groups all installed software by name, version, and publisher across every device.
Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
Every action across the platform is logged with user, IP address, geographic location, user agent, old value, new value, and timestamp. The audit trail is immutable via the UI. Risk statistics, age and overdue trends, nightly compliance history per framework and compliance exports provide documented evidence for assessors.
Policies and procedures regarding the use of cryptography and encryption
Every agent request is signed with an Ed25519 per-device keypair. Keys are DPAPI-protected on the endpoint. Each request carries a SHA3-256 body hash and a nonce plus timestamp for replay protection. The platform tracks BitLocker encryption status per drive across every managed device.
Human resources security, access control policies and asset management
Seven role tiers from Global Admin to Client User, each with strict database-level scoping. Two-factor authentication, by authenticator app or FIDO2 security key and passkey, is enforceable per role, per client and per user. Idle sessions time out, and a password or role change ends every session the user holds. Hardware, software, and device inventories form a continuously updated asset register.
Incident handling
Related detections become one attack story with a timeline and a recommended action, and a confirmed story is the case of record. Risks get due dates set per client and per severity, and custom rules can raise a finding's severity when it stays open too long. When an accepted risk expires without remediation, it reopens automatically and the assignee is notified.
A newly exploited vulnerability should not wait for your next review cycle. In Secuno it does not.
When a CVE is added to the CISA Known Exploited Vulnerabilities catalogue, Secuno checks your portfolio for it at once, sends affected clients a critical alert and an email, and moves the fixing update to the emergency patch lane.
- CISA KEV catalogue synchronised four times a day, with an immediate check when a new entry lands
- Every escalation is logged with user, timestamp, and old/new values
- Accepted risks require a business justification with expiry date per NIS2 governance requirements
The 24-hour warning, drafted before you start typing
When an incident is significant, NIS2 gives the entity 24 hours for an early warning and 72 hours for a notification. The hardest part of that first day is working out what happened and when. Secuno starts from the attack it has already reconstructed.
Drafted from the confirmed attack
Once an analyst confirms an attack story as active, contained or resolved, the 24-hour early warning and the 72-hour incident notification are generated as drafts in Dutch and English: the entity and its provider, the nature of the incident, the timeline, the preliminary scope, and whether malicious action or cross-border impact is suspected. The notification adds the assessment, the root cause and the measures taken.
Clocks from the earliest moment
The deadlines run from the earlier of detection and the probable initial access, which dwell-time forensics estimates by looking back over the device's last 90 days. Both sets of clocks are shown, so nobody reports against the comfortable one by mistake.
A record that holds up
Every generation is a numbered version that is never edited afterwards. Sending is recorded with who sent it, when and to whom, so you can show a supervisor exactly what was reported and when.
On the compliance calendar
For clients classified as NIS2 essential or important, the calendar shows the 24-hour, 72-hour and one-month clocks of every open incident next to campaign deadlines and attestation renewals.
Secuno drafts. It does not send anything to a CSIRT or a supervisor: the entity reviews the text, completes it and submits it itself.
How attack stories and dwell-time forensics reconstruct an incident
The evidence an auditor asks for, kept current
Supervisory authorities under NIS2 can request evidence of your cybersecurity measures at any time. Secuno keeps the technical evidence current on its own, and reminds the right person before an attested policy lapses.
- Complete asset inventory: hardware, software, patch level, browser extensions, open ports
- Per-device risk register with severity, age, and remediation status
- Immutable change log: user, IP address, geographic location, old and new value on every action
- Accepted risk register with business justification, compensating controls, and expiry date
- Compliance report export: PDF, CSV, or JSON, scheduled or on demand
- Remediation deadlines set per client and per severity, with overdue findings surfaced immediately
- Cryptographic device authenticity: Ed25519 signatures, DPAPI-protected keys, replay protection
- NIS2 Article 21 risk categorisation built into every generated finding
- Article 23 early warning and notification drafts, each a numbered version, with a record of when and to whom they were sent
Dutch data jurisdiction. Built to support your GDPR and NIS2 obligations.
All data is stored and processed on Secuno's own infrastructure in the Netherlands. SECAI, the on-platform AI engine, runs locally: no CVE data, device inventory, or risk detail is sent to an external AI provider. Suitable for healthcare, financial, and government-sector clients.
The risk register an auditor can actually read
Supervisory authorities under NIS2 can request evidence of your cybersecurity measures at any time. Your Secuno risk list is that evidence, searchable, filterable, exportable, and always current.
- Every risk categorised: vulnerability, configuration, compliance, access control, network
- Status workflow with business justification required for accepted risks
- Full audit trail exported as PDF, CSV, or JSON for regulators
- 30-day statistics filterable by user, action, and date
See your NIS2 posture in under an hour
Agent deployed, first device inventoried, and a compliance report ready in under 24 hours. No scanner to configure, no integration to build.