Measures 1 to 4
Risk analysis and information system security policies map to the Secuno risk engine and per-client policy configuration, where every risk carries a category and an owner. Incident handling maps to the per-risk audit trail, which records creation, assignment, status changes, and engine actions on a chronological timeline.
Business continuity and backup are organisational measures no agent can observe, so they are recorded as attested controls: a named person states compliant, nearly compliant or gap, with a note and optional evidence, and the attestation lapses after its review period (six months for backups) with reminders beforehand. Supply chain security maps to software inventory visibility across every managed device, which surfaces vulnerable third-party components.
Measures 5 to 7
Security in acquisition, development, and maintenance maps to continuous CVE correlation and the configuration rule engine, which flags drift from a secure baseline. Policies to assess the effectiveness of measures map to the thirty-day activity statistics and SLA reporting.
Basic cyber hygiene maps to the configuration rules that detect missing antivirus, disabled firewall profiles, and disabled disk encryption across the estate. Awareness training is an attested control, like backups.
Measures 8 to 10
Cryptography and encryption map to BitLocker encryption status reporting per drive and to the agent's own Ed25519 signing and DPAPI key protection. Human resources security and access control map to local account and Administrators group monitoring, plus identity context from AD and Entra.
Use of multi-factor authentication and secured communications maps to access-control rule coverage and the platform's own authentication. Each generated risk references the obligation it relates to, which makes the evidence traceable.
Producing the evidence
The NIS2 framework in the compliance module combines automated evidence (open risks in mapped categories, agent device checks and Microsoft 365 tenant controls) with those attestations, and never counts unknown or not applicable as a pass. It exports per framework to PDF or CSV, and the audit log exports to CSV and JSON for auditor or regulator review.
Because categorisation happens at risk creation rather than at report time, the mapping is consistent across the whole history rather than reconstructed for each audit.