NIS2 — Network & Information Security Directive

NIS2, out of the spreadsheet.

Essential and important entities. Supply-chain security obligations. 24-hour incident notification, transposed differently across 27 member states. The Agency keeps your NIS2 evidence trail current and your supply-chain visibility live.

The numbers your team already knows.

NIS2 raised the stakes — wider scope, stricter supply-chain obligations, and member-state transpositions that move the goalposts country by country. Your evidence trail has to keep up.

27 states
EU member states, each transposing NIS2 with local nuances
Cross-border evidence reuse matters
24 hrs
Initial incident notification window
NIS2 Article 23
Article 21
Risk management and supply-chain security obligations
Continuous, evidence-backed

TARA, VANCE, REX — your NIS2 evidence layer.

Three of The Agency's leads cover NIS2 end-to-end: continuous gap analysis, regulator-formatted reporting per member state, and supply-chain monitoring that keeps Article 21 obligations evidenced.

TARA avatar
TARA
Compliance & Remediation

Article 21 supply-chain security, continuously evidenced. TARA assesses your supply-chain posture against NIS2 obligations on a rolling basis — and tracks remediation against the deadlines the directive expects.

What you get
  • Article 21 supply-chain security gap analysis
  • Member-state-aware control mapping
  • Treatment plans with deadlines and SLA tracking
VANCE avatar
VANCE
Regulatory Reporting

Incident reports formatted for the right regulator. VANCE generates NIS2 incident packs, board-pack summaries and cross-border evidence bundles — formatted for the supervisory authority actually reviewing them.

What you get
  • 24-hour and 72-hour incident reports composed
  • Cross-border evidence packages assembled automatically
  • Tamper-evident audit trail per output
REX avatar
REX
Supply-Chain Monitoring

Supply-chain visibility kept live, not point-in-time. REX maps your vendors, their vendors, and the breach signal from both — so Article 21 supply-chain security has actual evidence behind it.

What you get
  • Fourth-party discovery — supply-chain depth mapped
  • Continuous breach signal correlated against the chain
  • Material-change detection within the 24-hour window

Four shifts you'll feel across member states.

NIS2 stops being a sprint to the local transposition deadline and becomes a continuous evidence layer that adapts when each member state moves the goalposts.

Article 21 supply-chain security, evidenced

Supply-chain posture is mapped, scored and continuously evidenced — not asserted in a slide deck.

Incident notifications within the 24-hour window

REX detects material change continuously; VANCE drafts the notification; your team reviews and submits.

Sector-aware NIS2 mapping

Essential entity vs important entity, with the right evidence depth and reporting cadence per classification.

Cross-border evidence assembly compressed

One evidence layer feeds reports for every member state your operations touch — no re-assembly per regulator.

The brief format is the difference. We stopped getting lists of findings and started getting decisions. That's the bit that was missing.

SR
Head of Third-Party Risk
UK Tier 1 Bank

See it on your vendors.

Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.