Overview
The Network and Information Security Directive 2 (NIS2, EU 2022/2555) entered into force in October 2024 and applies to Essential and Important entities across 18 sectors - including energy, transport, banking, health, water, digital infrastructure, and public administration. NIS2 significantly raises the bar on cybersecurity governance: entities must implement risk management measures, maintain auditable records, and be able to produce tamper-evident evidence for regulators and incident response authorities. The core challenge is not implementing controls - it is proving those controls were applied, when, and by whom, under adversarial scrutiny.Article-Level Coverage
Article 21 - Cybersecurity Risk-Management Measures
Art. 21(2)(b) - Incident Handling
Entities must maintain procedures for handling and reporting security incidents. ROOTKey anchors incident records at the moment of creation - logs, response actions, containment decisions - making them tamper-evident and independently verifiable.
Art. 21(2)(d) - Supply Chain Security
Entities must address security risks in supply chains and vendor relationships. ROOTKey provides immutable, multi-party provenance records for software, hardware, and service procurement across organisational boundaries.
Art. 21(2)(h) - Cryptography
Entities must use cryptography and, where appropriate, encryption. ROOTKey applies SHA-256 hashing and blockchain anchoring to all integrity records - providing cryptographic proof that satisfies this requirement directly.
Art. 21(2)(a) - Risk Analysis & IS Security Policies
Entities must maintain policies on risk analysis and information system security. ROOTKey anchors policy documents, configuration records, and change logs - creating a verifiable history of security governance decisions.
Art. 21(2)(f) - Access Control
Entities must implement access control policies. ROOTKey anchors access grant and revocation events, creating an immutable record of who had access to which systems, and when that access was modified.
Art. 21(2)(g) - Asset Management
Entities must maintain asset management processes. ROOTKey records can anchor asset inventories, configuration baselines, and software bill of materials - with tamper-evident version history.
Article 23 - Reporting Obligations
NIS2 Article 23 requires significant incidents to be reported to national authorities within strict time windows:
Regulators examining an incident are scrutinising the organisation that produced the incident record. ROOTKey’s anchoring ensures that record cannot have been altered before submission.
Compliance Mapping Table
Deployment Considerations
For NIS2-regulated entities with OT/SCADA infrastructure:- Use MQTT deployment for anchoring data from industrial control systems without disrupting OT network architecture
- Use On-Premise deployment for air-gapped regulated environments where controlled outbound connections are required
- Consider EU-sovereign deployment (EBSI + OVH) for entities with national security classification requirements
Sectors Covered by NIS2
Request a NIS2 architecture review
We’ll map your NIS2 obligations by sector and entity classification to a concrete ROOTKey implementation - including evidence package design for national authorities.
See the regulatory audit trail use case
Full implementation guide for building NIS2-compliant audit trails with ROOTKey.