The NIS2 Compliance Cloud Architecture Checklist is a free 35-point self-assessment for essential and important entities subject to the EU NIS2 Directive. It maps cloud and platform architecture against Article 21 risk-management measures across 10 areas, Article 23 incident-reporting timelines (24-hour early warning, 72-hour notification, 1-month final report), supply-chain security, business continuity (RTO/RPO), MFA, encryption, and vulnerability management. It is aimed at security, compliance, and platform teams at NIS2-regulated organizations and the ICT providers serving them. Aenix uses this checklist during NIS2-aligned readiness engagements; its Ænix Private Cloud Platform, built on the CNCF project Cozystack, supports these controls with Tenant CRD network segmentation enforced by Cilium, opt-in volume encryption under keys you hold, and API audit logging you route and retain yourself. Aenix claims no NIS2 certification: compliance belongs to the regulated entity.
A 35-point checklist for essential and important entities subject to NIS2. Covers Article 21 risk management measures (10 areas), Article 23 incident reporting timelines, supply-chain transparency, business continuity, MFA, encryption, and architecture-level controls. Used by Ænix during NIS2-aligned readiness engagements.
Pairs with: Ænix Private Cloud Platform — built to supply the platform-side controls NIS2 work draws on: Tenant CRD with Cilium NetworkPolicy for segmentation, opt-in volume encryption under keys you hold, audit logging you retain, and a published coordinated vulnerability disclosure process of the kind Article 12 describes.
What’s in the checklist
Five sections, 35 architectural control points:
- Risk management (10 points) — the Article 21(2)(a)-(j) cybersecurity risk-management measures, plus the management-body accountability of Article 20
- Incident handling and reporting (6 points) — Article 23(4) readiness: 24-hour early warning, 72-hour incident notification, one-month final report
- Business continuity and vulnerability management (7 points) — documented and tested RTO/RPO, patch SLA, SAST/DAST in CI, coordinated vulnerability disclosure (Article 12)
- Supply chain and cryptography (6 points) — Article 21(2)(d) supplier security to the second hop, Article 21(2)(h) cryptography and encryption posture
- Access control and audit (6 points) — Article 21(2)(i)-(j) access control and MFA, plus Article 21(2)(f) effectiveness assessment
Who uses this
- Essential entities (energy, transport, banking, healthcare, public administration, digital infrastructure, MSPs)
- Important entities (postal, manufacturing of critical products, digital service providers, R&D)
- ICT third-party providers serving essential entities
After downloading
The checklist gives you the working surface to assess your architecture against NIS2. For deeper engagement see NIS2 compliance services.
Ænix is the team behind Cozystack (CNCF Project), and we offer Ænix Platform — our commercial productized offering based on Cozystack.
Frequently asked questions
Who must comply with NIS2?
NIS2 applies to essential entities (energy, transport, banking, healthcare, public administration, digital infrastructure, MSPs) and important entities (postal, manufacturers of critical products, digital service providers, R&D), plus ICT third-party providers serving them. The checklist covers all three groups.
What are the NIS2 incident-reporting timelines?
Under Article 23, regulated entities must submit an early warning within 24 hours of becoming aware of a significant incident, a fuller incident notification within 72 hours, and a final report within one month. The checklist helps you verify your architecture and processes can meet each deadline.
Is the checklist free, and what do I get?
Yes. It is a free downloadable PDF with 35 points covering Article 21 risk-management measures across 10 areas, Article 23 reporting timelines, supply-chain security to at least the second hop, business continuity with documented RTO/RPO, MFA, encryption posture, and vulnerability management.
How does Aenix help with NIS2 compliance?
Aenix uses this checklist during NIS2-aligned readiness engagements and offers NIS2 compliance services for deeper work. The platform supplies controls, not compliance: NIS2 obligations sit with the essential or important entity, and no platform can hold them. Ænix Private Cloud Platform, built on the CNCF project Cozystack, supports relevant controls through Tenant CRD segmentation with Cilium NetworkPolicy, opt-in volume encryption under keys you hold, and API audit logging you route and retain.
What is Cozystack and how does it relate to this checklist?
Cozystack is an open-source, Apache 2.0 cloud platform and CNCF Sandbox project that runs VMs and containers on one Kubernetes API via KubeVirt, with Cilium (eBPF) networking and LINSTOR/DRBD storage. Aenix is the team behind it and sells the productized Ænix Platform on top, the architecture this NIS2 checklist is designed to assess.
