The NIS2 Directive (EU 2022/2555) had to be transposed by 17 October 2024; some member states transposed late, so check your national law. For essential and important entities — energy, transport, banking, financial market infrastructures, healthcare, drinking water, digital infrastructure, public administration, postal, waste, ICT services, and several other sectors — NIS2 imposes specific cybersecurity and incident-management requirements that map directly to cloud architecture.
Ænix runs NIS2-aligned platform readiness engagements for in-scope entities and the ICT third parties serving them. Output: a control-level map of where you stand today, where the gaps are, and what an architecture-level remediation plan looks like.
Pairs with: Ænix Private Cloud Platform — built to support NIS2 work (Art. 21 risk-management measures, Art. 23 incident reporting, and a published vulnerability disclosure process — see Art. 12). Tenant isolation with NetworkPolicy / Cilium segmentation, opt-in volume encryption, audit logging with configurable retention. Free NIS2 Compliance Checklist →.
Who has NIS2 in scope
The measured evidence behind these controls — full CIS Kubernetes Benchmark results, Kubernetes conformance listings, and a plain statement of what Ænix does and does not claim — lives on the compliance evidence pages. Those pages are run output and reasoning, published so an assessor can check it. AENIX s.r.o. itself holds ISO/IEC 27001:2022 certification for its own ISMS.
Reading as a CISO? The CISO guide summarises what the platform does and does not provide.
NIS2 applies broadly to:
- Essential entities — energy, transport, banking, financial market infrastructures, healthcare, drinking water, wastewater, digital infrastructure (IXPs, DNS, TLD, cloud providers, datacenter providers, CDN, MSPs, MSSPs, public electronic comms), public administration, space.
- Important entities — postal, waste management, chemical, food, manufacturing of critical products, digital service providers (online marketplaces, search engines, social platforms), R&D.
- ICT third parties serving in-scope entities.
If your sector is in scope or your customers are in scope, NIS2 architectural requirements apply.
What NIS2 requires of cloud architecture
1. Risk management measures (Article 21) Documented cybersecurity risk-management practices covering policies on risk analysis, ICT asset management, incident handling, business continuity, supply chain security, vulnerability handling, security in network/IS acquisition.
2. Incident reporting (Article 23) Incidents reported to CSIRT/competent authority within 24 hours (early warning), 72 hours (incident notification), and one month (final report). Architecture must support detection and reporting at these timelines.
3. Supply-chain security (Article 21(2)(d)) Risk-management measures must cover the security of the supply chain, including the relationships between the entity and its direct suppliers and service providers. In practice that means supplier mapping, exit readiness, and supplier monitoring — not a questionnaire on file.
4. Management-body accountability (Article 20) Management bodies must approve the risk-management measures, oversee their implementation, and follow cybersecurity training — and can be held liable for failure to do so. Compliance is not delegated entirely to technical teams.
For a control-level checklist, see the NIS2 compliance checklist.
Where most cloud setups fail NIS2 audit
Incident detection too slow for 24-hour deadline Detection requires telemetry and monitoring tuned to recognize the kinds of events NIS2 considers reportable. Most cloud setups have observability for performance, not for incident detection at NIS2 timelines.
ICT supply chain mapped only to first hop NIS2 requires visibility into the supply chain for critical-function ICT third parties. Most organizations cannot enumerate beyond their direct vendors.
Backup and BCP works on paper, not in drill NIS2 requires business continuity. Most BCP plans are documents that have never been tested under realistic failure scenarios.
Vulnerability management is reactive Patch cycles run on monthly cadence; critical vulnerabilities get emergency patches. NIS2 expects more proactive vulnerability handling for critical infrastructure.
How Ænix helps
The NIS2 engagement runs as part of our Platform Readiness Assessment with sovereignty + regulator-gap workstream emphasized. The 14- or 28-day engagement produces:
- NIS2 control-level map — control-by-control review of what your architecture demonstrates
- Supply chain mapping — to second hop for critical-function ICT third parties
- Incident detection and reporting capability assessment — telemetry and processes against the 24/72-hour/one-month timelines
- Business continuity and vulnerability management posture
- Architecture-level remediation plan
Delivered by Ænix engineers with regulator-dialog experience (engineering teams in the EU and Central Asia; EU contracts through AENIX s.r.o.). The same engineers also run DORA compliance — the 28-day variant maps both regulators in one engagement.
Why Ænix specifically
- Engineers who build the platforms — teams in the EU and Central Asia, with experience inside the same regulatory frameworks as your customers.
- No hyperscaler bias. Recommendations reflect technical fit and regulatory alignment, not partnership economics.
- Open-source platform foundation. Cozystack supports air-gapped installation, opt-in volume encryption and audit logging; the compliance evidence pages state what is and is not provided by default.
- Cross-regulator engagement — DORA + NIS2 + GDPR mapped together in 28-day variant.
| When | What | Output |
|---|---|---|
| Day 0 | 30-min discovery call (free) | Confirm fit, narrow NIS2 scope (which sectors / which obligations) |
| Days 1-13 (or 1-27) | Sovereignty + regulator-gap workstream | Daily updates, three checkpoints |
| Day 14 (or 28) | Executive readout (60-90 min) | Written report: NIS2 control map, supply-chain map, BCP/incident posture, remediation plan |
Case studies
Nine anonymised case studies are published on the case studies page, in anonymised form where the customer requires it. Reference calls are arranged under NDA where the customer agrees.
"Running Nuvolos on sovereign bare metal meant we needed hyperscaler-grade multi-tenancy without the hyperscaler. Cozystack delivered exactly that — isolated tenants, shared GPUs, KubeVirt for legacy workloads — and it's why we can promise our customers infrastructure control, not just a workspace."
Alexandru PopescuCEO, Nuvolos
14-day (focused NIS2)
On request
28-day (NIS2 + DORA + GDPR overlay)
On request
- NIS2 compliance checklist — control-level checklist
- NIS2 requirements for cloud infrastructure — long-form explainer
- DORA compliance — financial-services regulator
- Data sovereignty — adjacent trigger
- Cozystack — sovereign-by-architecture platform
Ænix created Cozystack — a CNCF Sandbox project and CNCF Certified Kubernetes distribution — and co-maintains it. AENIX s.r.o. holds ISO/IEC 27001:2022 certification.