The NIS2 Directive (EU 2022/2555) is in transposition across EU member states with deadlines that have already passed for many. For essential and important entities — energy, transport, banking, financial market infrastructures, healthcare, drinking water, digital infrastructure, public administration, postal, waste, ICT services, and several other sectors — NIS2 imposes specific cybersecurity and incident-management requirements that map directly to cloud architecture.
Ænix runs NIS2-aligned platform readiness engagements for in-scope entities and the ICT third parties serving them. Output: a control-level map of where you stand today, where the gaps are, and what an architecture-level remediation plan looks like.
Pairs with: Ænix Private Cloud Platform — NIS2-aligned by design (Art. 21 risk-management measures, Art. 23 incident reporting, Art. 12 coordinated vulnerability disclosure). Tenant CRD with NetworkPolicy / Cilium for segmentation, customer-controlled encryption, audit-ready logging. Free NIS2 Compliance Checklist →.
Who has NIS2 in scope
The measured evidence behind these controls — full CIS Kubernetes Benchmark results, Kubernetes conformance listings, and a plain statement of what Aenix does and does not claim — lives on the compliance evidence pages. Nothing there is a certification; it is the run output and the reasoning, published so an assessor can check it.
NIS2 applies broadly to:
- Essential entities — energy, transport, banking, financial market infrastructures, healthcare, drinking water, wastewater, digital infrastructure (IXPs, DNS, TLD, cloud providers, datacenter providers, CDN, MSPs, MSSPs, public electronic comms), public administration, space.
- Important entities — postal, waste management, chemical, food, manufacturing of critical products, digital service providers (online marketplaces, search engines, social platforms), R&D.
- ICT third parties serving in-scope entities.
If your sector is in scope or your customers are in scope, NIS2 architectural requirements apply.
What NIS2 requires of cloud architecture
1. Risk management measures (Article 21) Documented cybersecurity risk-management practices covering policies on risk analysis, ICT asset management, incident handling, business continuity, supply chain security, vulnerability handling, security in network/IS acquisition.
2. Incident reporting (Article 23) Incidents reported to CSIRT/competent authority within 24 hours (early warning), 72 hours (incident notification), and one month (final report). Architecture must support detection and reporting at these timelines.
3. Supply-chain security (Article 21(2)(d)) Risk-management measures must cover the security of the supply chain, including the relationships between the entity and its direct suppliers and service providers. In practice that means supplier mapping, exit readiness, and supplier monitoring — not a questionnaire on file.
4. Management-body accountability (Article 20) Management bodies must approve the risk-management measures, oversee their implementation, and follow cybersecurity training — and can be held liable for failure to do so. Compliance is not delegated entirely to technical teams.
For control-level checklist, see the NIS2 requirements article.
Where most cloud setups fail NIS2 audit
Incident detection too slow for 24-hour deadline Detection requires telemetry and monitoring tuned to recognize the kinds of events NIS2 considers reportable. Most cloud setups have observability for performance, not for incident detection at NIS2 timelines.
ICT supply chain mapped only to first hop NIS2 requires visibility into the supply chain for critical-function ICT third parties. Most organizations cannot enumerate beyond their direct vendors.
Backup and BCP works on paper, not in drill NIS2 requires business continuity. Most BCP plans are documents that have never been tested under realistic failure scenarios.
Vulnerability management is reactive Patch cycles run on monthly cadence; critical vulnerabilities get emergency patches. NIS2 expects more proactive vulnerability handling for critical infrastructure.
How Ænix helps
The NIS2 engagement runs as part of our Platform Readiness Assessment with sovereignty + regulator-gap workstream emphasized. The 14- or 28-day engagement produces:
- NIS2 control-level map — control-by-control review of what your architecture demonstrates
- Supply chain mapping — to second hop for critical-function ICT third parties
- Incident detection and reporting capability assessment — telemetry and processes against the 24/72-hour/one-month timelines
- Business continuity and vulnerability management posture
- Architecture-level remediation plan
Delivered by EU-based engineers with regulator-dialog experience. Same engineers also run DORA compliance — the 28-day variant maps both regulators in one engagement.
Why Ænix specifically
- EU-based engineers with experience inside the same regulatory frameworks as your customers.
- No hyperscaler bias. Recommendations reflect technical fit and regulatory alignment, not partnership economics.
- Open-source platform foundation. Cozystack supports air-gap, customer-controlled keys, full audit trails — sovereignty-by-architecture.
- Cross-regulator engagement — DORA + NIS2 + GDPR mapped together in 28-day variant.
| When | What | Output |
|---|---|---|
| Day 0 | 30-min discovery call (free) | Confirm fit, narrow NIS2 scope (which sectors / which obligations) |
| Days 1-13 (or 1-27) | Sovereignty + regulator-gap workstream | Daily updates, three checkpoints |
| Day 14 (or 28) | Executive readout (60-90 min) | Written report: NIS2 control map, supply-chain map, BCP/incident posture, remediation plan |
"Running Nuvolos on sovereign bare metal meant we needed hyperscaler-grade multi-tenancy without the hyperscaler. Cozystack delivered exactly that — isolated tenants, shared GPUs, KubeVirt for legacy workloads — and it's why we can promise our customers infrastructure control, not just a workspace."
Alexandru PopescuCEO, Nuvolos
14-day (focused NIS2)
On request
28-day (NIS2 + DORA + GDPR overlay)
On request
- NIS2 requirements article — control-level guide
- DORA compliance — financial-services regulator
- Data sovereignty — adjacent trigger
- Cozystack — sovereign-by-architecture platform
Ænix is the team behind Cozystack — a CNCF Project, Kubernetes Certified Distribution.