21RISK is NIS2 compliance software for groups with many sites. Adopt the requirements of the directive ready-made, reuse the controls you already run for ISO 27001, and show your management which requirements still have no control.
NIS2 sits next to your other frameworks in Frameworks and Controls. Open an Article 21 measure and see what covers each requirement, and which ones have no control yet.
NIS2 rarely starts from zero. The work is to connect what you already do to what the directive asks for, and to keep it current.
Most of what NIS2 asks for already exists as ISO 27001 or SOC 2 controls. A separate NIS2 spreadsheet describes the same controls twice, and the two copies drift apart.
Article 20 makes the management body approve and oversee the measures. That needs an answer to one question: what is in place, and what is still missing?
Policies sit in a shared drive, audit findings in a spreadsheet and the fixes in email. When the authority asks, someone has to put it together by hand.
Start from the requirements, reuse what exists and spend your time on what is missing.
Add NIS2 in Frameworks and Controls: 64 requirements from the directive and its implementing regulation, with a suggested control for each. Mark what does not apply to you, with the reason.
If you already have ISO 27001 or SOC 2 in 21RISK, the suggested controls you hold are linked to their NIS2 requirements instead of being created again. Coverage then shows what is left.
Give each control an owner and link the policies behind it. Audit findings land on a findings board, each linked to the control it affects, and stay open until the fix is done.
Article 20, Article 21 with the measures of Implementing Regulation 2024/2690 under each area, and Article 23.
CONTROLSWrite a control once and map it to NIS2, ISO 27001 and SOC 2. Change it in one place.
COVERAGEA requirement that does not apply stays on record with its reason and leaves the coverage count.
POLICIESKeep the document, the owner and the review date. 21RISK records who approved it and when, and which version was in force.
FINDINGSLink a finding to the control it affects. Statuses, due dates and history show who fixed what.
AIConnect Claude or another assistant to read your requirements, controls and findings, and draft the next step.
21RISK started with property insurance. A cyber incident at a plant is a business interruption question too, so the security team and the risk manager keep one set of sites, people and access.
Often, yes. Annex II of the directive covers the manufacture of food, chemicals, medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment. It generally applies from medium-sized companies upward: 50 employees, or €10 million in both turnover and balance sheet. These companies are usually important entities. The national law of each country decides, so check it with your legal advisor.
64 requirements in four parts: scope, registration and supervision; governance under Article 20; the Article 21 risk-management measures; and incident reporting under Article 23. Suggested controls are mapped to every requirement, and everything stays editable in your copy.
Implementing Regulation (EU) 2024/2690 is binding for digital providers such as cloud, data centre and managed service providers. For other companies it is a practical reading of what Article 21(2) expects, which is why the template uses it to break each measure into concrete requirements. Mark what does not fit you as not applicable, with the reason.
No. A control can count for several frameworks: 38 of the 50 library controls mapped to NIS2 are also mapped to ISO 27001. When you adopt the second framework, the suggested controls you already have are linked to its requirements instead of being created again. The 12 NIS2-specific controls cover what ISO 27001 does not ask for by name, such as registration with the authority and the incident notification procedure.
No. 21RISK shows which requirements have a control. Whether a control works is what your audits show, and the findings linked to it are where that shows up. NIS2 is a directive, so the binding obligations are in each country’s national law. The template paraphrases the legal text and is not legal advice.
No. Article 23 sets an early warning within 24 hours and an incident notification within 72 hours, and you send those to your CSIRT or competent authority yourself. 21RISK keeps the control that describes your notification procedure, its owner and the policy behind it.
It is not a security tool. It does not scan for vulnerabilities, monitor networks, collect logs or detect incidents. 21RISK covers the management side: requirements, controls, policies, approvals and the follow-up on findings.
Member States must allow fines of up to at least €7 million or 1.4% of worldwide annual turnover for important entities, and €10 million or 2% for essential entities, whichever is higher. National law can set higher limits.
Requirements, controls and policies, on the same platform as your sites, audits and insurance.