NIS 2 Compliance with Continuous Control Assurance
What NIS 2 requires
NIS 2 is a binding EU directive that raises cybersecurity requirements for essential and important entities across the EU.
NIS 2 is Directive (EU) 2022/2555, and member states had to bring it into national law by 17 October 2024. Article 21 lists the cybersecurity risk management measures, including incident handling, business continuity and supply chain security, and Article 23 sets the reporting of significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
How DigitalXForce covers NIS 2
DigitalXForce maps NIS 2 measures to tested controls and to the supply chain duties covered by its third-party risk module.
Testing each control continuously against live evidence is Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Each control is mapped once in the AI-Powered Risk Management and Automated GRC module and tested with C-Assess for compliance and X-Assess for security.
What is tested from live data and what still needs a person
Which controls DigitalXForce tests directly from live tool data depends on the tools you connect through X-Connect and E-Connect. Controls that rest on a document, such as a signed policy, are reviewed by AI JedAI against the requirement and kept with their evidence. The demo shows that split for your own stack.
The evidence the auditor receives
For each control, the auditor receives the test result, the evidence it read, the time it was read and the history of earlier results. A-Assess prepares the evidence and findings in the form auditors review.
Other frameworks the same controls report to
For financial entities, DORA applies in place of NIS 2 on ICT risk management and incident reporting. A NIS 2 measure often also answers requirements in ISO/IEC 27001 and NIST CSF 2.0. DigitalXForce maps such a control once, so one test result reports to each framework it belongs to. The article on the common control framework explains the method.
Where to go next
NIS 2 covers many sectors, and the industries page shows how each one uses the platform. Request a demo to see your own NIS 2 controls tested.
DigitalXForce is not a certification, assessment or authorization body for NIS 2. It tests and documents the controls the framework requires.
