Management accountability
Management bodies approve the cybersecurity risk-management measures, oversee their implementation, receive training and can be held liable for infringements.
Directive (EU) 2022/2555 · NIS2
Start tracking your NIS2 compliance today.
Audexa turns NIS2 into measurable work: a guided 49-control audit, gaps prioritized by risk, policies, evidence and an executive report so management can approve and oversee the measures.
- 49 controls across 9 NIS2 domains
- 35 NIS2 policy templates
- Executive report for management
49 NIS2 controls with guidance and remediation steps
9 domains, from governance to the supply chain
35 NIS2 ↔ ISO 27001 mappings to reuse evidence
35 NIS2-related policy templates
What NIS2 requires
NIS2 requires risk management, incident reporting and accountable management.
The directive expands the sectors in scope and raises the bar. Technical measures are not enough: you have to show that they are managed, reviewed and overseen by management.
Risk-management measures
Article 21 lists minimum measures, including risk analysis, incident handling, business continuity, supply chain security, secure development, encryption, access control, training and MFA.
Incident reporting
Significant incidents require an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
Supply chain
The security of suppliers and service providers is part of the mandatory measures, including an assessment of their practices and vulnerabilities.
Supervision and penalties
The directive sets maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.
Ongoing evidence
Authorities can request proof of compliance. A one-off audit with no follow-up leaves gaps between reviews.
Sources: Directive (EU) 2022/2555 (EUR-Lex)
How Audexa helps
From NIS2 assessment to evidence you can show.
One workspace to assess, prioritize, execute and report, with no scattered spreadsheets or unversioned documents.
Assess
Know where you stand on every requirement.
Guided NIS2 audit
Clear questions for each control, with interpretation guidance, weighting and remediation steps.
Scope and applicability
Mark controls as not applicable or out of scope with a justification, and export the statement of applicability.
Weighted scoring
Yes, Partial and No answers with proportional impact, so the result reflects your actual situation.
Remediate
Turn every gap into work with an owner.
Action plan without duplicates
Create tasks from all or some gaps, with an owner, dates and expected evidence.
Treatable risks
Rate likelihood and impact, then choose to mitigate, accept or transfer, with management sign-off and approval.
Inventory and vulnerabilities
Link assets and suppliers to controls and detect CVE exposure with vRadar.
Prove
Keep the proof ready for management and supervisors.
Evidence vault
Private documents with expiry, review and history, reusable across controls and frameworks.
Versioned policies
Editable templates with approval, signature and one-step conversion into evidence.
Executive and technical report
PDF, Excel and Word with progress over time, gaps, risks and a roadmap for management.
Some features depend on your plan and active modules.
NIS2 controls
Check how well you meet each NIS2 control.
The 49 controls are organized into nine domains that follow the structure of the directive. Each one explains what to review, how to interpret it and what to do if it is not met.
- Scope, registration and classification as an essential or important entity
- Governance, Article 21 risk management and operational security
- Article 23 incidents and reporting, continuity and crisis management
- Supply chain, cyber hygiene, training and evidence
NIS2 policies
Create, approve and export the policies NIS2 expects to see.
Start from security templates, tailor them with your organization's variables and manage the full lifecycle: version, review, approval and signature. An active policy can be saved as evidence for the control.
- 35 NIS2-related templates in five languages
- Reusable variables: company, owners, deadlines
- Version history and restore points
- Internal or link-based signing and export to Word
NIS2 action plan
Build an action plan to close your NIS2 gaps.
Each gap can become a task with the control's context, recommended steps and expected evidence. Completing a task does not mark the control as compliant: evidence and a re-audit confirm the progress.
- A plan from all or only some gaps, with no duplicate tasks
- Owner, start, due and review dates
- Evidence linked to controls, tasks and policies
- Exportable audit pack with approved evidence
How it works
Three steps from uncertainty to a NIS2 plan.
Define the scope
Describe your organization, decide which controls apply and justify any exclusions.
Assess with guidance
Answer the NIS2 audit control by control and get your score and prioritized gaps.
Execute and prove
Assign tasks, gather evidence, approve policies and share the report with management.
Before and after
NIS2 in spreadsheets vs. NIS2 in Audexa.
AreaWithout a platformWith Audexa
Initial assessment
Weeks of interviews and Excel
Guided audit from day one
Gap tracking
Lists with no owner or date
Tasks with owners, deadlines and expected evidence
Evidence
Attachments scattered across email and folders
Private vault with expiry and history
Management reporting
Manual slide decks
Exportable executive report
Other frameworks
Starting from scratch for each standard
Mappings to ISO 27001 and Spain's ENS
Frequently asked questions
What people usually ask us about NIS2.
Is NIS2 already mandatory in my country?
The directive has been in force in the EU since 2023 and the transposition deadline was October 17, 2024, but it applies through each Member State's national law, and the status and details vary by country. On July 8, 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for not fully transposing it. Check your national law: preparing now avoids improvising once it applies to you.
Which companies does NIS2 apply to?
Medium-sized and large entities in the sectors listed in Annexes I and II of the directive (energy, transport, health, digital infrastructure, managed ICT services, manufacturing, food and others), and in some cases smaller entities because of their critical role. Audexa includes a dedicated domain to document scope and classification as an essential or important entity.
Does Audexa certify us for NIS2?
No. NIS2 is not a certification and Audexa does not replace the competent authority. Audexa helps you measure your alignment, carry out remediation and keep the evidence that demonstrates compliance.
We already work with ISO 27001. Do we have to start from scratch?
No. Audexa includes 61 mappings between NIS2 and ISO 27001 so you can reuse evidence and reviewable answers across both frameworks.
How long does it take to get a first compliance snapshot?
You can start the guided audit the same day. Timing depends on your organization, but the results, gaps and action plan are generated as soon as you complete the questionnaire.
How does Audexa help with incident reporting?
The NIS2 audit assesses your ability to detect, classify and report incidents within the Article 23 deadlines, and gaps become concrete tasks and policies, such as the incident reporting procedure.
Where is the data hosted?
Audexa runs on EU infrastructure, with role-based access, two-factor authentication and activity traceability.
Request a demo
See what your NIS2 compliance would look like.
In a 30-minute demo we walk through the NIS2 audit, the action plan and the management report, with examples from your sector.
- We review whether your organization may be in scope for NIS2.
- We show you the guided audit, gaps and tasks.
- We explain which plan fits your team.