Checks, NIS2, Early access
NIS2 readiness, with the 24 hour, 72 hour and one month reports checked.
nerix reads your documents and records against the cyber security duties of NIS2: risk management measures, incident reporting, supply chain security and management accountability. It also tells you whether the rules apply to your business and why. Early access.
The free plan is one seat and 3,000 credits a month, never charged.
01What nerix checks
Thirty-five duties, from board oversight to supply chain security.
The library holds the NIS2 duties as 35 requirements, in full with a link to the official text. They include board oversight of security measures, training for board and staff, risk analysis and a security policy, incident handling, business continuity, supplier security, secure development, patching, encryption, access rights, multi-factor login, logging and network protection.
Incident reporting has a requirement for each step in time: the early warning within 24 hours, the incident notification within 72 hours and the final report within one month, with reporting thresholds and follow-up reports. nerix looks in your documents for each duty. A document that only mentions it counts as Partly found, and a person confirms every result.
- GovernanceBoard oversight, management accountability, security officer and contact point, training.
- Risk measuresRisk analysis and policy, continuity, supplier and supply chain security, secure development, patching, encryption, access, multi-factor login, logging.
- Incident reportingEarly warning in 24 hours, notification in 72 hours, final report in one month, thresholds, follow-up reports, informing service users.
- AuthoritiesRegistration in the entity register, keeping details current, cooperating with supervisory inspections.
02Does it apply to you
Sector and size decide, and nerix says what it is missing.
NIS2 covers entities in the sectors of its Annex I and Annex II that are medium-sized or larger, and some kinds of entity of any size. nerix tests your sector code and your size against that rule. If it lacks the sector, the number of employees or the turnover, the answer is unknown and the law stays in your plan with a short question for you.
A law is set to not apply only with positive evidence from your facts. You can set a locked law to Not applicable for us only with a reason, which is kept with your name. Some kinds of entity are covered whatever their size. The rule cannot see those, so such a business stays unknown and the law stays in your plan.
- SectorAnnex I and II sectors by NACE code, such as energy, transport, health, digital providers and some manufacturing.
- SizeMedium-sized or larger, from your employees, turnover and balance sheet.
- UnknownA fact that is missing becomes a question, never a no.
03Where it stops
The library follows the Dutch law. Check your own country's act.
NIS2 is an EU directive that each member state turns into national law. The library's entry follows the Dutch Cyberbeveiligingswet (Cbw) and its official text, with the directive behind it. Some requirements name Dutch bodies and routes, such as the reporting route for healthcare providers. If you are in another country, check the national act: nerix does not hold a separate entry for it yet.
nerix reads documents and records. It does not scan your network, find vulnerabilities or file a report with an authority for you. Its rule for who is covered was written from the directive with its citation and carries no recorded human review yet. Readiness information, not an audit or legal advice.
Readiness information, not an audit, a certificate or legal advice.
04Questions
Questions
Does NIS2 apply to my business?
It depends on your sector and size. nerix tests your sector and size against the directive's annexes and says why. If it does not have a fact, it asks, and does not assume no.
Does nerix report incidents to the authority?
No. It checks that you have a reporting procedure with the three steps (24 hours, 72 hours, one month) and the records to show it. You send the report yourself.
Which country's law is it?
The library follows the EU directive through the Dutch Cyberbeveiligingswet. Other member states' acts are not separate entries yet, so check yours.
Can nerix test our security?
No. It reads your policies, procedures and records. It does not scan systems, find vulnerabilities or prove a measure works.
Is there an NIS2 incident template?
The plan includes an NIS2 readiness check, a cyber basics check, an incident response tabletop, a business continuity drill and a vendor security review. The free template library has an incident response plan, an IT security policy and an incident log.
What does a check cost?
The price is shown before you start: credits per requirement checked, plus a one-time charge the first time each document is read. See the pricing page.
Need something this does not do? We build it into your workspace. Built for you
- ISO 27001 information securityCheck your documents against the ISO 27001 clauses and all 93 Annex A controls, build the statement of applicability from the result, and invite your auditor.
- GDPR data protectionCheck your documents against 38 GDPR duties, from the processing register to breach notification, and find out whether the rules apply to your business.
- EU AI ActCheck your documents against 45 duties of the EU AI Act, from the register of AI systems to human oversight, and see whether the Act applies to you.
- ISO 9001 quality managementSee which ISO 9001 clauses your documents and records already show, run the internal audits and management review it asks for, and turn gaps into tasks.
- Checks, the whole productThe plan, internal checks, issues and business reviews that every readiness check sits beside.
- TemplatesFree policy, register and checklist templates you can fill in and download.
Keep reading
Quality and audits7 min read
NIS2 checklist for small companies
A NIS2 checklist for small companies. See if the directive applies, the ten Article 21 security measures and the 24 hour, 72 hour and one month deadlines.