BY NEURABYTE
FRAMEWORKS/SECURITY/NIS 2
NIS2
SECURITY · European Union

NIS 2

EU cybersecurity obligations for essential and important entities.

The NIS 2 Directive replaced NIS 1 in October 2024 and widened the set of sectors covered, from energy and transport to digital providers and manufacturing. It imposes risk management measures, supply chain security, and incident reporting with a 24-hour early warning and 72-hour notification.

AT A GLANCE
ISSUEREuropean Union REGIONEU member states CATEGORYSecurity CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Medium and large entities in the 18 listed sectors
02Digital infrastructure and managed service providers
03Suppliers to essential entities, through supply chain requirements
02. KEY REQUIREMENTS

The parts of NIS 2 that touch what agents do.

Art. 21(2)(i) Access control
Policies on access control and asset management, including for privileged accounts.
Art. 21(2)(b) Incident handling
Procedures to detect, analyze, and respond to incidents, with evidence to support reporting.
Art. 21(2)(e) Secure development
Security in acquisition, development, and maintenance, including vulnerability handling.
Art. 23 Reporting
Significant incidents are reported to the CSIRT or competent authority within statutory deadlines.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against NIS 2. Where there is no evidence, the report says gap.

LORE CONTROL NIS 2 REFERENCE
Blocking authorization gateArt. 21(2)(i)
Maker–checker approvalArt. 21(2)(i), 21(2)(j)
Signed, hash-chained receiptsArt. 21(2)(b), Art. 23
Context disclosure recordArt. 21(2)(h)
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Board accountability and training obligations are organizational.
National transposition varies; the crosswalk follows the Directive text, not each member state's law.
05. QUESTIONS
Are we an essential or important entity?
That depends on sector and size thresholds in Annexes I and II. Your national authority decides; counsel can help.
How does Lore help with 72-hour reporting?
The receipt chain lets you reconstruct what an agent did, when, and under whose authority without waiting on log correlation.
Does NIS 2 mention AI?
Not directly. But agents acting inside covered systems fall under the same access and incident requirements.
← PREVIOUSPCI DSS 4.0 ALL FRAMEWORKS NEXT →GDPR
NIS 2 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for NIS 2 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.