EU
NIS 2
The EU directive that sets cybersecurity risk-management and incident-reporting duties.
Who it applies to
Essential and important entities in 18 sectors across the EU, from energy and health to digital providers.
What it can cost
Essential entities: up to €10 million or 2% of worldwide turnover. Important entities: up to €7 million or 1.4%.
- Applies from
- 18 October 2024, through national laws
- Incident reporting
- Early warning in 24 hours, notification in 72 hours
- Accountability
- Management bodies approve and oversee the measures
What NIS 2 asks of you
- 01Risk analysis and security policies
- 02Incident handling
- 03Business continuity and crisis management
- 04Supply chain security
- 05Vulnerability handling and disclosure
- 06Cryptography, access control and MFA
How orta covers NIS 2
14 NIS 2 requirements, mapped
Each requirement is linked to orta's common controls, so evidence you already have counts here too.
Checked from your own systems
Host, Kubernetes and AWS checks run on a schedule and mark controls passing or failing, every day.
Policies drafted from a conversation
orta interviews your team by voice or text, asks only what NIS 2 needs, and drafts the policy set from the answers.
Ready for your auditor
Give them a read-only login to see controls, evidence and documents in one place.
What feeds it
- Continuous complianceA passing check counts in every framework that needs it.
- Runtime detectionCatch the attack while it is happening.
- Vulnerability managementFewer false alarms, real fixes.
- Risk managementRisk that moves with reality.
