NIS2 Compliance.
Continuous monitoring, documented evidence.
The NIS2 Directive requires organisations across 18 sectors to implement cybersecurity measures — or face fines up to €10M. National laws are now taking effect across the EU.
EU Directive
In force
Since Jan 16, 2023
National transposition
Ongoing
Deadline was Oct 17, 2024
Germany (NIS2UmsuCG)
In force
Since Dec 6, 2025
Affected entities must comply from the date their national law takes effect. Check your country's implementation status.
Does NIS2 apply to you?
NIS2 applies to essential and important entities in 18 sectors. If your organisation has 50+ employees or €10M+ turnover in one of these sectors, you are likely in scope.
Energy
Essential
Transport
Essential
Banking
Essential
Health
Essential
Digital Infrastructure
Essential
ICT Services
Essential
Chemicals
Important
Manufacturing
Important
Postal Services
Important
Cloud / SaaS
Important
Food
Important
Research
Important
The cost of non-compliance
Essential entities
€10M
or 2% of global annual turnover
whichever is higher
Important entities
€7M
or 1.4% of global annual turnover
whichever is higher
Management can be held personally liable under NIS2 Art. 20.
What NIS2 requires — and what SiteGuardian monitors
NIS2 Art. 21 defines 10 cybersecurity risk management measures. SiteGuardian continuously monitors the technical ones.
Risk analysis and security policies
MonitoredSiteGuardian provides continuous security posture scoring, DNSSEC validation, vulnerability disclosure checks (security.txt), server version concealment, and an immutable audit trail with hash-chain tamper detection.
Incident handling
MonitoredSiteGuardian detects incidents in real time, supports NIS2-compliant reporting workflows (24h early warning, 72h notification, 30-day final report), and generates pre-filled incident reports for your national CSIRT.
Business continuity
SiteGuardian monitors uptime from multiple regions and alerts on outages. Backup management, disaster recovery plans, and crisis management require organisational measures.
Supply chain security
MonitoredSiteGuardian classifies monitors into own infrastructure, suppliers, and partners. It scores supplier security posture, verifies DMARC/SPF/DKIM enforcement, and tracks supply chain concentration risk across 5 maturity levels.
Secure development
SiteGuardian monitors Content Security Policy quality, detects unsafe-inline/unsafe-eval directives, and checks for security headers that protect against injection attacks. Secure SDLC processes require organisational measures.
Effectiveness assessment
MonitoredSiteGuardian tracks your compliance score over time, generates 90-day trend reports, and provides before/after comparisons to measure the effectiveness of your security improvements.
Cyber hygiene and training
MonitoredSiteGuardian continuously monitors technical cyber hygiene: HTTPS enforcement, HSTS, security headers, MFA, and DNS hardening. Training and awareness programmes require organisational measures beyond automated monitoring.
Cryptography and encryption
MonitoredSiteGuardian validates TLS 1.2+ enforcement, detects deprecated protocols and weak cipher suites, checks forward secrecy (PFS), monitors SSL certificate validity, and verifies HSTS preload readiness.
Access control and asset management
SiteGuardian enforces MFA (TOTP/SSO) on all accounts, provides role-based access control, and maintains an asset inventory of all monitored services. HR security policies require organisational measures.
Multi-factor authentication
MonitoredSiteGuardian requires TOTP or Google SSO for platform access, monitors MFA status across all team members, and verifies encrypted communication channels (TLS, DANE, MTA-STS) for email transport.
Start preparing today
Scan your website to see where you stand. SiteGuardian maps every finding to NIS2 articles — so you know exactly what to fix.
Free forever for 1 monitor. No credit card required.