Directive (EU) 2022/2555 — cybersecurity

Nasıl doğrulanır

• A management-approved risk analysis and information-security policy exists and has been reviewed within a defined interval

  Article 21(2)(a) states the duty but not a review cadence or threshold — the specific interval here is a draft placeholder pending compliance-expert definition, not something the primary text specifies.

Nasıl doğrulanır

• Incidents are logged with detection/assessment/response timestamps, and NIS2 Art 23 reporting deadlines are met for qualifying incidents

  Art 23's clock (24h early warning / 72h notification / 1 month final report) is the concrete, quotable threshold here — see the Incident Notification Commitments section. The incident register itself is §3.15, Phase 3 scope.

Nasıl doğrulanır

• A documented business continuity and disaster recovery plan exists, backups run on a defined schedule, and restores have been tested

  Restore-test cadence and RTO/RPO thresholds aren't specified in the primary text — draft placeholder pending compliance-expert input. Backup APIs can automate the schedule/completion evidence; the restore test itself stays a human process (§3.1).

Nasıl doğrulanır

• A current supplier/vendor register exists with a security assessment on file for each direct supplier and service provider

  Art 21(3) also requires considering the coordinated supply-chain risk assessments under Article 22(1) — not yet modelled; the Vendor module (§3.14, Phase 3) is where this becomes automatable.

Nasıl doğrulanır

• A vulnerability handling and disclosure process exists, with vulnerabilities tracked from discovery to remediation

  Scanner/patch-state automation (README: scanner APIs, GitHub/GitLab, patch state) is the intended evidence source — specific remediation SLAs are a draft placeholder pending expert input.

Nasıl doğrulanır

• A documented cryptography/encryption policy exists and encryption is enforced for data classified as requiring it

  Which data classes require encryption depends on the entity's own asset classification (the Asset model is Phase 3 scope) — draft placeholder pending that and expert input.

Nasıl doğrulanır

• An access control policy exists, staff access is provisioned/deprovisioned against HR records, and an asset inventory is maintained

  Deprovisioning-latency threshold and inventory completeness criteria are draft placeholders pending expert input.

Nasıl doğrulanır

• >= 95% of active users MFA-enabled AND 0 unprotected admin accounts

  Single band only — NIS2 Art 21(1) proportionality (micro/small/medium bands) not yet split out, pending compliance expert input. Also see Implementing Reg §11.7.2: authentication strength should scale with asset classification, which this threshold alone doesn't express (Asset model is Phase 3).