In manufacturing companies that supply larger groups, the first document about information security rarely comes from a regulator. It comes from a customer’s purchasing department, in the form of a questionnaire. Two weeks to answer, around twenty questions on backup, authentication and incident handling. At that point NIS2 compliance stops being a line in the three-year plan and becomes a condition for staying on the supplier list.
It asks whether multi-factor authentication is active and how long logs are retained. It asks whether an incident response procedure exists and who signs it. An answer counts only where the matching evidence can be shown. A first reading in the meeting room usually produces the same picture. Management discovers that company security was built to work. Documenting it takes further effort, and nobody had budgeted for that.
Scope depends on the activity code, not on turnover
The European directive 2022/2555 identifies regulated entities by sector of activity, by size and by role in the supply chain. The activity code weighs more than turnover.
Size enters as a second criterion, after sector: the directive treats large companies as essential entities and medium-sized ones as important entities, using the European thresholds for headcount and turnover. That is why companies convinced they were outside the scope find themselves inside it. A manufacturer of industrial machinery with a few dozen employees qualifies because of its product category. A much larger services firm may fall outside. In one project followed by Aesir the technical lead was certain of exclusion. The formal check said otherwise, and with the confirmation came the need to build the procedural layer from scratch.
Even firms outside the scope are rarely left alone. Regulated companies answer for the security of their own supply chain, and that responsibility travels downstream as a contractual requirement. NIS2 compliance therefore lands on the commercial table, not only on the legal one. Companies that address it early make it count with automotive customers, defence customers and public-sector buyers.
Ninety-eight questions measure the distance to NIS2 compliance
A structured self-assessment is the first instrument of the journey: a ninety-eight question survey that translates the requirements of the directive into specific checks on the existing infrastructure.
In a manufacturing group with around fifty users and an in-house data centre, that survey produced a precise picture. Firewall and anti-spam filtering had been in place for years. Endpoints carried up-to-date protection. Then the list of gaps began. No multi-factor authentication, not even on remote network access. Servers still behind on updates, while workstations were aligned. Network segmentation and log centralisation were both missing. Four full backups with one month of retention, described as disaster recovery yet without any analysis of restore times.
Asked how many hours of downtime the company could absorb, the data centre manager answered plainly: there is no analysis, there is nothing here at all. Production halts and the damage is real, but nobody had ever attached a number to it.
What goes into the technical plan
A plan born from this kind of assessment is built from recurring elements, which return project after project with different weights. Each item below matches a specific question in the questionnaire: reading them shows how many lines currently have no answer, before any budget discussion starts.
- Multi-factor authentication, starting from remote access and administrative accounts.
- Centralised patch management on servers and workstations, with an agreed plan and regular reporting.
- Email protection with domain validation through SPF, DKIM and DMARC.
- Recurring vulnerability assessment, weekly or monthly depending on exposure.
- Centralised log collection and retention, for at least six months.
- Network segmentation into separate areas for users, guests and servers.
- Backup following the 3-2-1 rule, with an actual restore test every month.
- Incident register, declared point of contact and named deputy.
- Role matrix and a documented procedure on technical and organisational measures.
In the case described, bringing the technical layer into service was estimated at around fifteen working days, spread across successive phases. Everything starts with monitoring agents on every workstation, because without centralised collection none of the later items can be verified. Almost all these measures sit inside a managed security perimeter. That changes where NIS2 compliance appears in the accounts: no longer a one-off project but a recurring service, with reporting attached.
ISO 27001 and the directive overlap widely, yet they do not coincide
ISO 27001 is a voluntary standard for managing information security. The directive is a European legal obligation, and a company holding the certification already covers a substantial share of it.
Jacopo del Campo, CTO at Aesir, puts it plainly: a certified management system covers between half and seventy per cent of the directive’s requirements. Specific obligations remain outside. Notification of incidents to the competent authority, the declared point of contact, the explicit accountability of management bodies.
The reverse path is far less effective. One manufacturing group had produced its treatment plan, role matrix and incident register on its own. Asked whether those documents could be reused for a future certification, the answer was no: they had been written for the directive and nothing else. Documentation written for a single goal has to be rewritten from scratch when the second goal arrives.
When the IT supplier becomes the weak link
In regulated supply chains a customer’s audit reaches through to whoever runs the infrastructure. A supplier without declared standards is an objection that surfaces during an audit.
An Italian software house with international customers described the situation without softening it. If a customer asks what exactly we do, we are left holding the pieces. The company was certified and its application ran inside a cloud operated by a certified provider. Supporting infrastructure, on the other hand, sat with an operator holding no declared standard at all. Eighty workstations, fourteen virtual machines, five offices, a single domain controller without redundancy.
The inventory surfaced more. Inbound email filtering existed, outbound filtering did not. Two different backup tools coexisted without anyone deciding which one was authoritative. Firewall changes were applied without leaving a record of the previous configuration. The internal lead called it the most serious gap of all.
Insight: in smaller firms the weakest security link is almost always contractual, and it gets chosen the day the IT supplier contract is signed. Whoever holds the credentials holds part of the risk, and that part never appears on a technical diagram.
Aesir Srl operates under ISO 9001 and ISO 27001 certification and has aligned voluntarily with the requirements of the directive, despite falling outside its direct scope. Managed services and security services stay within the same contractual perimeter. A company inside a regulated chain can therefore hand its own client a single line of accountability instead of two. Document protection follows the same logic, as described in our piece on corporate document protection.
The NIS2 compliance evidence needed on audit day
An audit closes on the evidence a company manages to produce. The critical point, then, is how quickly that evidence can be retrieved.
| Requirement | Evidence requested | Where it usually sits |
|---|---|---|
| Access control | List of accounts with a second factor enabled, plus password policy | Tenant identity console |
| Vulnerability management | Periodic reports and a record of the fixes applied | Managed monitoring platform |
| Business continuity | Restore test results, not backup results alone | Archived test reports |
| Incident handling | Event register with date, classification and action taken | Corporate document system |
| Supply chain security | Supplier certifications and contractual clauses | Service agreements |
The third column is the neglected one. Many companies hold the evidence but keep it scattered across mailboxes, shared folders and separate supplier portals. Gathering it during an audit costs more than producing it. A well-planned NIS2 compliance path therefore starts by deciding where proof will be stored, rather than which tool to buy first. Restore evidence in particular belongs with the rest of the backup and disaster recovery documentation.
How NIS2 compliance work spreads across the months
The path consists of an initial scoping meeting followed by recurring appointments. Their frequency depends on how complex the organisation is.
The opening meeting settles three points: which systems fall inside, which requirements are already covered and who acts as the single point of contact. In the projects Aesir follows, the reference figure remains the centre of the whole path. Engineers work on tickets, patches and monitoring without going through management each time.
A typical calendar for a company with around fifty users runs like this. The first fortnight closes the assessment and installs the monitoring agents. Weeks three to six bring multi-factor authentication, patch management and email protection. From week seven come segmentation, log centralisation and a first documented restore test. Documentation runs in parallel and closes later, because it depends on decisions that belong to the board.
Remote work and on-site visits then alternate. Technical interviews happen with whoever administers the systems, priority decisions with whoever answers for the budget. A board treating the directive as an IT matter slows the path down. Accountability assigned by the law to management bodies cannot be delegated. The pattern mirrors what happened with data protection law: at first NIS2 compliance is treated as a cost, and later as a credential to show customers.
Five checks before answering a customer questionnaire
- Establish whether the company falls inside the scope by sector and size, recording the outcome in writing.
- List privileged accounts and check how many carry a second authentication factor.
- Verify how long logs are retained and whether they are readable from one place.
- Retrieve the latest restore test report; if none exists, schedule one before answering.
- Ask IT suppliers which certifications they can show, and with what expiry date.
NIS2 compliance questions that return at every first meeting
How long does NIS2 compliance take from a standing start?
Results depend above all on the starting point. In a company with around fifty users the technical layer reaches service in roughly fifteen working days, spread over several weeks. Documentation continues beyond that, because it requires organisational decisions rather than configuration.
Is round-the-clock monitoring necessary?
Continuous monitoring covers the window where attacks concentrate, meaning nights and weekends. In companies without evening technical cover it is the first item to evaluate, alongside centralised patch management.
Does ISO 27001 certification remove the obligations of the directive?
No, although it reduces the remaining work considerably. Incident notification, the point of contact and the formal accountability of management bodies still need covering. Certification does not address them in the same terms.
What happens when a customer asks for evidence the company does not hold?
Declaring the plan beats declaring nothing: which measures are under way, on what timetable and who answers for them. A dated plan is verifiable information, and supply chains accept it more often than people expect.
Let’s talk
NIS2 compliance is best approached in the order it will be audited: first the measures that leave a readable trace, then those requiring organisational decisions. A company that knows where its logs live and which certifications its suppliers hold answers a questionnaire in half a day. The others find out under deadline.
If you would like to explore the subject or assess the situation in your own company, you can fill in the form at the bottom of this page or write to support@aesir-tech.it: we will arrange a free consultation and start from your numbers.