NIS2 evidence guide for operators
Under Article 21 of Directive (EU) 2022/2555 (NIS2), essential and important entities must take appropriate and proportionate technical, operational and organizational measures; paragraph 2 lists ten of them. For essential entities, the competent authorities may carry out inspections and audits and request evidence at any time (Article 32); for important entities, they act when evidence or indications suggest a breach (Article 33). Each member state transposes the directive into its own law, which may add requirements, for example a minimum retention period for logs. This page shows for each of the ten measures what WKL Database Gateway Manager contributes to access to your databases, how you prove it and what stays with you. Text of the directive: https://eur-lex.europa.eu/eli/dir/2022/2555/oj.
The app doesn't meet any of these measures on its own. It is one building block for access to databases through the data service WKL Database Gateway; servers, network, databases, other applications and your organization belong to it as well.
The ten measures of Article 21(2) NIS2
| Point | Measure (shortened) | What the app contributes | Evidence | What stays with you |
|---|---|---|---|---|
| a | Policies on risk analysis and information system security | Protected assets, personal data and limitations are described, as are the circumstances with significant risk | Security and privacy, Circumstances with significant risk | the risk analysis of your whole deployment |
| b | Incident handling | Person sperren … (Lock person) locks all keys and ends all sessions; end single sessions; Herkunft sperren … (Block origin) refuses a suspicious network; change log and audit show who did what and when | reports Austritte und Sperren (Departures and locks) and Verwaltungsänderungen (Administration changes); area Protokoll (Log); area Anmeldungen (Sign-ins) | your incident process and the reporting of significant incidents (Article 23: early warning within 24 hours, notification within 72 hours, final report within one month) |
| c | Business continuity, backup management, disaster recovery | card Pflege (Maintenance) on the overview: back up and check the administration store | backup files in the service's folder | backup concept, restore tests, emergency access (Backup and restore, data service documentation) |
| d | Supply chain security | manufacturer information, point of contact for vulnerabilities, support period; software bills of materials when the delivery contains them | Supplier fact sheet, MANUFACTURER.md, SECURITY.md | the assessment of the supplier and your contracts |
| e | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | free fix releases; coordinated vulnerability disclosure; a new version comes only from the delivery folder that you fill | SECURITY.md; Put a new version in place | putting new versions in place promptly; keeping Access and Windows up to date |
| f | Assessing the effectiveness of the measures | work lists Ohne Regel (No rule), Ohne Zugang (No access), Ohne zweiten Faktor (Without second factor), Einrichtung offen (Setup pending), Schlüssel laufen ab (Keys expiring); reports of the state at the time of creation | reports Rechteübersicht (Rights overview) and MFA-Abdeckung (MFA coverage), created and filed regularly | review cycle, assessment of the results, actions |
| g | Basic cyber hygiene and cybersecurity training | step-by-step instructions in the administrator guide | Administrator guide | training of administrators and users |
| h | Cryptography and, where appropriate, encryption | keys only as a SHA-256 hash in the administration store; secret of the second factor encrypted; the VBA class sends keys, passwords and Windows sign-ins to another computer only over HTTPS | Security and privacy | certificate and HTTPS of the data service, master key, encryption of the databases |
| i | Human resources security, access control, asset management | rules per person and object; rights per network and sign-in method; revoking access when someone leaves; keys with expiry date and purpose per device | report Rechteübersicht; report Austritte und Sperren | joiner and leaver process; locking Windows accounts, groups and SQL logins where they are managed; permissions in the databases |
| j | Multi-factor authentication | second factor (TOTP) per person; the sign-in policy requires it, for example from outside; for the right to administer, the service always requires it | report MFA-Abdeckung with the rules that require a code and the keys without a second factor | deciding where a code is required; secured communication outside the data service |
All reports are in the area Protokoll under Weitere (More) > Nachweisberichte (Evidence reports), each as an Excel file and as a PDF with a header (creator, time in UTC, service, installation); see How to create evidence reports.
Limits of the evidence
- The change log isn't tamper-proof: anyone who may write the data service's store file on the server can change it. Therefore keep reports outside the server.
- The audit of accesses goes back as far as the data service keeps it (default 365 days). If your national law requires a longer retention, set it in the service or back up its log file.
- Rights overview and MFA coverage show only the state at the time of creation. A past state can be proven only with reports you created at the time.
- Members of Windows groups and permissions inside the databases aren't in any report.