Directive (EU) 2022/2555, known as NIS2, raises the level of cybersecurity required from a wide range of organisations in the European Union. Its Article 41 set 17 October 2024 as the deadline for transposition into national law. The status of that transposition in your country should be checked with the competent national authority.
The Directive does not say whether a given organisation is in scope. That depends on its sector, size and status, and should be reviewed with a lawyer.
What Article 21 asks for
Article 21 lists minimum risk management measures. They include risk analysis and information system security policies, incident handling, supply chain security, vulnerability handling, and asset management.
External attack surface touches these points directly. You cannot handle vulnerabilities on assets you do not know exist.
A simple roadmap
- Inventory. List the domains, subdomains and services exposed on the Internet, and the host of each one.
- Responsibilities. Name the person in charge of keeping this inventory up to date, and state who approves a new public service.
- Vulnerability handling. Define who receives alerts, who sets the priority, and within what timeframe fixes are made.
- Suppliers. List the providers that expose services in your name, and their commitments on security.
- Evidence. Keep the records of discovery and remediation. They show that the process exists.
What a tool can and cannot do
A discovery tool helps with steps 1 and 5. It does not decide for you, it does not make an organisation compliant on its own, and it does not replace governance or procedures.
Atlas, in development, is designed for this use. To learn more, write to us.