Compliance
All articles
Compliance Documentation Audit for NIS 2 Baseline Obligations: Method Overview
A Compliance Documentation Audit maps NIS 2 documents to baseline requirements, scores maturity on a 0-4 scale, verifies evidence traceability, and c…
NIS 2 Significant Incident IS-2: Integrity Loss Affecting Digital Data
IS-2 in the ACN baseline model covers integrity loss affecting digital data under entity ownership or control. Practical guide to qualification, evid…
NIS 2 baseline deadline October 2026: 8-month implementation roadmap
With the NIS 2 baseline adoption deadline set for October 2026, organizations have roughly 8 months left. This guide provides a compressed, phased ro…
NIS 2 KPIs and continuous improvement: operational metrics for resilient compliance
ACN guidance frames improvement as a continuous phase across the full incident lifecycle. This guide provides a practical KPI framework, governance r…
NIS 2 Significant Incident IS-1: Confidentiality Loss Affecting Digital Data
IS-1 in the ACN baseline model covers confidentiality loss affecting digital data under entity ownership or control. Practical guide to qualification…
Common NIS 2 compliance mistakes: practical gaps that delay baseline readiness
Most NIS 2 delays are operational: missing evidence, unclear ownership, untested notification workflows, and late governance decisions. A practical g…
NIS 2 Incident Typology Model: Condition, Compromise, and Affected Object
ACN baseline guidance classifies significant incidents through condition, compromise, and object of compromise. Practical guide to using the typology…
NIS 2 operational registers for logs, backups, and recovery: practical guide to auditable evidence
NIS 2 baseline requires operational evidence beyond policies. This guide covers how to build auditable registers for logs, backups, restore tests, an…
NIS 2 incident-notification obligations are live: operating model after the 9-month deadline
The NIS 2 9-month incident-notification deadline passed in January 2026. This guide provides the post-deadline operating model: governance confirmati…
NIS 2 incident management and CSIRT notification plan: practical guide for an approvable RS.MA-01 document
The incident management plan is mandatory under NIS 2 Appendix C (RS.MA-01). This guide covers what an approvable plan must include, a practical temp…
NIS 2 Recovery Controls (RC): Operational Resilience and Service Restoration
The NIS 2 Recovery (RC) domain defines how entities restore operations after incidents and sustain resilience. Practical guide to restoration procedu…
NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document
The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa…
NIS 2 Response Controls (RS): Containment and Eradication in Incident Handling
Containment and eradication are iterative response steps that limit damage and remove attacker persistence. Practical guide to strategy selection, ev…
NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document
The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem…
NIS 2 Response Controls (RS): Signaling and Investigation Operating Model
The NIS 2 Response (RS) domain requires structured incident response through signaling, investigation, and iterative decision loops. Practical guide …
NIS 2 business continuity plan: practical guide to build an approvable ID.IM-04 document
The business continuity plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must include, a practical temp…
EU Cybersecurity Act Revision - COM(2026) 11: What Changes and Why It Matters
The European Commission's January 2026 proposal to revise the EU Cybersecurity Act: supply-chain risk governance, simplified certification (ECCF), EN…
NIS 2 vulnerability management plan: practical guide for ID.RA-08 approval
The vulnerability management plan is mandatory under NIS 2 Appendix C (ID.RA-08). This guide covers what an approvable plan must show, a practical st…
NIS 2 Detection Controls (DE): Event Monitoring and Adversarial Signal Handling
The NIS 2 Detection (DE) domain requires monitoring networks, services, and endpoints to identify adverse events early. Practical guide to log readin…
NIS 2 training and cyber-competency register: practical guide to auditable workforce evidence
NIS 2 baseline requires operational evidence of training execution and competency development. This guide covers what a training register must contai…