Trust & Compliance / NIS2
NIS2 compliance
Encryption, supply-chain security and incident evidence.
NIS2 is the EU directive that raises cybersecurity obligations for essential and important entities across many more sectors than the original NIS Directive. XQ supports its risk-management measures with object-level encryption and policy-based key management, protects data shared across your supply chain, and provides the real-time monitoring and audit logs incident reporting depends on.
Built for EU essential and important entities · CISOs and management bodies accountable under NIS2 · Suppliers to NIS2-regulated organizations
At a glance
DirectiveEU NIS2 (Directive (EU) 2022/2555)
Reporting24-hour early warning, 72-hour notification
XQ coversEncryption, access control, supply-chain data, audit
PenaltiesUp to €10M or 2% of turnover (essential entities)
Works with AWS · Azure · Google Cloud · On-premises · Microsoft 365 · SIEM tools
Meet the encryption measures
Policy-based encryption and key rotation cover NIS2’s cryptography requirements.
Secure the supply chain
Share data with suppliers while keeping precise control over who can open it.
Report incidents fast
Real-time access monitoring and forensic logs support the 24- and 72-hour deadlines.
What NIS2 requires
NIS2 replaces the 2016 NIS Directive with stricter, more harmonized obligations and a much wider scope, including public administration, healthcare and other critical sectors. Management bodies are accountable for cybersecurity, and national authorities can impose significant fines.
- Risk-management measures (Article 21), including policies on cryptography and encryption, access control and supply-chain security.
- Incident reporting (Article 23): an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
- Governance (Article 20): management bodies approve and oversee the measures.
- Penalties of up to €10 million or 2% of worldwide turnover for essential entities.
How XQ maps to NIS2
| NIS2 requirement | How XQ helps |
|---|---|
| Cryptography and encryption — Art. 21(2)(h) | End-to-end encryption at rest and in transit, policy-based key management and dynamic key rotation. |
| Access control — Art. 21(2)(i) | Zero Trust Data verifies every access request against policy, so only authorized users can decrypt information. |
| Supply-chain security — Art. 21(2)(d) | Data shared with third-party suppliers stays encrypted and governed by your policy, with granular control and revocation. |
| Incident handling and reporting — Art. 23 | Real-time insight into data access and usage, plus detailed logs and forensics to prepare the required reports. |
| Governance and accountability — Art. 20 | Centralized management of keys and policies, and compliance reports on encryption, access controls and incidents. |
Scoping NIS2 measures for a specific system or supplier?
Data classification that supports risk management
XQ’s data and metadata tagging classifies information as it is created, so protection and policy follow its sensitivity — and classified data can be shared securely with partners and authorities when cooperation requires it.
Related resources and articles
FAQ
NIS2, answered directly.
Who has to comply with NIS2?
Medium and large organizations in the sectors the directive lists — classed as essential or important entities — plus some smaller organizations designated by member states. Each member state transposes the directive into national law.
How does XQ help with NIS2’s encryption requirements?
Article 21 calls for policies on cryptography and encryption. XQ encrypts data at rest and in transit at the object level, manages keys by policy and rotates them dynamically.
Can XQ help meet the 24-hour and 72-hour reporting deadlines?
XQ gives real-time visibility into who accessed which data and when, plus forensic logs, so you can scope an incident quickly and support the early warning and notification.
How does XQ address supply-chain security?
Data you share with suppliers stays encrypted and under your policy, so you decide who can open it and can revoke access at any time.
How does XQ support NIS2 governance and management accountability?
Article 20 makes management bodies responsible for approving and overseeing cybersecurity measures. XQ manages keys and policies centrally and produces compliance reports on encryption, access controls and incidents, giving management the evidence to oversee those measures.
Get NIS2-ready at the data layer.
Talk to our team about encryption, supply-chain controls and incident evidence for NIS2.