Frameworks · European Union
NIS2 Art. 21 asks for supply-chain security and security in development and maintenance; Art. 23 sets reporting times. Aspian Cloud governs suppliers and changes, and keeps the incident timeline ready.
- Instrument
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)
- In force
- Transposition deadline 17 October 2024; national measures apply from 18 October 2024 (Art. 41). Applies through each Member State's national law
- For
- Essential and important entities under your Member State’s NIS2 law, and their suppliers.
| Clause | What it requires | Evidenced by |
|---|---|---|
| Art. 21(2)(d) | Cyber risk measures must cover supply chain security, including the security of relationships with direct suppliers and service providers.Source: eur-lex.europa.eu | Supplier engagements: scoped, expiring identities that can propose but never approve, and verified offboarding. |
| Art. 21(2)(e) | Security must be built into acquiring, developing and maintaining network and information systems, including vulnerability handling and disclosure.Source: eur-lex.europa.eu | One rulebook applied from the first commit to staff, suppliers and AI agents, and CI changes that always need a named person. |
| Art. 23(4)(a), (b), (d) | For significant incidents, give an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification.Source: eur-lex.europa.eu | Incident records linked to changes, with the timeline your 24-hour, 72-hour and one-month reports need. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.