NIS2 software for implementing the NIS2 requirements.
SecTepe.Core helps you with NIS2, from checking whether it applies to proving what you did. The duties of Art. 20, 21 and 23 run as tasks with a status. When you must report an incident, a deadline clock runs. All evidence lives in one platform that runs only in the EU.
What NIS2 requires from organisations
Directive (EU) 2022/2555 applies to essential and important entities. They must take steps to manage cyber risks (Art. 21). They must report serious incidents (Art. 23). Their management signs off on these steps and checks that they happen (Art. 20).
In Germany, the NIS2 Implementation Act (NIS2UmsuCG) turns the directive into law. At its core is the revised BSI Act (BSIG). It also sets out how affected entities register with the BSI. OurNIS2 Directive overview explains who is affected, which deadlines apply and what fines you may face. TheNIS2 fine calculator gives a rough estimate for your company.
NIS2 requirements as manageable obligations
No more lists in a spreadsheet. You track each NIS2 duty as a task with an owner and a status.
- When you set up the framework, Core creates the NIS2 duties for you. These are the ten measures of Art. 21(2), the reporting duty of Art. 23 and the duties of management under Art. 20.
- A NIS2 roadmap lists the measures. It also has a checklist of the steps to register with the BSI.
- The NIS2 assessment uses questionnaires that adapt to your answers. It rates your maturity and shows the gaps.
- You manage tasks from assessments, audits and risks in one place.
See multi-framework assessmentsto learn how assessments, gap checks and roadmaps work across many frameworks.
Art. 23 reporting obligations with a deadline clock
When you mark an incident as one you must report, SecTepe.Core starts a deadline clock. It shows three dates. The early warning is due 24 hours after you learn of it. The notification is due after 72 hours. Then comes the final report.
Art. 23 wants the final report one month after the notification at the latest. The clock counts from the moment you mark the notification as sent. When a deadline is close or has passed, the people in charge get a message.
For each stage, the AI drafts the report. You check and edit it. Then you mark it as sent. TheAI automation page explains how AI works in SecTepe.Core. You send the report through the BSI portal yourself, outside SecTepe.
Risk management, supply chain and training in one platform
The Art. 21 measures need tools. SecTepe.Core comes with these modules.
Risk assessment
Risk matrix, risk register and treatment plans.
Incident response
Record incidents, respond with set playbooks and review what happened.
Business continuity
Work out what an outage would cost (business impact analysis) and plan for scenarios.
Supplier management
Manage suppliers and rate the risks that third parties bring.
Vulnerability management
Rank flaws by CVSS, the common score for weak spots, and track each fix.
Security awareness
Training and phishing simulations for your staff.
Suppliers can also submit questionnaires and evidence themselves through thesupplier & vendor portal.
Evidence for management and supervisors
Dashboards and reports for management show how far you are. You get them as PDF, Excel or Word. That helps management sign off on the Art. 20 measures and check that they happen. You also create and manage reports for the authorities in the same platform.
Many NIS2 rules overlap with ISO/IEC 27001. When they overlap, you meet them once. They then count for both frameworks. Learn more on theISO 27001 software page.
Support with NIS2 implementation
Would you like help along the way? Our NIS2 consultants check whether NIS2 applies to you. They run the gap analysis and put the measures in place with you.
NIS2 consultingCheck first whether you are affected
The free NIS2 quick test gives you a first answer on whether NIS2 applies. Then you know if you need to act, and how soon.
Start the NIS2 quick testFAQ on NIS2 software
- What is NIS2 software?
- NIS2 software helps you meet the duties of the NIS2 Directive and prove that you did. These are the risk measures under Art. 21, reporting under Art. 23 and the duties of management under Art. 20. SecTepe.Core tracks each duty with a status. It links them to risks, incidents, suppliers and evidence. A deadline clock runs with each report.
- Which NIS2 requirements does SecTepe.Core cover?
- SecTepe.Core sets up and tracks these as duties: the ten minimum measures of Art. 21(2), the reporting duties of Art. 23 and the duties of management under Art. 20. You put technical measures, such as sign-in with a second factor or encryption, in place in your own IT. SecTepe.Core records the status and collects the evidence.
- Does SecTepe.Core submit reports directly to the BSI?
- No. SecTepe.Core works out the deadlines and reminds the people in charge. It drafts the early warning, the notification and the final report. You send the report through the BSI portal yourself, outside SecTepe. Then you mark the stage as submitted.
- Who is affected by NIS2?
- As a rule, mid-sized and large companies in the sectors listed in Annexes I and II of the directive. Examples are energy, transport, health, digital infrastructure, food and manufacturing. Some entities are covered no matter their size. The free NIS2 quick test gives you a first answer. Our NIS2 overview explains sectors, thresholds and duties in detail.
- Does SecTepe offer support with NIS2 implementation?
- Yes. Whether you need a demo, advice or a quote, contact our compliance team through the contact form.
- How much does the NIS2 software cost?
- Every organisation gets the full feature set. The price depends only on the size of your organisation. There is no per-user pricing and no surcharge per standard. You will find the plans under Pricing & plans, and you can try SecTepe.Core free for 30 days.
Note: The facts on the NIS2 Directive are a guide only. They are not legal advice. What counts is Directive (EU) 2022/2555 and the law your country uses to put it in place.
Implement NIS2 with clear obligations, deadlines and evidence.
See in a demo how SecTepe.Core brings NIS2 duties, report deadlines and evidence together. Or first check for free whether NIS2 applies to you.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.