NIS2 Directive Compliance
NIS2 Article 21 requires identity and access controls. We assess your Linux estate.
Non-compliance penalties reach €10M or 2% of global turnover. Our pilot maps every privilege path across your Linux servers and delivers compliance evidence before your next regulatory review.
Linux Is Different
Compliance Frameworks Demand Identity Controls Your Tools Cannot Provide
NIS2, DORA, SOC 2, and ISO 27001 all require evidence of identity governance and access control. For Linux, that evidence lives in sudo rules, SSH keys, and service accounts -- not in your cloud IAM console.
- Compliance platforms generate questionnaires but cannot verify actual Linux identity posture
- Cloud IAM audits prove who can access AWS or Azure -- not who has root on your Linux servers
- Framework-specific gap analyses identify requirements but do not map them to Linux-level controls
- LinuxGuard delivers compliance evidence mapped directly to framework controls from your actual Linux configuration
Why NIS2 Makes Linux Identity Visible
- NIS2 Article 21(2)(i) explicitly mandates identity and access management controls as a required cybersecurity measure for essential and important entities — Linux servers are the primary surface where these controls fail.
- Orphaned accounts from former employees with active sudo configurations represent a direct compliance gap under NIS2 access management requirements, creating liability for both the organization and board members personally.
- Privilege drift through undocumented sudo rules accumulates silently over time, leaving organizations unable to demonstrate the continuous control required by NIS2 Article 21(2)(a) risk analysis obligations.
- NIS2 Article 20 introduces personal liability for board members who fail to implement adequate cybersecurity measures — unmanaged Linux privilege is a documented, reportable control failure.
- NIS2 has been enforceable since October 2024 with no transition period. Member state supervisory authorities are actively conducting compliance assessments, making immediate evidence of control effectiveness essential.
How Our Pilot Addresses NIS2 Directive Requirements
Every pilot finding is mapped to specific NIS2 Directive controls, providing direct compliance evidence for your regulatory submissions.
Scroll horizontally to see all columns →
| Article / Requirement | What It Mandates | How the Pilot Covers It |
|---|---|---|
| Article 21(2)(i) | Identity and access management | Full inventory of users, groups, sudo rules, SSH keys, and service accounts with privilege path mapping |
| Article 21(2)(a) | Risk analysis and information system security policies | Risk-scored findings mapped to exploit patterns, prioritized by likelihood and impact on essential services |
| Article 21(2)(e) | Supply chain security | Third-party and service account privilege assessment identifying vendor accounts with excessive access |
| Article 21(2)(j) | Multi-factor authentication and continuous access solutions | Assessment of authentication controls on privileged accounts including sudo and SSH key management gaps |
What You Get
- Identity & Privilege Inventory — Every user, group, sudo rule, SSH key, and service account across your Linux estate, showing who can do what
- Risk-Scored Findings Report — Prioritized findings based on real exploit patterns, highlighting the privilege paths attackers would use first
- Compliance Evidence Package — Identity governance gaps mapped to NIS2 Article 21 controls with remediation guidance
- Prioritized Remediation Plan — Phased plan to reduce privilege drift and move toward least-privilege, with a zero trust alignment overlay where applicable
- Board-Ready Executive Summary — Executive summary for boards and a technical deep-dive for your security team
How It Works
1
Discovery & Scoping
Align scope, identify in-scope systems, and establish secure data access. Stakeholder interviews set priorities and compliance requirements.
2
Identity & Privilege Mapping
Deploy lightweight, read-only collectors to gather Linux identity and privilege data across your estate. Users, groups, sudo rules, SSH keys, PAM configurations, and service accounts.
3
Security & Compliance Assessment
Build privilege paths, identify drift patterns, and map identity governance gaps to compliance framework controls (NIS2, DORA, CIS, NIST, SOC 2, PCI DSS). Score risks based on real exploit patterns.
4
Reporting & Remediation
Deliver the identity and privilege map, risk report, compliance gap analysis, and least-privilege roadmap. Two readouts: executive summary and technical deep-dive.
Frequently Asked Questions
Does NIS2 apply to our Linux servers specifically?
Yes. NIS2 Article 21(2)(i) mandates identity and access management controls as a baseline cybersecurity measure. Linux servers running essential services — payment infrastructure, core banking, healthcare systems, energy management — are explicitly within scope. The directive does not distinguish by operating system; it requires demonstrable control over all systems supporting essential services.
What does Article 21 require for identity and access management?
Article 21(2)(i) requires entities to implement and maintain appropriate measures for identity and access management. This means being able to demonstrate who has access to which systems, what privileges they hold, and that access is granted on a least-privilege basis with regular review. On Linux estates, this includes sudo rules, SSH key management, service account governance, and group membership oversight.
How does LinuxGuard produce NIS2 compliance evidence?
The pilot delivers a structured compliance evidence pack mapped directly to NIS2 Article 21 controls. For each control, we document the current state of your Linux identity infrastructure, identify gaps against the NIS2 requirements, and provide remediation guidance with a prioritized action plan. The evidence pack is formatted for submission to your national supervisory authority and for internal board reporting.
What are the non-compliance penalties under NIS2?
For essential entities, NIS2 penalties reach €10M or 2% of global annual turnover, whichever is higher. For important entities, the ceiling is €7M or 1.4% of global turnover. Critically, Article 20 introduces personal liability for board members and senior executives who fail to implement adequate cybersecurity measures, including direct fines and potential bans from management roles.
How long does the NIS2 pilot take?
The pilot is a fixed-scope engagement covering scoping and data collection, analysis that maps findings to NIS2 controls, and delivery of the compliance evidence pack, executive summary, and remediation roadmap with a readout session for your team. See the Fixed Fee Pilot page for the full timeline.