# NIS2

Source: https://s3msecurity.com/compliance/nis2/
Last updated: 2026-11-12

S3M supports NIS2 risk-management measures with technical controls. ConnGuard NAC enforces access policy by identity and device, EndGuard and CityGate verify sessions continuously and isolate compromised endpoints, and SAMI answers incident questions from telemetry. The table maps each measure in Article 21(2) and the Article 23 early warning to the products that support it.

**Directive (EU) 2022/2555, the NIS2 Directive.** Applies to: Essential and important entities in the sectors the directive lists, through each member state’s national law. Official text: https://eur-lex.europa.eu/eli/dir/2022/2555/oj

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| Art. 21(2)(a) | Policies on risk analysis and the security of information systems. | ConnGuard NAC turns access policy into rules enforced at every connection, by identity, device and role. | ConnGuard NAC |
| Art. 21(2)(b) | Incident handling. | EndGuard isolates a compromised endpoint during its session, and SAMI shows which device and user were involved, from telemetry. | EndGuard, SAMI |
| Art. 21(2)(f) | Policies and procedures to assess whether the risk-management measures work. | SAMI provides evidence for these reviews: answers on access and device state, each with its source. | SAMI |
| Art. 21(2)(g) | Basic cyber hygiene practices and cybersecurity training. | EndGuard checks device posture before and during each session, and ConnGuard NAC isolates devices that fail the check. Training is outside S3M. | EndGuard, ConnGuard NAC |
| Art. 21(2)(i) | Human resources security, access control policies and asset management. | ConnGuard NAC sees managed, IoT and BYOD devices and grants access by identity; CityGate does the same at telecom scale. Human resources security is outside S3M. | ConnGuard NAC, CityGate |
| Art. 21(2)(j) | Multi-factor or continuous authentication, and secured voice, video, text and emergency communications. | EndGuard and CityGate verify identity, device and session continuously while the session lasts. This row covers continuous authentication only; S3M does not provide multi-factor authentication. | EndGuard, CityGate |
| Art. 23(4)(a) | Send an early warning within 24 hours of becoming aware of a significant incident. | SAMI answers who connected, from which device and when, from stored telemetry, which helps you prepare the early warning. | SAMI |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Which NIS2 measures does S3M support?

Article 21(2) points (a), (b), (f), (g), (i) and (j), and the early warning in Article 23(4)(a), as the table shows. Supply chain, development, cryptography and backup measures need other tools.

### Does S3M provide multi-factor authentication for NIS2?

No. Article 21(2)(j) names multi-factor or continuous authentication. EndGuard and CityGate support the continuous part by verifying identity, device and session for as long as the session lasts.

### Is NIS2 the same in every EU country?

No. NIS2 is a directive, so each member state writes it into national law. Check your national act and confirm legal questions with your counsel.