NIS2 — the EU's new security lawIn force now
Not just that you are watching — that you can show it, months later, to someone who asks. Quanovio checks the systems you already use, every day, and writes down what it found in language you can hand to an inspector.
The short versionFour questions
If you are a medium or large organisation in energy, transport, health, water, food, manufacturing, waste, post, chemicals, digital services, research or public administration, almost certainly yes. The law is called NIS2, it applies across all 27 EU countries, and it reached thousands of organisations that had never been regulated on security before. Many of them still do not know.
Fines reach €10 million or 2% of worldwide annual turnover, whichever is larger. Directors can be held personally responsible, and regulators can suspend a manager from their duties. In practice the first thing that happens is simpler: a customer, an insurer or a bank asks for your evidence, and you do not have any.
One report, every morning. It says what is wrong, what got fixed, and what came back after being fixed. Each line is tied to the numbered part of the law it answers, so when someone asks for proof you send the report instead of starting a project.
Fix the things it finds. We never touch your systems — we cannot, and that is deliberate. We tell you what is wrong and in what order to deal with it; your own people or your IT supplier do the work, and the next morning's report says whether it worked.
The idea the whole thing rests onTwo different jobs
Think of the fire extinguishers in your building. Having them is not enough. Someone signs a sheet every month to say they were checked, and that sheet is what an inspector asks for. Security now works the same way. The law does not only ask whether you are watching — it asks you to produce the record. Most organisations are doing far more than they can show.
One page. Below is a real example, shortened. The number on the left is the part of the law each line answers; you do not need to understand it, but the person who inspects you will.
Previously remediated on 2 September. A sharing link created in March remains active on Budget-2027.xlsx, which was restricted on 28 August. The content is retrievable by any holder of the URL without authentication.
Remediation is performed by your administrators. The next collection verifies the result.
Approximately one third of the numbered controls in CIR (EU) 2024/2690 are evidenced by telemetry. The remainder — risk methodology, supply chain assessment, cryptographic policy, training, physical security — are documentary and are reported as open, with the evidence an assessor will request. Coverage claims that exceed what a monitoring system can observe do not survive an audit.
| Ref | Control | Detections | Evidenced |
|---|---|---|---|
| 11.6 | Authentication | 293 | Yes |
| 11.2 | Management of access rights | 127 | Yes |
| 3.2 | Monitoring and logging | 119 | Yes |
| 3.4 | Event assessment and classification | 92 | Yes |
| 6.x | Vulnerability, configuration and change | 67 | Yes |
| 11.3 | Privileged and administration accounts | 30 | Partial |
| 11.5 | Identification and identity lifecycle | 21 | Yes |
| 11.7 | Multi-factor authentication | 0 | Requires an identity source |
Connectors request read scopes exclusively. A credential returned with write permission is rejected at connection time rather than retained.
Identical software, deployed in your own network or operated on your behalf within the European Union. Self-hosted deployments transmit nothing externally.
Each finding includes a remediation plan executed by your administrators. Subsequent collections record the outcome as closed, unresolved, or recurring.
Tell us what your organisation runs — five lines is enough — and we will tell you which parts of the law you could prove today and which you could not. Written, free, and no call required.