NIS2 Checklist: How Sonatype Helps You
The Network and Information Security Directive 2 (NIS2) is the EU's most comprehensive cybersecurity legislation. Our comprehensive checklist outlines the key elements in Articles 21 and 23 of the NIS2 Directive that relate to protecting software components.
Security Directive 2 (NIS2) is the EU’s most comprehensive cybersecurity legislation, and taking steps to make sure your organisation is compliant should be a top priority. But that doesn’t mean it needs to be complex.
We’ve outlined the key elements, Articles 21 and 23, that relate to protecting software components and how Sonatype can help you manage these obligations.
Cybersecurity risk-management measures
NIS2 Measures |
Why it Matters |
Sonatype Platform |
---|---|---|
21-2(a) policies on risk analysis and information system security; |
|
Sonatype Lifecycle | Sonatype Intelligence
|
21-2(b) incident handling; |
|
Sonatype Nexus Repository
|
21-2(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; |
|
Sonatype SBOM Manager | Sonatype Lifecycle
|
21-2(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
|
Sonatype Lifecycle and Sonatype SBOM Manager
|
21-2(g) basic cyber hygiene practices and cybersecurity training; |
|
Sonatype Repository Firewall | Sonatype Nexus Repository
|
21-2(i) human resources security, access control policies and asset management |
|
Sonatype Lifecycle | Sonatype Nexus Repository
|
21-2(j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate |
|
Sonatype Platform
|
NIS2 Measures
21-2(a) policies on risk analysis and information system security; |
21-2(b) incident handling; |
21-2(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; |
21-2(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
21-2(g) basic cyber hygiene practices and cybersecurity training; |
21-2(i) human resources security, access control policies and asset management |
21-2(j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate |
Why it Matters
|
|
|
|
|
|
|
Sonatype Platform
Sonatype Lifecycle | Sonatype Intelligence
|
Sonatype Nexus Repository
|
Sonatype SBOM Manager | Sonatype Lifecycle
|
Sonatype Lifecycle and Sonatype SBOM Manager
|
Sonatype Repository Firewall | Sonatype Nexus Repository
|
Sonatype Lifecycle | Sonatype Nexus Repository
|
Sonatype Platform
|
NIS2 Reporting Obligations
In Article 23, NIS2 details Reporting Obligations that all member states must adhere to, including filing a final report not later than one month after the submission of the incident notification under point (b), including:
Final Report Obligations |
Sonatype Platform |
---|---|
A detailed description of the incident, including its severity and impact; |
|
The type of threat or root cause that is likely to have triggered the incident; |
|
Applied and ongoing mitigation measures; |
|
Where applicable, the cross-border impact of the incident; |
|
Final Report Obligations
A detailed description of the incident, including its severity and impact; |
The type of threat or root cause that is likely to have triggered the incident; |
Applied and ongoing mitigation measures; |
Where applicable, the cross-border impact of the incident; |
Sonatype Platform
|
|
|
|
Optimise and Protect Your Software Supply Chain
Sonatype has been at the forefront of software supply chain management, including empowering developers and organisations to protect the integrity of their software components through automated cybersecurity hygiene practices like vulnerability scanning, dependency analysis, and policy enforcement. For a detailed look at how Sonatype can help meet NIS2 requirements, download our User’s Guide to NIS2 Compliance.
![img-EU_deep_dive img-EU_deep_dive](https://www.sonatype.com/hubfs/img-EU_deep_dive.jpg)
How Sonatype’s Platform helps you comply
Simplify SBOM Compliance and Security Monitoring with Sonatype SBOM Manager
More than 70 percent of Fortune 100 companies manage their software supply chains with Sonatype, and our SBOM Manager has been developed to take the uncertainty out of SBOM collection and monitoring compliance.
Talk to an expertRelated Resources
![Summer of Software-04](https://www.sonatype.com/hubfs/Summer%20of%20Software-04.png)
![](https://www.sonatype.com/hubfs/Artboard%201@2x-2.png)
![cover-DORA-checklist](https://www.sonatype.com/hubfs/1-2023%20New%20Site%20Assets/Cheat%20Sheets/cover-DORA-checklist.jpg)