WisecNIS2 asks for measures. Wisec shows that they work.
Can you show an auditor how you secure your software supply chain and whether your measures are effective?
Directive (EU) 2022/2555 requires essential and important entities to take risk management measures, including supply chain security and vulnerability handling. Their customers pass it on to their software suppliers.
Measures, and evidence that they are effective.
The supply chain.
Security in the relationships with suppliers, software included.
Vulnerabilities.
Security in development and maintenance, vulnerability handling and disclosure included.
Effectiveness.
Procedures to assess how effective the risk management measures are.
Notification.
Early warning within 24 hours, notification within 72 hours, final report within one month, for a significant incident.
What the directive asks, what Wisec proves.
The NIS2 report maps these measures to the evidence recorded over the period, and adds the posture figure and the signed monthly records.
| Reference | What is expected | The evidence Wisec produces |
|---|---|---|
| Article 21(2)(a) | Information system security policies. | Block or warn policies enforced by the gate, with the result of every build. |
| Article 21(2)(d) | Supply chain security. | A signed SBOM per build, SLSA provenance, detection of suspicious dependencies. |
| Article 21(2)(e) | Vulnerability handling in development and maintenance. | CVEs detected on every build, triage decisions in a signed VEX, remediation times. |
| Article 21(2)(f) | Assessing the effectiveness of measures. | The posture figure: the share fixed within your deadlines over 90 days, frozen every month in a signed record. |
| Article 23 | Notify a significant incident in time. | Timestamped, signed builds to rebuild the timeline, and a search by CVE to measure exposure. |
An evidence mapping, not a declaration of conformity. Wisec documents the part of your measures that plays out in the development chain. Governance, the entity's risk analysis, incident handling and business continuity remain yours, and the report changes the status of no other measure.
A PDF to hand over, with its scope.
Covered, partial, to address.
Computed from the share of the period's builds that carry the evidence: at least 90 %, at least 50 %, or less.
Printed on the report.
Every project by default, or those you pick. A report without a stated scope is not usable in an audit.
Your dates.
The report covers the period you choose, and states when it was produced.
Available on the Business and Pro plans. The NIS2 report is generated from the Compliance page, with the posture of the period.
Source: Directive (EU) 2022/2555 of 14 December 2022 (NIS2). Its transposition and details vary between Member States. This is not legal advice.