NIS2 / ReCyF
Compliance management for the NIS2 directive and the ReCyF framework (Référentiel Cyber France, ANSSI): entity qualification, incident management, supply chain and business continuity.
Hidden by default
Restricted to "Advanced modules": it requires the right (granted by an administrator), then switching it on yourself in My Account, for the menu entry to appear.
Methodological positioning
NIS2/ReCyF is a compliance framework like any other (ISO 27001, RGS…), structured into 20 security objectives grouped into 4 pillars: Governance, Protection, Defence, Resilience. It is assessed with the same engine as the other frameworks.
No double entry
Detailed NIS2 compliance tracking happens in the Audit module, not here. The NIS2 module covers what Audit cannot do: the operational registers (incidents, suppliers, continuity) and entity qualification.
Entity qualification
Three fields determine the applicable scope: NIS2 regime (essential entity / important entity / not subject), sector of activity (Annex I or II) and registration number.
The regime determines how many objectives apply: OS16 to OS20 only apply to essential entities.
The Carry my scope into the audit grid button marks out-of-scope objectives as "not applicable" with their justification, without overwriting what has already been assessed. If you become an essential entity, the reverse button resets the relevant objectives to "to be audited".
Interaction with other modules
| Module | Contribution |
|---|---|
| Audit | Assesses compliance article by article, with evidence and an action plan |
| IEC 62443 | The NIS2 tab on the Compliance page maps the technical coverage of your zones onto the NIS2 objectives it helps meet |
| EBIOS RM | Risk scenarios — especially ecosystem and supply chain ones — inform treatment priorities |
The three operational registers
- Incident management — regulatory notification deadlines
- Supplier register — cyber compliance of critical providers
- Business continuity — BCP/DRP with RTO and RPO
Scope of the registers
These registers belong to your account (or to your group if you are part of one) — they are independent of risk analysis projects. Opening or closing a project has no effect on their content.
Exports
The NIS2 dashboard generates a Word report and an Excel export consolidating the three registers.