NIS2 compliance software

Software helps with NIS2 when it turns obligations into tasks, evidence and deadlines that have an owner: risk and asset management, an incident register with the Article 23 clocks (24 hours, 72 hours and one month), supplier control and device evidence. No tool replaces management's decisions or guarantees compliance.

Which tools help with NIS2 compliance

Directive (EU) 2022/2555 does not ask you to buy a product. It requires essential and important entities to take technical, operational and organisational measures proportionate to the risk. Article 21 lists at least ten areas: risk analysis and information system security policies, incident handling, business continuity and backups, supply chain security, security in acquisition and maintenance (including vulnerability handling), assessing the effectiveness of the measures, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication [1]. Management bodies must also approve and oversee those measures [1].

Each area has its own software category:

A single platform rarely covers everything. The usual pattern is a mix of specialised tools plus a layer that gathers evidence and deadlines in one place.

Which software supports NIS2 incident management

Article 23 sets a reporting flow for significant incidents: an early warning without undue delay and in any event within 24 hours of becoming aware, an incident notification within 72 hours with an initial assessment, an intermediate report if the CSIRT or authority asks for it, and a final report no later than one month after the notification [1]. If the incident is still ongoing, a progress report is submitted and the final report follows within one month of handling it [1].

Software that supports this flow should:

• record the incident once and keep the moment you became aware of it, because the clocks run from there;
• help classify whether it is significant, with criteria you confirm;
• show each deadline as pending, overdue or met;
• generate drafts of the early warning and notifications from the incident data;
• keep an audit trail of who changed what and when, and attach evidence and the root cause.

What software cannot do is decide for you whether an incident is significant or file the notification: that belongs to your organisation, through the channel set by the competent authority or CSIRT. If you are a digital infrastructure provider (DNS, cloud, data centres, managed service providers and others), Implementing Regulation (EU) 2024/2690 also sets the significant-incident criteria and the technical measures [2].

Which software manages NIS2 compliance in Spain

First the legal status, because it shapes what can be required today. The Directive's transposition deadline was 17 October 2024. Spain's Council of Ministers gave first-reading approval to the draft Cybersecurity Coordination and Governance Act on 14 January 2025 [3], and on 8 July 2026 the European Commission referred Spain to the Court of Justice of the EU for not notifying full transposition [4]. As of 3 November 2026 the act is still a draft: no cybersecurity bill appears in the official list of government bills of the current legislature in the Congress of Deputies [5], the Cortes have been dissolved since 6 October 2026 (Royal Decree 806/2026 of 5 October) [6], and it is not recorded as published in the BOE (Spain's official gazette). The network and information security rule found in the BOE remains Royal Decree-law 12/2018 [7]. Check the BOE and the Congress initiatives portal before setting internal deadlines.

Two practical consequences:

• There is no "certified" NIS2 software for Spain. Be wary of anyone who promises one. What you can ask is that the tool works in Spanish, supports the frameworks that already apply to you (for example the ENS in the public sector and its suppliers) and can adapt to the formats and channels the law sets once it is published.
• Preparing now is not jumping the gun. The Article 21 measures and the Article 23 flow are the reference content, and they are also what a customer or an auditor will ask you about. Our NIS2 compliance guide gives the background.

Which software helps maintain compliance over time

NIS2 compliance is a state you have to sustain, not a project that closes. What degrades over time is evidence: it expires, changes owner or stops reflecting reality. Look for software that lets you:

1. Keep evidence with an owner, a validity date and a status, and stop counting it once it expires.
2. Schedule periodic reviews of policies, risks and suppliers.
3. Collect data automatically where possible (inventory, encryption, versions) so you do not depend on manual screenshots.
4. Give management a dashboard, because Article 20 makes the management body responsible for overseeing the measures [1].
5. Keep history: show how you stood six months ago, not only today.

In June 2025 ENISA published technical implementation guidance that pairs each requirement with examples of evidence. Note that it was written for Implementing Regulation 2024/2690, and its examples are non-exhaustive and do not by themselves define what compliance is [8]. It is useful as a reference for what is usually asked.

How to achieve NIS2 compliance with software

1. Determine whether it applies to you, and as what (essential or important entity), with legal advice. No software decides this for you.
2. Inventory assets, processes and critical suppliers. Without an inventory there is no measurable risk.
3. Run a gap analysis against the ten Article 21 areas and prioritise.
4. Pick the fewest tools that close the gaps, and check how they export evidence.
5. Rehearse the incident flow with an exercise: who declares "awareness", who classifies, who files?
6. Set a review cycle and take it to management.

If you need support, our GRC consulting and the NIS2 compliance solution cover the gaps and the plan; supply chain risk management deals with Article 21(2)(d).

What NIS2 compliance evidence can I get from an MDM

An MDM (mobile device and endpoint management) is a useful source because it produces objective, repeatable data about managed devices. For example, Microsoft Intune evaluates rules such as a minimum operating system version, a device that is not jailbroken or rooted, or a maximum threat level, and offers actions for non-compliance such as marking the device non-compliant, locking it remotely or retiring it; if a device fails to report within the validity period it is treated as non-compliant [9]. With that kind of data you can support:

• Asset management and access control (21(2)(i)): inventory of enrolled devices and their owner.
• Cryptography (21(2)(h)): disk or device encryption status.
• Basic hygiene and maintenance (21(2)(e) and (g)): operating system version and patch level against the required minimum.
• Authentication and access (21(2)(j)): PIN or password requirements and use of compliance status in conditional access.
• Response (21(2)(b)): lock or retire actions for a compromised device.

The limits matter to an auditor: an MDM covers managed devices only (not servers, industrial environments or unenrolled equipment), reflects the state at the last check-in, and does not by itself prove that the policy is the right one. Keep the evidence with a date, a scope and an owner.

Where HodeiShield fits

HodeiShield is our compliance and risk platform. This is what its NIS2 use case documents, nothing more:

• Incidents: it records the incident once, classifies it and calculates the deadlines; you download drafts, but you send the notification to the CSIRT or authority yourself, and there are no automatic warnings before a deadline expires (see incident management).
• Evidence: held with an owner, validity and status; expired evidence stops counting. It scores the ten Article 21 measures from the evidence you upload.
• Endpoints: its own agent for Windows, macOS and Linux runs 172 checks and sends signed observations; a device that stops reporting for more than seven days (the default freshness) no longer counts as compliant. An integration with MDM products is not documented (see endpoint security).
• Suppliers and management: third-party risk management, an executive dashboard and PDF reports.

Its declared limits: it does not determine whether you are an essential or important entity, does not implement the measures, does not notify for you and is not real time. The score guides your work; it does not guarantee compliance.

Our point of view

We think the right tool is the one that lets you show, with a date and an owner, what you do, and that does not promise to comply for you. If you work on a plant floor, also read NIS2 in the industrial sector and OT.

Frequently asked questions

Is there software that guarantees NIS2 compliance?

No. NIS2 requires measures and management accountability; software helps organise, measure and document them, but the decision and the responsibility stay with the organisation.

Can software file the incident notification for me?

It depends on the tool and on the channel each authority sets. The usual and prudent pattern is that the software calculates deadlines and prepares drafts, and a person reviews and files the notification.

What are the NIS2 reporting deadlines?

An early warning within 24 hours, an incident notification within 72 hours, an intermediate report if requested, and a final report no later than one month after the notification [1].

Has Spain transposed NIS2?

As of 3 November 2026, no: the act is still a draft. The Government gave it first-reading approval in January 2025 [3], it is not a bill in the Congress of Deputies [5], the Cortes have been dissolved since 6 October 2026 (Royal Decree 806/2026 of 5 October) [6], and the Commission referred Spain to the Court of Justice in July 2026 [4]. Check the BOE before you decide.

Is an MDM enough to prove compliance?

No. It provides evidence for managed devices (inventory, encryption, versions, compliance status), but NIS2 also covers governance, risk, suppliers, incidents and continuity.

Next step

Want a NIS2 gap assessment and a view on which tools you really need? Tell us about your case or discover HodeiShield.

Sources

1. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). EUR-Lex (Official Journal of the EU), 2022-12-14. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
2. Commission Implementing Regulation (EU) 2024/2690 on technical and methodological requirements of cybersecurity risk-management measures. EUR-Lex (Official Journal of the EU), 2024-10-17. https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj
3. El Gobierno presenta la futura Ley de Coordinación y Gobernanza de la Ciberseguridad. La Moncloa, Consejo de Ministros, 2025-01-14. https://www.lamoncloa.gob.es/consejodeministros/resumenes/Paginas/2025/140125-rueda-de-prensa-ministos.aspx
4. Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity. European Commission, 2026-07-08. https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules
5. Proyectos de ley de la legislatura actual (datos abiertos, descarga del 3 de noviembre de 2026). Congreso de los Diputados, 2026-11-03. https://www.congreso.es/webpublica/opendata/iniciativas/ProyectosDeLey__20261103050038.json
6. Real Decreto 806/2026, de 5 de octubre, de disolución del Congreso de los Diputados y del Senado y de convocatoria de elecciones. Boletín Oficial del Estado, 2026-10-06. https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-20742
7. Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información. Boletín Oficial del Estado, 2018-09-08. https://www.boe.es/buscar/act.php?id=BOE-A-2018-12257
8. NIS2 Technical Implementation Guidance. ENISA, 2025-06-26. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
9. Device compliance policies in Microsoft Intune. Microsoft Learn. https://learn.microsoft.com/en-us/intune/device-security/compliance/overview