# NIS2 Compliance Assessment

> Auto-generated by Prism from the project specification.
> Organization: **{{ organization_name }}**
> Generated: {{ generated_at }}

## 1. Entity Classification

| Field | Value |
|-------|-------|
| Organization | {{ organization_name }} |
| NIS2 Sector | {{ nis2_sector or "Not specified" }} |
| Entity Type | {{ nis2_entity_type | title }} |

{% if nis2_entity_type == "essential" %}
> **Essential entities** are subject to stricter supervisory measures under NIS2
> Article 32, including proactive audits and compliance checks.
{% else %}
> **Important entities** are subject to reactive supervisory measures under NIS2
> Article 33, triggered by evidence of non-compliance.
{% endif %}

## 2. Risk Management Measures (Article 21)

The following technical measures are addressed by this application:

### 2.1 Policies on Risk Analysis and Information System Security

| Measure | Status | Notes |
|---------|--------|-------|
| Data classification policy | {{ "Implemented" if has_classification else "Pending" }} | Field-level classification in spec |
| Access control policy | {{ "Implemented" if has_auth else "Pending" }} | Authentication & RBAC |
| Data retention policy | {{ "Implemented" if has_retention else "Pending" }} | Automated retention enforcement |
| Audit logging | {{ "Implemented" if has_audit_log else "Pending" }} | GDPR audit trail |

### 2.2 Incident Handling

| Requirement | Status | Notes |
|------------|--------|-------|
| Incident detection | Pending | Implement application monitoring |
| Incident response plan | Pending | Organizational policy required |
| 24-hour early warning | Pending | NIS2 Article 23 requirement |
| 72-hour incident notification | Pending | NIS2 Article 23 requirement |
| 1-month final report | Pending | NIS2 Article 23 requirement |

### 2.3 Business Continuity and Crisis Management

| Requirement | Status | Notes |
|------------|--------|-------|
| Backup management | Pending | Configure database backups |
| Disaster recovery | Pending | Document recovery procedures |
| Crisis management | Pending | Organizational policy required |

### 2.4 Supply Chain Security

| Requirement | Status | Notes |
|------------|--------|-------|
| Subprocessor inventory | {{ "Documented" if subprocessors else "Pending" }} | {{ subprocessors | length }} subprocessors listed |
| Supplier security assessment | Pending | Assess each subprocessor |
| Contractual security requirements | Pending | Include in DPA/contracts |

{% if subprocessors %}
**Declared subprocessors:**
{% for sp in subprocessors %}
- {{ sp }}
{% endfor %}
{% endif %}

### 2.5 Security in Network and Information Systems

| Requirement | Status | Notes |
|------------|--------|-------|
| Vulnerability handling | Pending | Implement dependency scanning |
| Vulnerability disclosure | Pending | Publish security.txt |
| Secure development practices | Partial | Code generation enforces patterns |

### 2.6 Cybersecurity Risk Assessment

| Requirement | Status | Notes |
|------------|--------|-------|
| Risk assessment methodology | Pending | Organizational policy required |
| Regular risk assessments | Pending | Schedule periodic reviews |
| Risk treatment plan | Pending | Document mitigations |

### 2.7 Cryptography and Encryption

| Requirement | Status | Notes |
|------------|--------|-------|
| Encryption in transit | {{ "Implemented" if has_auth else "Pending" }} | TLS/HTTPS |
| Encryption at rest | {{ "Partial" if total_encrypted_fields > 0 else "Pending" }} | {{ total_encrypted_fields }} fields encrypted |
| Key management | Pending | Implement key rotation policy |

### 2.8 Human Resources Security

| Requirement | Status | Notes |
|------------|--------|-------|
| Security awareness training | Pending | Organizational policy |
| Access management | {{ "Implemented" if has_auth else "Pending" }} | Role-based access control |
| Multi-factor authentication | {{ "Implemented" if has_mfa else "Pending" }} | MFA configuration |

### 2.9 Access Control and Asset Management

| Requirement | Status | Notes |
|------------|--------|-------|
| Asset inventory | Partial | Models and fields documented |
| Access control enforcement | {{ "Implemented" if has_auth else "Pending" }} | Auth + RBAC |
| Audit trail | {{ "Implemented" if has_audit_log else "Pending" }} | Privacy audit log |

## 3. Reporting Requirements (Article 23)

NIS2 requires timely incident reporting to the national CSIRT:

| Deadline | Requirement | Prepared |
|----------|------------|----------|
| 24 hours | Early warning of significant incident | No — implement alerting |
| 72 hours | Incident notification with assessment | No — implement IR process |
| 1 month | Final report with root cause analysis | No — implement IR process |

## 4. Governance (Article 20)

| Requirement | Status |
|------------|--------|
| Management body approval of cybersecurity measures | Pending |
| Management body cybersecurity training | Pending |
| Regular review of risk management measures | Pending |

## 5. Compliance Checklist

- [x] Data classification implemented
{% if has_audit_log %}
- [x] Audit logging active
{% else %}
- [ ] Audit logging not enabled
{% endif %}
{% if has_auth %}
- [x] Authentication and access control
{% else %}
- [ ] Authentication not configured
{% endif %}
{% if has_retention %}
- [x] Data retention policies enforced
{% else %}
- [ ] Data retention policies not configured
{% endif %}
{% if total_encrypted_fields > 0 %}
- [x] Field-level encryption ({{ total_encrypted_fields }} fields)
{% else %}
- [ ] No field-level encryption configured
{% endif %}
- [ ] Incident response plan
- [ ] Business continuity plan
- [ ] Supply chain security assessment
- [ ] Regular penetration testing
- [ ] Security awareness training program
- [ ] Vulnerability disclosure policy

## 6. Penalties Reference

{% if nis2_entity_type == "essential" %}
**Essential entities**: Up to €10,000,000 or 2% of total worldwide annual turnover
(whichever is higher) — NIS2 Article 34(4).
{% else %}
**Important entities**: Up to €7,000,000 or 1.4% of total worldwide annual turnover
(whichever is higher) — NIS2 Article 34(5).
{% endif %}

---

*This document is auto-generated from the Prism specification. It provides a starting
point for NIS2 compliance assessment but must be supplemented with organizational
policies, procedures, and regular reviews.*
