NIS2
NIS2 asks you to detect and report incidents. Here's where Kandaro helps.
The NIS2 Directive, and in the Netherlands the Cyberbeveiligingswet (Cbw), require many medium and large organisations to manage cyber risk, handle incidents and report significant ones within fixed deadlines. Kandaro Deception supports specific parts of that. It does not make you compliant on its own.
Article 21: risk-management measures
Which measures Kandaro supports, and which it doesn’t.
Article 21(2) of the NIS2 Directive lists ten minimum measures. Kandaro has a real role in three of them. For the rest, you need other tools and processes, and we would rather say so.
| Article | Measure | How Kandaro helps | Evidence you get |
|---|---|---|---|
| 21(2)(b) | Incident handling | Detects intruders who are already inside, groups their activity into one incident and explains in plain English what happened and what to do next. Your team assigns, comments on and closes each incident. | Incident timeline with first and last activity, the activity log of who did what, and JSON exports. |
| 21(2)(f) | Assessing whether your measures work | A decoy that raises an alert shows an attacker got past your other defences. Decoy coverage across your network is a measurable control you can review. | Each decoy’s status and last check-in, and the incidents it raised. |
| 21(2)(d) | Supply chain security | Kandaro is one of your suppliers. We give you what you need to assess us. | Our security page, data processing agreement, signed sensor images with a software bill of materials, and our vulnerability disclosure policy. |
| 21(2)(a), (c), (e), (g)–(j) | Risk analysis, business continuity, secure development, cyber hygiene and training, cryptography, access control, MFA | Outside what Kandaro does. | — |
Article 23: reporting
Three deadlines once you’re aware of a significant incident.
NIS2 sets fixed reporting steps. Kandaro doesn’t file reports for you, but it gives you the facts for each one, timestamped and in plain language.
01 · Within 24 hours
Early warning
to your CSIRT or supervisor once you become aware of a significant incident (Art. 23(4)(a)).
With Kandaro: The incident’s first-seen time and plain-English summary help you decide quickly whether it is significant and what to say.
02 · Within 72 hours
Incident notification
updating the early warning with an initial assessment, including severity and impact (Art. 23(4)(b)).
With Kandaro: The timeline shows which systems were touched, from where and in what order, with MITRE ATT&CK techniques.
03 · Within one month
Final report
after the incident notification, with a detailed description, the likely root cause and the measures taken (Art. 23(4)(d)).
With Kandaro: The activity log records who handled the incident and what they decided. Export it as JSON for your report.
Who it applies to
In broad terms, NIS2 covers medium and large organisations (from 50 employees, or more than €10 million in turnover or balance sheet) in the sectors listed in its Annexes I and II, such as energy, transport, healthcare, digital infrastructure, waste, manufacturing, food and postal services. Some smaller organisations are covered too. The Netherlands implements NIS2 through the Cyberbeveiligingswet, which also sets out who your supervisor is.
Not sure whether it applies to you? The NCSC and your sector's supervisor publish self-assessment tools. If it does apply, detection and incident handling are where a decoy pays off first: it tells you someone is inside, which is exactly the moment your reporting clock starts.
Questions about how Kandaro fits your NIS2 programme? Ask us through the contact form, or read how we secure Kandaro itself.
See your first explained finding today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing