NIS2 compliance and maritime cyber resilience, without the legalese

NIS2 is the European Union's updated cybersecurity law. It widened the net dramatically: many more organisations now count as essential or important entities, and with that status comes a duty to manage cyber risk properly, not as a project you finish, but as something you do continuously and can evidence.

Crucially, it makes management personally accountable. Leadership has to understand the risks, approve the measures, oversee them, and be trained. "We assumed IT had it covered" stopped being a defence.

In practice the directive asks for a handful of sensible things, done consistently: understand your risks, secure your networks and devices, control who has access, keep working copies of your data, watch for trouble, manage your suppliers, train your people, and, when something significant happens, investigate and report it quickly. There are hard deadlines: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within a month.

None of that is unreasonable. The hard part is doing it across every server, laptop and network link you own, consistently, with enough record-keeping to prove it months later when somebody asks. That gap is what this platform is built to close.

For the details, article by article (who is in scope, the ten measures, the reporting stages and the fines), read NIS2 requirements, explained.

Ask any organisation whether it controls access, and the answer is yes. Ask it to show, for a date eight months ago, who had administrative rights, when the last leaver's account was closed and who approved the exception, and the answer becomes an afternoon of archaeology.

Here, each protective capability does its job and leaves a trail. When the gateway blocks a hostile connection, when a machine reports a missing update, when an account is switched off the moment somebody leaves, when a supplier's remote session ends: all of it is recorded automatically, dated, and exportable. The evidence an auditor wants becomes a by-product of staying secure rather than a separate annual ordeal.

And because everything reports into one place, you are never guessing: one honest view of where you stand, what is healthy, and what still needs attention, ranked so you fix what matters first.

No platform makes you compliant on its own, and any vendor claiming otherwise is describing a product that does not exist. Compliance is a set of things an organisation does; software can carry most of the weight, evidence almost all of it, and remove nearly all of the drudgery, but somebody still has to decide, approve and sign.

We are also not a law firm. Whether you are in scope, and as which kind of entity, depends on your sector, size and national implementation. We will tell you what we see and what similar organisations concluded, and where you need a legal opinion, we will say so.

What we will do is make sure the underlying work is genuinely done and genuinely evidenced. Under Complete we take that on as a service, with a service level and our own signature next to yours.