NIS2 in one paragraph
The NIS2 directive (EU) 2022/2555 obliges far more companies than before to take cybersecurity measures; member states implement it in national law, Germany in the BSI Act (§ 30 BSIG). Art. 21(2) lists ten areas, from risk analysis and incident handling to cryptography. Most of them are organisational, some can be read from a company’s domain from the outside.
There is no certificate for NIS2. The directive asks for measures and evidence, not a badge; this quick check only covers the measures visible from the outside.
What the quick check tests
Five of the ten areas of Art. 21(2), each with the checks that can be evidenced from the outside:
- (b) Incident handling: DMARC aggregate reports and TLS-RPT, so that forgery attempts and encryption failures get reported.
- (c) Business continuity: several reachable name servers serving the same zone version, the domain does not expire, the website certificate is valid.
- (e) Security in acquisition, development and maintenance: an up-to-date CMS, a valid security.txt as the channel for reporting vulnerabilities, no version numbers in the web server’s responses.
- (h) Cryptography: no TLS 1.0 or 1.1, a valid certificate, HSTS, a signed DNS zone, CAA records, encryption on the mail server and for mail clients.
- (j) Secured communications: SPF, DKIM, DMARC and DANE protect email against forgery and interception.
What only works with monitoring
Some things a single lookup cannot show: whether the domain is monitored at all, how available the website was over the last 30 days and whether databases or remote access are open to the internet. These checks show as “only with monitoring” in the result and are not counted, instead of the check guessing. DomainWarn’s monitoring checks them continuously.
How to read the result
A measure is met when all checkable points are met, not met when none is, and partly met otherwise. Points that are not checkable or only work with monitoring do not decide. Below each measure you see the individual checks with evidence and recommendation.
What the quick check cannot do
The check is an automated test from the outside. It does not replace an assessment under NIS2 or the BSI Act, an audit or a certification, and it is not legal advice. It does not see risk analysis, backups, training, access control or anything behind the firewall.
Keep an eye on it
Today’s state is different tomorrow. DomainWarn monitors your clients’ domains continuously, measures availability, checks open ports, reports changes and creates the compliance report on NIS2, BSI TR-03108 and TR-03182 as a PDF for your clients.