Does a NIS2 catalogue automatically make an organisation compliant?

No. Actual implementation, responsibility and effectiveness need assessment. Sector-specific rules may also apply.

Software for NIS2 implementation: Coordinate measures across departments

Your NIS2 scope has been established. Measures now sit with IT, procurement, HR and management. The real project begins where this list needs to become a functioning workflow.

Select software using an open security gap: who prioritises it, who implements treatment and who verifies completion? This guide connects IT, procurement, HR and management within that workflow.

Which gap should procurement close?

A scope assessment, a technical detection tool and a GRC platform do different jobs. In Germany, scope under section 28 BSIG comes first. Then use existing tools and establish the missing connection.

Already available	Still unresolved	Selection question
Technical findings	Prioritisation by business consequences	Can affected information assets, other assets and processes be assigned?
Security policies	Approval, distribution and application	Do changes reach relevant employees?
Provider contracts	Owned security measures	Who assesses evidence and handles gaps?
Continuity plans	Recovery tested in practice	Do test results and remediation remain connected?

This structure is a working aid, not a complete statutory measures catalogue. Requirements for your entity need separate determination.

Kopexa connects work across departments

In Kopexa, you record information assets and other assets, assess risks and assign measures. Evidence belongs to measures, which are mapped to controls. This keeps visible which implementation actually supports a requirement.

Document versions undergo approval. The Workforce Hub makes relevant content available to employees, including notifications and documented participation. BPMN processes describe handovers, while a BIA supports prioritisation by outage consequences.

This should lead to specific management decisions: which risk remains open? Which resource is missing? Which measure takes priority? Our management review guide turns reports into decision briefs.

Test an incident, beyond normal working status

An important provider reports a disruption. During testing, find the affected process, assess impact and assign owners for technical response and notification assessment. Who deputises outside business hours?

Test notification separately: who prepares information, who decides and who submits it? The Kopexa functions described here do not include a regulatory reporting channel. Our incident management guide explains the organisational workflow.

Decide on practical implementability

During the pilot, take an open gap involving several roles. Follow it to verified completion. Record additional data entry, necessary questions and unclear responsibilities. If the new solution merely creates another list, the bottleneck remains.

For small teams, our guide to an ISMS without an internal IT department explores cooperation with external IT partners. Test cross-department implementation against your own workflow in Kopexa’s two-week guided trial.