Built for the regulator you actually answer to.
Critical-infrastructure operators are frequently classified as essential entities under NIS2 — the stricter of the two tiers. Essential entities face proactive supervision and the full Article 20, 21 and 23 obligation set: governance accountability, documented operating measures, and the 24-hour / 72-hour / one-month reporting clocks.
Which obligations apply — and how they are enforced — depends on the member state: NIS2 is a directive, transposed into 27 national laws with real differences. TruSecure determines your classification in your jurisdiction, maps the resulting obligations to operating controls, and keeps the member-state specifics attached.
What changes for the operator
- Classify first
Sector, size and member state determine the tier. The applicability engine reasons through the transposition that actually applies to you.
- Map the obligations
Articles 20, 21 and 23 become operating controls with citations — not a compliance memo.
- Run the clocks
Incident workflows carry the 24-hour early warning, 72-hour notification and one-month report, with every decision logged.
- Show the supervisor
Evidence exports answer supervisory requests directly — scoped, timestamped, sealed.
What you'd actually look at
The starting point — the applicability engine's conclusion, openable in the dashboard from day one:
- Member state
- DE · national transposition applies
- Size
- large · thresholds met
- Classification
- essential entity
- Supervision
- proactive
- Obligations
- Art. 20 · 21 · 23
- Controls mapped
- 191
The essential-entity obligation set
| What it asks of you | Citation | Where it is answered |
|---|---|---|
| Management-body accountability and training | Art. 20 | Board reporting |
| Documented, operating risk-management measures | Art. 21(2) | Control library · evidence |
| Staged incident reporting | Art. 23 | Incident resilience |
| Member-state transposition specifics | 27 national laws | Country pages · engine |
Why the member state changes the work
The same operator can face meaningfully different obligations depending on where it is established. The 27 transpositions differ in how they size entities, which sectors land in which annex, who the competent authority is and what the national law adds on top of the directive. The country pages here track each transposition individually — authority and requirements per member state — and the applicability engine reasons through the one that applies to you, not a generic reading of NIS2.
Sector substance matters as much as the tier: an energy transmission operator, a hospital group and a rail operator can each carry the essential-entity classification, but the controls that matter and the supervisors reading them differ. The mapping starts from your sector and your member state, not from a generic checklist.
How operators usually start
A demo that runs your classification live, then onboarding maps the resulting obligations to operating controls, and the subscription. No self-serve checkout, no per-seat math.
TruSecure helps operationalize requirements and prepare evidence. Legal interpretation should be validated by qualified counsel.