Does NIS2 require zero trust?

No, NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. does not name zero trust, but several of its required measures point the same way. Article 21 of Directive (EU) 2022/2555 asks entities in scope for risk-based measures that include, among others, access control policies, asset management, the use of multi-factor or continuous authentication, secured communications and supply-chain security. Zero-trust practices, such as verifying each user and device, granting least privilege and segmenting networks, are one practical way to meet those measures, but the directive leaves the method to you, and national transpositions and guidance may add detail; check your own country's law. What auditors look for is a documented risk assessment, measures that match it, and evidence that they work. NetSenX contributes evidence on the network side: which hosts talk to which on monitored segments, and alerts on lateral movement, scanning and beaconing, on every plan. It does not make you compliant.

← All 45 questions on Zero trust, identity and segmentationAll topics