# Does NIS2 require zero trust?

No, NIS2 does not name zero trust, but several of its required measures point the same way. Article 21 of Directive (EU) 2022/2555 asks entities in scope for risk-based measures that include, among others, access control policies, asset management, the use of multi-factor or continuous authentication, secured communications and supply-chain security. Zero-trust practices, such as verifying each user and device, granting least privilege and segmenting networks, are one practical way to meet those measures, but the directive leaves the method to you, and national transpositions and guidance may add detail; check your own country's law. What auditors look for is a documented risk assessment, measures that match it, and evidence that they work. NetSenX contributes evidence on the network side: which hosts talk to which on monitored segments, and alerts on lateral movement, scanning and beaconing, on every plan. It does not make you compliant.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/does-nis2-require-zero-trust

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)
- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)
- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)
- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)
- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)