NIS2 Directive (EU 2022/2555)
Best for: Entities the EU classifies as 'essential' or 'important' in 18 sectors, including energy, transport, banking, health, digital infrastructure, ICT service management, public administration, and critical manufacturing. The size threshold is generally 50+ employees or EUR 10M+ turnover. Sole providers of critical services may be caught regardless of size. Non-EU entities providing DNS, cloud, CDN, or managed security within the EU are also in scope.
| Mandatory? | Mandatory for essential/important entities in 18 EU sectors |
| Who validates? | National competent authority (EU member state) · No self-assessment |
| Renewal | Ongoing; no fixed audit cycle |
| Scope | Essential and important entities in energy, transport, health, digital infrastructure, etc. |
🏛 European Parliament and Council of the European Union. National competent authorities (e.g., BSI in Germany, ANSSI in France, ACN in Italy) enforce at the member state level. ENISA coordinates cross-border cooperation. · NIS2 Directive (EU 2022/2555, Oct 2024) Official source →
Get Started
module "..." {
source = "nis2.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Encryption at Rest: Checks encryption configuration on Athena workgroups, backup recovery points, API Gateway stage caches, and Bedrock invocation logs in S3 and CloudWatch. Validates that KMS keys are in use where required.
- Encryption in Transit: Validates ACM certificate key lengths (minimum 2048-bit RSA), certificate transparency logging, and SSL certificate attachment on API Gateway stages.
- Logging and Monitoring: Verifies logging is enabled on API Gateway stages, AppSync GraphQL APIs, Athena workgroups, and Bedrock model invocations. Flags services where logging is disabled or misconfigured.
- Backup and Business Continuity: Confirms backup plans, vaults, and report plans exist in each configured region, and that recovery points are encrypted.
- Access Control and Session Management: Enforces AppStream fleet timeout thresholds (idle disconnect at 600s, session disconnect at 300s, max duration at 36000s) and the IMDSv2 requirement on Auto Scaling launch configurations.
- Incident Reporting Readiness: Validates that AWS accounts have a security alternate contact registered and that primary contact details are current.
What you handle
- Encryption at Rest: Defining and documenting your encryption policy per Article 21(2)(e). Key rotation schedules, key access reviews, and mapping encryption coverage to all in-scope systems beyond AWS.
- Encryption in Transit: TLS policy decisions (minimum version enforcement), certificate lifecycle management for non-ACM certificates, and documenting approved cipher suites.
- Logging and Monitoring: Centralized log aggregation, SIEM integration, alert tuning, and building the incident detection workflows needed to meet Article 23 reporting timelines. Retention period configuration and log integrity verification.
- Backup and Business Continuity: Disaster recovery testing, recovery time objective (RTO) and recovery point objective (RPO) documentation, and the broader business continuity plan required by Article 21(2)(c).
- Access Control and Session Management: MFA enforcement policies, identity governance, privileged access management, and access review processes per Article 21(2)(i) and (j). Role-based access control documentation across all environments.
- Incident Reporting Readiness: The full incident response plan, CSIRT notification procedures, the 24-hour early warning and 72-hour notification workflows required by Article 23, and staff training on reporting obligations.
Controls by Category
Access Control and Session Management (Article 21(2)(i)(j)) (3 controls)
IMDSv1 on EC2 instances and overly permissive session durations are the most common access control findings here, and both are straightforward to catch in automated scans. Article 21(2)(i) and (j) require documented access control policies and MFA enforcement, so assessors will also ask for evidence of access reviews and authentication configuration that no scan can verify on its own.
Cryptography and Encryption (Article 21(2)(e)) (5 controls)
Backup data stored without encryption is one of the most consistent findings in this category and directly contradicts Article 21(2)(e). Beyond backups, assessors examine certificate configurations for weak key lengths or expiry issues and verify that data stores are encrypted both at rest and in transit.
compliance.tf moduleACM certificates should have transparency logging enabledcompliance.tf moduleAPI Gateway stages should not use client SSL certificatesAPI Gateway stages should have cache encryption at rest enabledAthena workgroups should be encrypted at restLogging, Monitoring, and Incident Detection (Article 21(2)(b)) (3 controls)
Article 23's 24-hour early warning window means detection gaps are not just a hygiene issue, they are a compliance failure. Assessors will want to see logging enabled across all relevant services and confirm that logs feed into a SIEM or equivalent capability. Gaps at the API and application layer show up repeatedly.
Additional Controls (91)
AWS CloudTrail (4)
AWS CodeBuild (3)
AWS Database Migration Service (2)
AWS IAM (9)
AWS Step Functions (1)
Amazon CloudFront (2)
Amazon CloudWatch (1)
Amazon DocumentDB (1)
Amazon DynamoDB Accelerator (2)
Amazon EC2 (7)
compliance.tf moduleEC2 instances should have IAM profile attachedcompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleEC2 instances should use IAM instance roles for AWS resource accesscompliance.tf moduleEC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)compliance.tf moduleEC2 launch templates should not assign public IPs to network interfacescompliance.tf moduleAmazon EFS (2)
Amazon ElastiCache (2)
Amazon Kinesis (1)
Amazon Neptune (4)
Amazon OpenSearch Service (3)
Amazon RDS (14)
compliance.tf moduleAurora PostgreSQL DB clusters should publish logs to CloudWatch Logscompliance.tf moduleRDS DB clusters should be configured to copy tags to snapshotscompliance.tf moduleRDS DB clusters should have IAM authentication configuredcompliance.tf moduleRDS DB instances and clusters should have enhanced monitoring enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instances should be configured to copy tags to snapshotscompliance.tf moduleRDS DB instances should have iam authentication enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (3)
Amazon Route 53 (1)
Amazon S3 (6)
compliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have MFA delete enabledcompliance.tf moduleS3 buckets should have object logging enabledS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleAmazon SageMaker (1)
Amazon VPC (1)
Elastic Load Balancing (2)
Other (14)
compliance.tf moduleFSx for Lustre file systems should be configured to copy tags to backupscompliance.tf moduleAPI Gateway V2 stages should have access logging configuredcompliance.tf moduleGlue jobs bookmarks encryption should be enabledGlue jobs CloudWatch logs encryption should be enabledMSK Connect connectors should be encrypted in transitNetwork Firewall firewalls should have deletion protection enabledcompliance.tf moduleNetwork Firewall policies should have default stateless action set to drop or forward for fragmented packetscompliance.tf moduleNetwork Firewall policies should have default stateless action set to drop or forward for full packetscompliance.tf moduleRelated Frameworks
NIST CSF v2.0 — 🟢 High overlap (65%)
NIS2 Article 21 risk management measures map closely to NIST CSF functions (Identify, Protect, Detect, Respond, Recover). Organizations already aligned to NIST CSF will find significant overlap, particularly in incident response and business continuity. NIST CSF lacks the regulatory enforcement and incident reporting timelines that NIS2 mandates.
ISO/IEC 27001:2022 — 🟢 High overlap (70%)
ISO 27001:2022 Annex A controls cover most of Article 21's technical requirements. Several member states accept ISO 27001 certification as partial evidence of NIS2 compliance. The gap is in NIS2-specific obligations: incident reporting to national authorities, supply chain risk management with named critical suppliers, and governance requirements placing liability on management bodies.
GDPR — ⚪ Low overlap (25%)
GDPR Article 32 (security of processing) partially overlaps with NIS2 Article 21 on technical measures, and both require breach notification. GDPR focuses on personal data protection while NIS2 covers all network and information system security. Incidents may trigger reporting obligations under both regimes simultaneously, with different timelines and different authorities.