NIS2: mobilize your crisis team within the deadlines
Early warning within 24 hours, notification within 72 hours, final report within a month: Astry mobilizes the right people in seconds and keeps a record of every action for your audits.
NIS2 deadlines after a significant incident
- 24 hEarly warning to the authority
- 72 hIncident notification with a first assessment
- 1 monthFinal report
Holding the 24-hour deadline requires an almost instant internal alert chain, nights and weekends included.
What NIS2 requires, what Astry provides
Astry does not make you compliant on its own: it covers the operational part of the incident and continuity requirements.
Incident handling (art. 21.2.b)
Alerts from your detection tools (monitoring, SIEM, EDR via webhook or email) centralized, routed to the on-call team and escalated if nobody acknowledges.
Notification deadlines (art. 23)
The crisis team (CISO, CIO, legal, communication) mobilized in seconds by call, SMS and push, day and night.
Business continuity and crisis management (art. 21.2.c)
On-call schedules during and outside business hours, crisis templates with actions assigned to positions, procedures in an end-to-end encrypted vault.
Traceability and evidence
Timestamped log of alerts, notifications and acknowledgements, MTTA and MTTR, CSV exports and a PDF report (REX) for each crisis.
Supply chain security (art. 21.2.d)
A French vendor, data hosted in the EU, SAML single sign-on, IP/VPN restriction and role-based access control.
Who is concerned?
NIS2 widely extends the scope of the first directive: entities with 50 employees or more, or €10M turnover or more, in many sectors.
See the detailed list of sectorsEssential entities
Energy, health, transport, digital infrastructure, managed IT services, drinking water, public administration.
Important entities
Postal services, waste management, manufacturing and chemicals, food, digital providers.
Their suppliers
Software vendors, maintenance providers, integrators: large accounts increasingly require NIS2 standards contractually.
What is at stake
NIS2 turns cybersecurity into a governance matter, for the company and for its executives.
Heavy fines
Up to €10M or 2% of worldwide turnover for essential entities, €7M or 1.4% for important entities.
Executives held liable
Management bodies must approve cybersecurity risk measures and oversee their implementation.
Insurers more demanding
Without proof of a crisis plan and of fast response, cyber coverage becomes harder and more expensive to obtain.
Evidence ready for the audit
During an inspection, you must show that your teams were mobilized on time. Astry records it as it happens, with no report to rebuild afterwards.
- Time each alert was sent, acknowledged and resolved
- Complete timeline of each incident and crisis
- MTTA and MTTR indicators, CSV exports
- Crisis report (REX) generated as a PDF
Cellule de crise indépendante : Un vrai plus en cas de pépin majeur. Les templates prêts à l’emploi, les procédures dégradées et les contacts d’urgence y sont stockés, garantissant notre autonomie si notre réseau principal tombe.(Shared in its original French wording.)
Damien MĂ©ry
Operations Manager at FreePro
Frequently Asked Questions
Let’s talk about your NIS2 approach
Tell us about your context: we get back to you with a demo tailored to your organization.
- A demo built around your incident and crisis processes
- A review of your alert and notification chains
- Free 30-day trial, no credit card required