Quick answer
NIS 2 is OptiTech's home framework: the requirement catalog is built from the Swedish Cybersecurity Act and MSB's regulations (not a generic translation of the directive), scoping determines your entity classification, the measures run as continuously verified controls, and the incident flow implements the actual Swedish reporting sequence: 24-hour early warning, 72-hour notification, one-month final report, with pre-filled authority forms and deadline countdowns.
Scoping and the management layer
The onboarding wizard determines whether you're in scope, your likely essential-or-important classification, and which measures apply proportionately. The management duties get their own machinery: board-facing reporting that demonstrates active oversight, training modules for management (a NIS 2 requirement with personal liability behind it), and documented approval of the risk measures, the paper trail that protects your board members personally.
The measures on automation
The directive's measure list maps directly onto platform mechanics: risk analysis in the risk register, incident handling below, continuity and backups verified through cloud integrations, supply chain security in the supplier register with questionnaires, hygiene and MFA checked continuously against your identity provider, and training tracked per employee. Evidence accumulates in the append-only log, which is what a supervisory authority means when it asks you to demonstrate compliance over time.
The incident flow, rehearsed and ready
When an incident opens, the record runs the NIS 2 track: significance assessment against the reporting criteria, countdown timers per deadline, MSB report forms pre-filled from the timeline, jour contact lists, and communication templates. The one-month final report assembles from the record instead of from memory. Run the built-in tabletop exercise before the real thing; the 24-hour clock is unforgiving to first-timers.
The supply chain, both directions
In-scope entities send structured questionnaires to suppliers; suppliers answer once and reuse. If NIS 2 reached you through a customer's contract rather than the annexes, the same mechanics answer their demands, and your posture becomes shareable proof for the next customer who asks. Financial-sector relationships layer DORA on the same control set.
Get a personalized walkthrough of automated compliance for your team. No commitment required.