Explain the treatment weeks later
Why was this alert excluded? Who approved the deferral? Which systems remain affected? If every review requires recalling the analyst and finding old conversations, tracking depends too heavily on people’s memory. Decisions were made, but their rationale is hard to retrieve.
A usable case file brings together affected systems, sources, analysis, the decision, the action owner and expected evidence. Work can continue when contacts change, and reviews start from information already organised.
Distinguish the directive, national law and working guidance
NIS2 provides for risk-management measures including supply chains, maintenance, vulnerability handling and evaluating measures. Applicability depends on activity, size and stated exceptions. Suppliers may also receive contractual requests from clients without being directly subject to the same requirements.
As of 30 October 2026, ANSSI states that French transposition is underway and presents ReCyF as a working draft subject to adjustment. The parliamentary file records the Resilience Bill’s progress. Separate applicable provisions from recommendations and work in progress; draft ReCyF is not a universal final standard.
Sources: Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexes, ANSSI: NIS2 scope, French transposition and ReCyF status, French National Assembly: Resilience Bill legislative file
Define a short chain from finding to evidence
First identify services, systems, versions and contacts. Link each finding to its instances and justify its status: applicable, not applicable or under investigation. Then establish priority using exposure, service impact, exploitation evidence and remediation constraints.
The decision specifies what must happen and who decides. Every action has an owner, deadline and expected evidence. A deferral retains its reason, owner, temporary measures and reassessment trigger. The next review can then focus on changes and decisions needed.
Fictional case: a component shared across services
In this fictional example, the Vallée group operates a portal and an internal application using the same library. Assessment of DEMO-NIS2-01 establishes a shared applicability condition. Treatments then differ: the portal is exposed, while the internal application has a separate validation process. One technical case can be shared, with two instances and two tracked actions.
The portal owner prepares a fix; the internal application owner requests supplier validation. Fixing the portal does not close the internal instance. A system absent from a new collection must also be checked. The review sees both paths and can resolve blockers without losing system coverage.
| Item | Evidence retained in the example |
|---|---|
| Shared assessment | Source, examined condition and identical assumptions |
| Portal instance | Version, owner and deployment validation |
| Internal instance | Supplier question, decision and reassessment |
| Review summary | Separate completed actions, blockers and pending decisions |
Measure useful effort and clarify responsibilities
Measure cases without owners, pending decisions and the time needed to retrieve evidence for a sample. Also track reassessments caused by missing context. Keep the same units across periods: consolidating rows changes register volume, not necessarily the number of vulnerabilities.
CyberLifeCycle handles monitoring, assessment and case tracking, with alerts and reports for teams and leadership. Retrieve priorities, overdue actions and evidence for your reviews. The organisation makes decisions and authorised teams implement fixes. These deliverables support NIS2 work; they do not cover every applicable requirement on their own.
Sources consulted
- Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexesAccessed on 30 October 2026.
- ANSSI: NIS2 scope, French transposition and ReCyF statusAccessed on 30 October 2026.
- French National Assembly: Resilience Bill legislative fileAccessed on 30 October 2026.