Mandate-first, not technology-first

Compliant by construction — not a tick-box

Regulations state outcomes, not products. Designing from a shopping list of tools risks buying things that miss the mandate. So we work the other way: we take each requirement of NIS2 and DORA and map it to the design property that satisfies it. Follow that mandate → principle chain and the architecture is compliant by construction — and any conformant technology can satisfy it.

This framework deliberately names no technology. It stays at the level of what the law requires and what design property answers it. The concrete tools are mapped per product elsewhere; this is the upstream artefact that drives every solution design and every audit gap-analysis.

Free guide: The Hamburg Enterprise Guide to Sovereign NIS2 Compliance

Are you in scope, what NIS2 actually requires, and how to meet it on open-source you host yourself — with a 90-day starting path. Just your work email.

Technology-neutral and testable

The 15 design principles

DP-1

Segmentation & zoning

Trust zones separated at L2/L3, default-deny between zones, blast-radius containment.

DP-2

Least privilege & access control

Access by role/need; management plane isolated from user and data planes.

DP-3

Strong authentication

Multi-factor / phishing-resistant auth for privileged and remote access.

DP-4

Cryptography in transit & at rest

Encrypted links and stored data; managed keys/certs; no plaintext control channels.

DP-5

Redundancy & no single point of failure

Critical paths duplicated; graceful degradation; defined RTO/RPO.

DP-6

Tested backup & recovery

Immutable, offsite copies; recovery proven by test, not assumed.

DP-7

Detection, logging & time-sync

Centralised, time-correlated logs; alert thresholds; monitored egress/ingress.

DP-8

Change control & config-as-code

Reviewed, versioned, reversible changes; reproducible state.

DP-9

Vulnerability & patch management

Continuous discovery; scheduled, evidenced remediation; coordinated disclosure.

DP-10

Asset inventory & source of truth

Authoritative register of assets, addresses and dependencies.

DP-11

Supply-chain assurance

Vetted suppliers/software; provenance and update integrity.

DP-12

Resilience testing

Periodic failover/DR and — where in scope — threat-led penetration testing.

DP-13

Incident handling & reporting readiness

Detect → classify → respond → report within regulatory timelines; evidence retained.

DP-14

Secure-by-design lifecycle

Security built into acquisition, development, maintenance and decommissioning.

DP-15

Cyber hygiene & human factors

Baseline hygiene, RBAC discipline, awareness/training as a design assumption.

Directive (EU) 2022/2555

NIS2 mandate → principle

Article 21(2) risk-management measures "shall include at least" the following. Art. 23 governs incident reporting.

NIS2 mandate Requirement (abridged) Principles
21(2)(a)Policies on risk analysis & information system securityDP-10, DP-8, DP-14
21(2)(b)Incident handlingDP-7, DP-13
21(2)(c)Business continuity — backup, disaster recovery, crisis managementDP-5, DP-6, DP-12
21(2)(d)Supply chain security (direct suppliers/providers)DP-11
21(2)(e)Security in acquisition, development & maintenance; vulnerability handling & disclosureDP-9, DP-14
21(2)(f)Assessing effectiveness of risk-management measuresDP-12, DP-8
21(2)(g)Basic cyber hygiene & trainingDP-15
21(2)(h)Cryptography and, where appropriate, encryptionDP-4
21(2)(i)HR security, access control, asset managementDP-2, DP-10, DP-15
21(2)(j)MFA / continuous authentication, secured commsDP-3, DP-4
Art. 23Incident reporting to CSIRT (early warning ≤24 h / notification ≤72 h)DP-13, DP-7
Regulation (EU) 2022/2554

DORA mandate → principle

DORA mandate Requirement (abridged) Principles
Art. 8 — IdentificationIdentify ICT assets, functions & dependenciesDP-10
Art. 9 — Protection & preventionSegregation, access control, encryption, resilient designDP-1, DP-2, DP-3, DP-4
Art. 10 — DetectionMulti-layer detection; alert thresholdsDP-7
Art. 11 — Response & recoveryICT continuity; respond & recover to targetsDP-5, DP-13
Art. 12 — Backup & restorationBackup policies; restoration methods; separated copiesDP-6
Art. 13 — Learning & evolvingPost-incident learning; continuous improvementDP-12, DP-8
Art. 17–23 — Incident mgmt (Ch. III)Classify & report major ICT incidentsDP-13, DP-7
Art. 24–27 — Resilience testing (Ch. IV)Test programme; threat-led penetration testing (TLPT)DP-12
Art. 28–44 — Third-party risk (Ch. V)Contractual, concentration & oversight controls on providersDP-11
From mandate to running configuration

How we apply it

Design

Every high- and low-level design is checked against DP-1…DP-15. A design that cannot demonstrate a principle records a residual risk — nothing is waved through.

Per-product mapping

Each principle is translated into concrete controls and evidence per product — the technology layer this framework intentionally leaves out.

Audit & gap analysis

Gap analysis scores your current state against the same principles, so every finding ties straight back to a regulatory mandate.

Testing & evidence

Acceptance and sandbox tests demonstrate the redundancy, backup, detection and resilience principles (DP-5/6/7/12) with evidence — proven, not assumed.

Sources (authoritative). NIS2 = Directive (EU) 2022/2555, esp. Art. 21(2)(a)–(j) and Art. 23 — EUR-Lex 32022L2555. DORA = Regulation (EU) 2022/2554, esp. Ch. II Art. 8–13, Ch. III Art. 17–23, Ch. IV Art. 24–27, Ch. V Art. 28–44 — EUR-Lex 32022R2554.