NIS2 requirements range from Risk Management measures to business continuity, and they apply to every organization the directive classifies as an essential or important entity. Since this is a cybersecurity framework, IT Asset Management (ITAM) can greatly help implement it.
In a nutshell, ITAM software supports many of the NIS2 obligations since it provides full visibility of your organization's assets and their relationships, and allows you to configure security alerts to act upon vulnerabilities faster and more efficiently.
Plus, if you connect it to your service desk or IT Service Management (ITSM) solution, its value expands even more. For instance, you could build workflows and create an incident category to report security breaches specifically.
Keep reading to see what NIS2 and its implementing rules ask for, what to record in your asset inventory, and how these solutions can help you out!
The EU NIS2 directive, in a nutshell
The NIS2 Directive (Directive (EU) 2022/2555) was adopted by the European Union in December 2022 and entered into force in January 2023 to strengthen cybersecurity resilience across the region. Member states had until October 17, 2024, to turn it into national law and had to apply it from October 18, 2024; most did, although in July 2026 the European Commission was still taking the countries that hadn't finished to the Court of Justice. The details vary by country, and putting them into practice has raised its own NIS2 implementation challenges, as EU experts have pointed out.
Even though the directive points specifically to sectors such as transport, energy, healthcare, and banking, its ultimate goal is to ensure a high transversal level of network and information security. Under Article 34, non-compliance can lead to administrative fines with a maximum of at least €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher, plus warnings, binding instructions and, for essential entities, temporary bans on managers.
Recommended reading
Read Article
NIS2 Directive: Understanding The EU Cybersecurity Legislation
NIS2 and Asset Management
One of the main differentiators with the original Network and Information Security (NIS) directive is that NIS2 encourages a proactive approach to incident reporting and Risk Management. So, the fact that this is a proactive cybersecurity directive goes hand in hand with what IT Asset Management can do for your organization.
Article 21(2)(i) of the directive lists "human resources security, access control policies and Asset Management" among the minimum measures that essential and important entities must take. At its core, ITAM helps organizations to:
- Build and maintain an updated software and hardware inventory.
- Map Configuration Item (CI) connections to ensure business continuity.
- Manage assets throughout their lifecycle, from acquisition to disposal.
- Monitor IT asset configurations to verify adherence to the security standard.
- Set out alerts and automation to make Risk Management easier.
- Report and monitor performance continually.
As you can see, these areas are crucial to NIS2 compliance. And since you might already have an ITAM strategy implemented in your company, it only makes sense to leverage it towards the EU framework implementation.
What the NIS2 implementing rules ask for
In October 2024, the European Commission adopted Implementing Regulation (EU) 2024/2690, which spells out the technical requirements behind each Article 21 measure. It applies directly to Domain Name System (DNS) service providers, top-level domain (TLD) name registries, cloud computing, data center, content delivery network, managed service, and managed security service providers, online marketplaces, online search engines, social networking platforms, and trust service providers.
For every other entity, it serves as a useful reference: its requirements are based on ISO/IEC 27001 and ISO/IEC 27002, the same standards behind ISO 27001 Asset Management controls. Section 12 of its annex breaks Asset Management into five points:
- Asset classification (12.1): set classification levels for all assets, including information, based on their confidentiality, integrity, authenticity, and availability requirements, and review them periodically.
- Handling of assets (12.2): apply a policy that covers the entire lifecycle, from acquisition, use, storage, and transport to disposal, including the irretrievable deletion and destruction of assets.
- Removable media policy (12.3): block removable media unless there's an organizational reason to use them, disable self-execution, scan them for malicious code, and protect the data they carry.
- Asset inventory (12.4): keep a complete, accurate, up-to-date, and consistent inventory that lists your operations and services and the systems and assets that support them, and record its changes in a traceable manner.
- Deposit, return or deletion of assets upon termination of employment (12.5): document that assets are returned or deleted when someone leaves, or make sure they can no longer access your network and information systems.
NIS2 asset inventory checklist
Point 12.4 asks for a complete and up-to-date inventory and leaves the choice of fields to each organization. Recital 26 of the same regulation suggests what a comprehensive inventory could include for each asset, which makes it the closest thing to an official NIS2 asset inventory checklist.
The table below combines that list with the items other sections of the regulation point to. Use it as a starting point and adjust the level of detail to your organization's needs, as point 12.4.2 allows.
NIS2 and Service Management
But that's not it. We've gone over the benefits of combining ITSM and ITAM, but in this case, it's highly recommended.
Connecting your ITAM solution to your help desk expands its capabilities and allows you to:
- Create workflows that automate parts of your NIS2 needs.
- Build a specific service category to report security incidents that collects all the data you need right at the submission point.
- Unify reporting capabilities to mix and match incidents with assets.
Even though ITAM is the most relevant practice to take advantage of here, ITSM elevates your NIS2 implementation by adding automation and simplifying processes.
Recommended reading
Read Article
The Asset Management SOP Playbook [+Free Template]
NIS2 requirements and how to address them with ITAM and ITSM
Now it's time to examine the cybersecurity framework's requirements and how ITAM and ITSM can address them.
Risk Management
The first NIS2 requirement is Risk Management. Article 21 asks organizations to take appropriate and proportionate measures to manage the risks to their network and information systems, including Incident Management, supply chain security, security in the acquisition and maintenance of their systems, access control, and encryption.
How ITAM and ITSM can help
- ITAM provides you with a Configuration Management Database (CMDB) that maps your entire IT infrastructure, meaning you will know how your IT assets are connected and how secure your network is.
- It also lets you track the assets' configuration so you can ensure they adhere to security standards and policies mandated by NIS2. This includes monitoring configurations for vulnerabilities and ensuring that security controls are properly implemented.
- In addition, you can support risk assessment activities by providing data on the security posture of IT assets and identifying potential risks to the organization's network and information systems. This information enables proactive risk mitigation strategies to align with NIS2 requirements.
- Furthermore, it helps you detect unauthorized software installations and act on them, or label outdated software and deploy patches to avoid exploits.
- On the other hand, you can build a service category within your self-service portal so employees can report a security breach or incident (either digital or physical). With this customization, you can collect all the information you need to address the problem right at the ticket creation stage (including pictures or screenshots).
- Lastly, since agents can see the assets linked to the person who creates the ticket, you can detect any patterns and proactively contact other users who might have the same issue but haven't realized it yet.
Recommended reading
Read Article
The ABC of Risk Management Automation
Corporate accountability
As per the second NIS2 requirement, set in Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures and oversee their implementation. They also have to follow training, and they can be held liable for infringements.
How ITSM can help
- In addition to generating a security incident category to simplify notification, the knowledge base is a great way to train corporate management. You can add NIS2-related content and cybersecurity standard procedures to your internal knowledge base so that your employees and managers can refer to this information as many times as they need.
- You can also establish approval instances on any security-related service desk workflow to ensure and track validations in adherence to the NIS2 directive.
Reporting obligations
Next, Article 23 requires organizations to notify their Computer Security Incident Response Team (CSIRT) or competent authority of any significant incident. An incident is significant when it has caused or can cause severe operational disruption or financial loss, or considerable damage to other people or organizations, and its notification follows three deadlines:
- An early warning within 24 hours of becoming aware of the significant incident.
- An incident notification within 72 hours, with an initial assessment of its severity and impact.
- A final report no later than one month after the incident notification, with a detailed description, the likely root cause, and the mitigation measures applied.
Authorities can also ask for intermediate reports along the way, and trust service providers must send the incident notification itself within 24 hours. If the incident is still ongoing when the final report is due, a progress report goes in at that point, and the final report follows within one month of handling the incident.
How ITAM and ITSM can help
- You can leverage service desk SOPs to design standard workflows to address security incident reports.
- In addition, you can see all affected assets and areas by any security incident within your CMDB. This way, you can adjust and notify accordingly to ensure business continuity.
Business continuity
Lastly, companies must create a plan to ensure business continuity in case of major cyber incidents that contemplates system recovery actions, emergency procedures, and the existence of a crisis response team.
How ITAM and ITSM can help
All the ideas shared above contribute to maintaining business continuity. Your ITSM and ITAM solutions should display your cybersecurity standard operating procedures, so that they can be easily found as soon as an incident occurs.
They can be attached to your asset profiles, published as knowledge base articles, or even automated into help desk workflows.
Extra measures
Article 21(2) lists ten baseline measures in total, including cyber hygiene and training, cryptography, multi-factor authentication, and policies to assess whether your measures work. Routine internal audits help you check that your IT infrastructure stays secure and compliant across all of them.
Dashboards keep that evidence visible for managers and auditors and help show your adherence to regulations. Segmenting user privileges, in turn, keeps unauthorized personnel away from sensitive information.
How InvGate Asset Management helps with NIS2 Asset Management
InvGate Asset Management: 5-minute demo
InvGate Asset Management is ITAM software that offers an enterprise experience without the complexity or the price of one, with an intuitive interface, a no-code approach, and fast deployment. For NIS2, its main job is keeping the inventory that point 12.4 asks for complete, accurate, and up to date, with the fields from the checklist above in one place.
Each capability maps to one of the requirements covered in this article, so the evidence is ready when an auditor or authority asks for it. Here's how:
- Complete inventory: the Agent, network discovery, integrations such as Microsoft Intune, Jamf, AWS, and Azure, and manual or CSV import feed one inventory, and network scans surface unknown devices connected to your network.
- Owners and responsibilities: every asset has an owner, and CI connections link it to anyone else with a role over it, such as the person responsible for protecting it. You can use native connection types like Security Auditor or define your own.
- Classification and criticality: custom fields and Smart Tags record the classification of the information each asset processes and its criticality under your risk assessment.
- Software and patch level: the Agent reports installed software and versions, and Health rules flag computers with critical OS updates pending, antivirus or encryption turned off, or banned software detected.
- End of Support dates: in cloud deployments, Atlas AI Agent adds End of Support dates from official manufacturer references for computers, servers, and network devices, and End of Life dates for databases.
- Services and dependencies: the CMDB maps which assets support each business application, CMDB Auto-Mapping suggests updates as your environment changes, and CI connections document direct dependencies, like the server a database runs on.
- Traceable changes: every property change on a CI is logged in its activity history, which supports the traceable record that points 12.4.1 and 12.4.3 ask for.
- Returns at offboarding: customizable document templates record hardware handoffs and returns, such as an offboarding document, to support point 12.5.
InvGate Asset Management runs in the cloud or on premises, including air-gapped environments, and InvGate holds ISO 27001:2022 and SOC 2 Type II certifications. That matters for supply chain security under Article 21(2)(d), since the tools you use to manage your assets are also part of your supply chain.
Meeting the reporting deadlines with InvGate Service Management
InvGate Service Management covers the incident side of NIS2. You can create a security incident request type in the self-service portal, collect what the early warning and the incident notification need from the first report, and set Service Level Agreement (SLA) targets that match the 24-hour and 72-hour deadlines, with Operational Level Agreements (OLAs) for each workflow stage.
Since both products work together, agents see the devices linked to each user, can link the affected CIs to the ticket, and can check CI connections from InvGate Service Management, so the impact described in the final report draws on real data. Every ticket also keeps an audit trail of updates and decisions, which helps when the authority asks how the incident was handled.
How Element U.S. Space & Defense built a compliance-ready inventory
Element U.S. Space & Defense, a government contractor specializing in engineering and testing, needed to meet the National Institute of Standards and Technology (NIST) 800-171 standard, a United States security framework that also depends on a reliable asset inventory. Before InvGate, its asset data was spread across spreadsheets, Intune, and Entra, with no defined ownership rules and inconsistent naming conventions.
With InvGate Asset Management, the team centralized 1,700 assets across six sites with standardized names, ownership, and lifecycle data, tagged assets by software approval, data use, shared access, and compliance requirements, and boosted update coverage from 55% to 95%. As Michael McCouch, Ops. Applications Product Manager, put it: "In one year, we replaced the help desk, built our asset inventory, and patched every asset to the latest levels."
To sum up
NIS2 requirements encompass a wide range of areas, and it's almost impossible to address all of them manually. Enter ITAM and ITSM. These practices can help you oversee a considerable part of them.
The core of the EU cybersecurity directive is to be more proactive about security measures. Proactiveness is part of the essence of ITSM and ITAM. With them, you don't need to wait until something goes wrong; you can have systems in place to help you detect problems before they arise. To see how it works with your own assets, start a free trial of InvGate Asset Management or talk to Sales.
Frequently Asked Questions
These are quick answers to the questions that come up most often about NIS2 and the asset inventory. Each one sums up what the directive and its implementing rules say.
Does NIS2 require an asset inventory?
Article 21(2)(i) of the NIS2 Directive lists Asset Management among the minimum cybersecurity measures for essential and important entities, and an asset inventory is where Asset Management starts. For the digital service providers covered by Implementing Regulation (EU) 2024/2690, point 12.4 makes it explicit: they must keep a complete, accurate, up-to-date, and consistent inventory and record its changes in a traceable manner.
What assets must be inventoried under NIS2?
The implementing regulation asks for an inventory of the network and information systems and other assets that support the organization's operations and services, both tangible and intangible, including information. For each asset, recital 26 suggests recording an identifier, the owner, a description, the location, the type, the classification of the information it processes, its last update or patch, its risk classification, and its End of Life. The level of detail should match the organization's needs.
What are the NIS2 incident reporting deadlines?
Under Article 23, entities must send an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours. A final report is due no later than one month after the incident notification, and authorities can request intermediate reports along the way. Trust service providers have 24 hours for the incident notification.
Who does NIS2 apply to?
NIS2 applies to medium-sized and large public and private entities that provide services or operate in the EU in the sectors listed in its Annexes I and II, such as energy, transport, banking, health, digital infrastructure, public administration, manufacturing, and digital providers. Some entities are covered regardless of their size, including trust service providers, DNS service providers, TLD name registries, and providers of public electronic communications. Each entity is classified as essential or important, which affects how it's supervised and the maximum fines it faces.
