Built for the regulator you actually answer to.
Critical-infrastructure operators are frequently classified as essential entities under NIS2 — the stricter of the two tiers. Essential entities face proactive supervision and the full Article 20, 21 and 23 obligation set: governance accountability, documented operating measures, and the 24-hour / 72-hour / one-month reporting clocks.
Which obligations apply — and how they are enforced — depends on the member state: NIS2 is a directive, transposed into 27 national laws with real differences. TruSecure determines your classification in your jurisdiction, maps the resulting obligations to operating controls, and keeps the member-state specifics attached.
What changes for the operator
- Classify first
Sector, size and member state determine the tier. The applicability engine reasons through the transposition that actually applies to you.
- Map the obligations
Articles 20, 21 and 23 become operating controls with citations — not a compliance memo.
- Run the clocks
Incident workflows carry the 24-hour early warning, 72-hour notification and one-month report, with every decision logged.
- Show the supervisor
Evidence exports answer supervisory requests directly — scoped, timestamped, sealed.
What you'd actually look at
The starting point — the applicability engine's conclusion, openable in the dashboard from day one:
- Member state
- DE · national transposition applies
- Size
- large · thresholds met
- Classification
- essential entity
- Supervision
- proactive
- Obligations
- Art. 20 · 21 · 23
- Controls mapped
- 191
The essential-entity obligation set
| What it asks of you | Citation | Where it is answered |
|---|---|---|
| Management-body accountability and training | Art. 20 | Board reporting |
| Documented, operating risk-management measures | Art. 21(2) | Control library · evidence |
| Staged incident reporting | Art. 23 | Incident resilience |
| Member-state transposition specifics | 27 national laws | Country pages · engine |
How operators usually start
A demo that runs your classification live, then a fixed-scope Resilience Sprint that maps the resulting obligations to operating controls, then the subscription. No self-serve checkout, no per-seat maths.
TruSecure helps operationalize requirements and prepare evidence. Legal interpretation should be validated by qualified counsel.