NIS2 and outside-in evidence
Which NIS2 Directive controls outside-in evidence can support, which findings count against each, and what it cannot tell you.
Last reviewed
NIS2 Directive
(EU) 2022/2555
4controls with outside-in evidence
Everything else in the framework needs evidence from inside the organisation.
NIS2, Directive (EU) 2022/2555, asks essential and important entities to manage cybersecurity risk, and Article 21 lists the measures that means. Several of them leave traces anyone can see from the internet: whether email is authenticated, whether services are encrypted with valid certificates, whether web traffic is forced onto HTTPS.
TrustSek maps its findings to those measures, so a finding tells you which part of Article 21 it bears on. It also works for your suppliers: you can score a supplier's domain without asking them for anything, which gives supply-chain checks a documented, repeatable starting point.
What Article 21 asks for
Article 21(2) lists ten measures. Outside-in evidence speaks directly to four of them, the ones whose results show on a public domain. The rest happen inside an organisation, where no scan can see.
| What it covers | Outside-in evidence | |
|---|---|---|
| (a) | Risk analysis and information system security policies | No |
| (b) | Incident handling | No |
| (c) | Business continuity, backups, disaster recovery and crisis management | No |
| (d) | Supply chain security | Indirectly: score the domains of your direct suppliers |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling | Yes: missing security headers and HSTS |
| (f) | Assessing whether the measures work | Indirectly: a dated, repeatable external measurement |
| (g) | Basic cyber hygiene and training | Yes: SPF, DKIM, DMARC, MTA-STS, HSTS and security headers |
| (h) | Cryptography and encryption | Yes: certificates, TLS versions and ciphers |
| (i) | Human resources security, access control and asset management | No |
| (j) | Multi-factor authentication and secured communications | Yes: HTTPS available and enforced on public services |
The findings that count against (e), (g), (h) and (j) are listed below, each linked to the module that explains it and how to fix it.
Using it to check suppliers
Article 21(3) asks you to take into account the vulnerabilities specific to each direct supplier and the overall quality of their cybersecurity practices. A questionnaire tells you what a supplier says; outside-in evidence shows part of what they do. In practice:
- List the direct suppliers that matter: the ones that hold your data, run services you depend on, or connect to your systems.
- Score each supplier's domain. It needs no access and no cooperation, so you can start before the supplier answers anything.
- Ask about specific findings, not generic controls. “Your mail domain publishes no DMARC policy” gets a faster and more honest answer than “Do you protect against email spoofing?”.
- Keep the dated report with your supplier assessment, and check again when the contract is renewed or the supplier's role changes.
The guide to NIS2 supplier security covers what Article 21(2)(d) requires in more depth, and TrustSek for companies shows how scoring suppliers works in the product.
What it does not cover
Outside-in evidence cannot show whether you have a risk-management process, incident handling, business continuity plans, staff training or governance in place. Those are most of what NIS2 asks for. A good score is not proof of compliance, and a finding is not a legal judgement. Use it as evidence alongside your own assessment, not instead of one.
Questions
Does a good score mean we comply with NIS2?
No. Outside-in evidence speaks to four of the ten Article 21 measures, and only to the part of them that shows on the internet. Compliance also depends on governance, processes and controls that no external scan can see.
Do suppliers have to agree to be scored?
No. The score is built from public evidence and needs no access to the supplier's systems. Telling a supplier you assess them this way, and sharing the findings, usually makes the follow-up conversation easier.
How does NIS2 apply in Sweden?
Sweden implements NIS2 through the Cybersecurity Act, Cybersäkerhetslag (2025:1506), which applies from 15 January 2026. The Swedish version of this page covers it in Swedish.
Controls with outside-in evidence (4)
Controls not listed here depend on policies, people and internal systems, so they need evidence from inside the organisation. Each finding links to its full explanation.
The mapping comes from the scoring engine and is being extended. In a few places it names the milder form of a finding and not the more serious one, for example 50 or more subdomains but not 100 or more.
Article 21(2)(e)
Security in network and information systems acquisition, development, and maintenance
Vulnerability handling and secure development show up externally as missing baseline security headers and HSTS.
Findings that count against it
Article 21(2)(g)
Basic cyber hygiene practices and cybersecurity training
Basic cyber hygiene is observable in email authentication and web security baseline configuration.
Findings that count against it
Article 21(2)(h)
Policies and procedures regarding cryptography and encryption
Cryptography policy compliance requires HTTPS with a valid trusted certificate and modern TLS.
Findings that count against it
Article 21(2)(j)
Use of multi-factor authentication and secure communications
Secure communications baseline requires forced HTTPS for any user-facing service.
Findings that count against it