// IMMO.QUICK · GATENIS2 · RL (EU) 2022/2555

24 hours, no excuse.

gateNIS2 forensically seals that a CRITIS incident passes six clusters, risk management, early warning, notification, supply chain security, board accountability, and subcontractor due diligence, before the reporting deadline lapses. Support for essential and important entities, never a replacement for the BSI's own recognition.

Request Access → See the architecture

In one sentence: gateNIS2 starts the twenty-four-hour clock for the early warning the moment an incident is classified, and seals every further reporting step seamlessly.

✓ RELEVANT IF...

You operate as an essential or important entity under NIS2 in a CRITIS sector
You need to prove the 24-hour early warning and 72-hour notification were made on time

✕ NOT RELEVANT IF...

You expect the BSI to automatically recognise the result as complete notification
No essential or important entity or CRITIS incident is involved

// The problem

The reporting clock starts once the incident is detected, not once the crisis meeting ends.

NIS2 requires an early warning within 24 hours and a full notification within 72 hours. gateNIS2 seals the moment of detection and calculates both deadlines deterministically.

// Architecture

6 clusters, checked sequentially.

Every cluster is dispositive (material_block_mode: true), a hit blocks bindingly, not merely for documentation.

CLUSTER 1

Risk Management

Checks documented technical and organisational measures under NIS2 Art. 21(1).

risk_management_documented

CLUSTER 2

Early Warning

Checks the 24-hour early warning notification under NIS2 Art. 23(4).

early_warning_within_24h

CLUSTER 3

Notification

Checks the complete 72-hour notification and the one-month final report.

notification_within_72h · final_report_1month

CLUSTER 4

Supply Chain Security

Checks supply-chain risk assessment and vulnerability disclosure under Art. 21(2)(d).

supply_chain_risk_assessed

CLUSTER 5

Board Accountability

Checks personal training of the management body under NIS2 Art. 20.

board_training_confirmed

CLUSTER 6

Subcontractor Due Diligence

Checks due diligence of subcontractors under Art. 21(2)(e).

subcontractor_dd_completed

// Test results

Two tested scenarios.

All values on this page are fictional test data and serve only to illustrate the gate logic.

Scenario	C1	C2	C3	C4	C5	C6	Verdict	Latency
CRITIS incident, early warning within 6h, notification within 48h, board training documented	PASS	PASS	PASS	PASS	PASS	PASS	NIS2_SEALED	418ms
Early warning reported only after 30 hours	PASS	FAIL	not evaluated	not evaluated	not evaluated	not evaluated	BLOCK_N2_EARLY_WARNING_24H_MISSING	371ms

// Clarification

What gateNIS2 is not.

Not automatic recognition by the BSI. The gate delivers a cryptographic proof, not regulatory confirmation of completeness.
Not an independent incident-response system. The gate seals the deadline and notification logic, it does not replace an existing SOC.

24 hours, no excuse.

The reporting clock starts once the incident is detected, not once the crisis meeting ends.

6 clusters, checked sequentially.

Two tested scenarios.

What gateNIS2 is not.

For essential and important entities that want to make NIS2 reporting deadlines provable.