Skip to content
Create a free account
Resources›NIS2 and CIS18

What Ejerblik covers in
NIS2 and CIS18

A control-by-control mapping. What we document, what we support, and what sits outside the product. Written so that an adviser can assess us without having to ask first.

The short answer

Ejerblik does not make you NIS2 compliant

Ejerblik provides the inventory of software, user accounts, access and suppliers that CIS18 controls 2, 5, 6 and 15 are built on, and that NIS2 Article 21 assumes under asset management, access control and supply chain security. That is the foundation beneath the requirements. The security work itself sits with your IT partner.

We could write that you meet the documentation requirements because your assets are in Ejerblik. It would not be true, and it would not hold up in front of an accountant, an insurer or the IT adviser your customer is going to ask anyway.

So it is set out control by control instead. The two matrices below are our own assessment of what the platform actually contains, held up against CIS Controls version 8.1 and NIS2 Article 21(2).

The division of work

Three layers, three owners

The inventory and the security work are two different jobs. Ejerblik handles the first. Your IT partner handles the third. The assessment in between, you do together.

Ejerblik
The inventory

Which systems you have, who owns them, who has access, which supplier is behind them, and when the agreement renews. It is a data problem, and without that layer none of the others can be documented.

Together
The assessment

What is critical, what an outage costs, what you act on first. Ejerblik gives you the structure through eleven ready-made reviews, among them an IT risk assessment built on the NIS2 method. The adviser brings the expertise, and management approves. Management approval is a requirement in its own right under NIS2.

Your IT partner
The security work

Updates, backup, logging, monitoring, contingency planning and the technical implementation of the controls. Ejerblik documents that two-factor authentication is switched on. Ejerblik does not switch it on.

Mapping 1 of 2

CIS Controls version 8.1

CIS18 is a voluntary framework, not a legal requirement, but it is widely used as the practical route to meeting the technical requirements in NIS2. Controls 2, 5 and 6 all sit in Implementation Group 1, the most basic measures, described as essential cyber hygiene. That is the starting line, and it is where most owner-managed companies stand today.

4
Provides
4
Supports
10
Out of scope
Control 01
Hardware and devices
The data model holds software and accounts, not computers, servers and network equipment. The topic is asked about in the IT risk assessment, but it is not captured as an asset.
Out of scope
Control 02
Inventory of software
The core of the asset register: name, category, platform, supplier, owner, person responsible, renewal date, notice period and cost per system.
Provides
Control 03
Data protection
Risk level per asset and a full GDPR review. There is no actual data classification on the individual asset.
Supports
Control 04
Secure configuration
Technical hardening of systems and devices.
Out of scope
Control 05
Account management
The employee register links people to accounts per asset, with role, access expiry and active status. When someone leaves, all access is closed in one go.
Provides
Control 06
Access control management
Access type, login method, documented login, administrator access and two-factor authentication status per asset. The documentation, not the enforcement.
Provides
Control 07
Vulnerability management
Scanning for vulnerabilities and carrying out updates.
Out of scope
Control 08
Log management
Ejerblik keeps a log of actions in the platform, but it is not a log management tool for your own systems.
Out of scope
Control 09
Email and browser
Technical filtering and protection.
Out of scope
Control 10
Malware defences
Protection of the individual device.
Out of scope
Control 11
Data recovery
Backup and recovery are asked about in several reviews, but they are not captured as a field on the asset.
Supports
Control 12
Network infrastructure
Running the network.
Out of scope
Control 13
Network monitoring
Monitoring and detection.
Out of scope
Control 14
Awareness and training
The reviews ask whether employees have been briefed on phishing within the past year. Ejerblik does not provide the training itself.
Supports
Control 15
Supplier management
Supplier, renewal, notice period and cost per asset give you the supplier inventory the control is built on.
Provides
Control 16
Application software security
Relevant for companies that develop software themselves.
Out of scope
Control 17
Incident response management
Contingency procedures are asked about. There is no field for who to contact when the individual asset goes down.
Supports
Control 18
Penetration testing
An external testing service.
Out of scope

Provides means that Ejerblik holds the documentation itself as structured data. Supports means that the topic is asked about in one of the platform reviews, but is not captured as a field on the asset. Out of scope means that the control is a technical measure or an operational task that belongs with the IT partner. Read more about CIS18 →

Mapping 2 of 2

NIS2, Article 21(2)

The ten risk management measures a covered entity has to have in place. On top of those come Article 20 on management approval and liability, and Article 23 on reporting within 24 and 72 hours of a significant incident. Neither of the last two is covered by Ejerblik.

2
Provides
4
Supports
4
Out of scope
Point (a)
Risk analysis and information system security policies
The IT risk assessment follows the NIS2 method, with the four asset categories and a closing section on impact, prioritisation and management approval. Ejerblik provides the structure, not the policy.
Supports
Point (b)
Incident handling
There is no incident logging and no escalation path in Ejerblik today.
Out of scope
Point (c)
Business continuity, backup and crisis management
The topic is covered as questions in the reviews, but there are no fields for criticality, maximum tolerable downtime or recovery time.
Out of scope
Point (d)
Supply chain security
Supplier per asset with contract data and risk level. That is the inventory a company has to be able to produce when a larger business partner sends over its vendor questionnaire.
Provides
Point (e)
Security in acquisition, development and maintenance
Including the handling of vulnerabilities.
Out of scope
Point (f)
Assessing the effectiveness of the measures
Repeated reviews with a history give you a measurable before and after. That is a method, not a policy.
Supports
Point (g)
Cyber hygiene and training
Covered as questions across the reviews.
Supports
Point (h)
Cryptography and encryption
A technical measure.
Out of scope
Point (i)
Human resources security, access control and asset management
The closest overlap in the whole directive. Asset management is the core of Ejerblik, and the employee register covers the personnel side.
Provides
Point (j)
Multi-factor authentication and secured communications
Two-factor authentication status is documented per asset, so the gaps become visible. Ejerblik neither enables nor enforces it, and secured communications sit entirely outside the product.
Supports

Very few owner-managed companies are directly covered by NIS2 themselves. The requirement reaches them through the supply chain, because point (d) obliges the covered companies to manage security at their suppliers. Read more about NIS2 →

What Ejerblik is not

  • Ejerblik is not a security tool. We do not scan for vulnerabilities, we do not monitor your network, and we do not enable two-factor authentication for you.
  • Ejerblik does not keep track of your computers, phones and network equipment. We cover software, accounts, access and suppliers.
  • Ejerblik is not a statement of legal compliance. An inventory is a precondition for being able to document, not proof that the requirements are met.
  • Ejerblik does not replace an IT supplier or a security adviser. The platform is built to work alongside them.
About this mapping

The assessments are based on the Ejerblik data model and review templates, held up against CIS Controls version 8.1 and NIS2 Articles 20, 21 and 23. They are our own, and they have not been confirmed by an external auditor or a certification body. This page is not legal advice, and it does not constitute a statement that a company complies with NIS2.

We update the mapping when the platform changes and when the frameworks change. If you disagree with an assessment, we would like to hear from you on the contact page.

Last reviewed 31 August 2026