NIS2 compliance with open source. No licences, no lock-in
NIS2 compliance with open source.
No licences, no lock-in.
The NIS2 Directive (EU 2022/2555) raises the bar for cybersecurity across critical sectors. Tools like Wazuh, Ansible and OpenVAS cover most of Article 21's technical requirements — for free. This guide explains what they cover, what they don't, and what the organisational gap looks like.
NIS2 is not optional for EU essential and important entities — or for their technology suppliers. Fines reach €10 million or 2% of global turnover. The directive mandates risk management, incident reporting, supply chain security and board-level accountability. And yet many organisations are paying six-figure licence fees for tools that open source alternatives replicate at zero cost.
At SIXE we deploy Wazuh, Ansible, OpenVAS and Keycloak in production environments for clients that operate in NIS2-regulated sectors. This guide is a distillation of what we've learned: which controls open source tools genuinely cover, which they don't, and what separates an organisation that passes an audit from one that installs the same tools and fails.
Does NIS2 apply to your organisation?
NIS2 applies to essential entities (energy, transport, banking, health, water, digital infrastructure, public administration, space) and important entities (manufacturing, food, postal and courier services, waste management, chemical production, digital providers). If you supply technology or services to any of these sectors, supply chain security provisions under Article 21.2.d may pull you into scope.
NIS2 entity calculator
Three questions to identify your category and the technical priorities that follow:
This result is indicative. Your exact classification under NIS2 depends on your national transposition law and, in some cases, explicit designation by your national competent authority. Check ENISA's NIS2 guidance and your national authority's register.
Which NIS2 Article 21 measures does each tool address?
Select a tool to see its NIS2 coverage and which specific Article 21 measures it supports. The percentage reflects its share of Article 21's technical controls — not total compliance, which always includes an organisational layer no tool replaces.
No single tool — open source or commercial — covers 100% of NIS2's Article 21 measures. The technical stack is necessary but not sufficient. Risk management policy, incident response procedures, supply chain contracts and board accountability are organisational — no product delivers them.
Installing tools is not being NIS2-compliant
This is the mistake most organisations make, and it's the most expensive. Arriving at an audit with Wazuh freshly deployed but without a documented risk management process, an incident response plan or board-level security governance means the tools won't save you.
Open source covers the technical what. NIS2 also demands the organisational how:
- Risk management policy — formal, reviewed annually, approved by senior management
- Incident response procedure — who gets the alert, how it's triaged, how the 24h/72h/1-month reporting timeline is met
- Supply chain security — contractual security requirements for all technology suppliers (Article 21.2.d)
- Board accountability — Article 20 makes senior management personally liable for NIS2 compliance failures
- Business continuity plan — with tested, documented recovery, not assumed recovery
- Staff security training — with attendance records. Our LPIC-1 and LPIC-2 courses cover the Linux administration competencies auditors expect from teams operating the security stack
Certification or self-assessment is only the first milestone. NIS2 is a continuous management system: regular risk reviews, incident register updates, supply chain re-assessments, tool tuning. If your tools aren't generating evidence someone is actively reading and acting on, they're a camera with the screen off.
How ready are you, honestly?
Tick only what you have operational and documented — not what's in progress or planned:
Linux is the foundation of your NIS2 stack. Master it.
Wazuh runs on Linux. OpenVAS runs on Linux. Ansible manages Linux servers. Keycloak deploys on Linux. The entire open source security stack sits on Linux — and a poorly administered OS invalidates every tool running on top of it.
At SIXE we offer two services that map directly onto NIS2 requirements:
- Debian support — proactive maintenance, security patch application, CIS hardening and change documentation. Everything NIS2 requires for OS lifecycle management and evidence of patch cadence.
- LPIC-1 and LPIC-2 training — internationally recognised Linux certification covering administration, security, networking and automation. Auditors expect the team operating the security stack to hold demonstrable, accredited competencies. Credly badges serve as evidence.
For automated hardening: our Ansible deployment service applies CIS security profiles across your entire fleet, generates compliance evidence and leaves the configuration as versioned code in Git — precisely what an auditor wants to see for systematic risk management.
The essentials, for those short on time
→ Wazuh covers the operational framework: log management, intrusion detection, FIM, vulnerability scanning.
→ Ansible + OpenSCAP automates hardening and makes it reproducible and audit-ready.
→ OpenVAS/GVM handles vulnerability management with scheduled, traceable scans.
→ Keycloak centralises identity and enforces MFA for privileged and remote access.
→ BorgBackup + LUKS covers business continuity and encryption at rest.
→ All of this without a risk management policy, incident response plan and governance framework: it won't pass an audit.
Frequently asked questions about NIS2 and open source
NIS2 (Directive EU 2022/2555) is the EU's updated network and information security framework. It mandates risk management, incident reporting and supply chain security for essential and important entities. Penalties reach €10 million or 2% of global turnover for essential entities.
Yes. NIS2 mandates outcomes, not specific products. Wazuh, Ansible, OpenVAS, Keycloak and pfSense collectively cover the vast majority of Article 21's technical measures — at zero licence cost.
No. Wazuh addresses a significant portion of the operational framework — log management, intrusion detection, FIM and vulnerability detection. But NIS2 also requires IAM, encrypted backups, network segmentation, documented risk management and board-level accountability that no single tool provides.
Both share the same Article 21 technical obligations. Essential entities face proactive supervision and fines up to €10M or 2% of global turnover. Important entities face reactive supervision and fines up to €7M or 1.4% of global turnover.
With a basic security baseline already in place, 4–6 months is realistic for important entities. Essential entities typically need 8–14 months. Technical deployment is the shorter phase — tuning tools, producing documentation and embedding governance processes take the most time.
Three stages: early warning within 24 hours, full notification within 72 hours, final report within one month. Wazuh provides the detection and logging capabilities to support this, but the reporting itself is an organisational process.
Regulation and resources cited
Directive (EU) 2022/2555 (NIS2). EUR-Lex
ENISA — NIS2 implementation guidance. enisa.europa.eu
Wazuh — Ensuring NIS2 compliance. wazuh.com
Greenbone — GVM Community Edition. greenbone.net
ISO/IEC 27001:2022 — information security management. iso.org
Wazuh — official documentation. documentation.wazuh.com
Published: · Last updated:
We've been deploying open source NIS2 stacks in production
Tell us your NIS2 category, what you have in place, and where your gaps are. We'll come back with an architecture sketch and concrete next steps.
