NIS2 and DORA: what they ask, and where to start
Both frameworks require an organisation to know what it runs before requiring it to protect it. Most are still at that first step.
What the frameworks require
NIS2 is Directive (EU) 2022/2555; its Article 21 sets out the risk-management measures. DORA is Regulation (EU) 2022/2554, covering financial entities and their critical ICT providers. Different scopes, the same starting point.
Know the estate
You cannot set a control on something you have not recorded. The inventory is the precondition, not the paperwork.
Measure, do not assert
An auditor asks what a statement rests on. A dated measurement answers; a policy document does not.
Keep it current
A picture taken once a year describes a network that no longer exists.
What can be measured from an inventory
Eight controls, each shown next to the article it refers to, measured on the data already collected. What comes out is a work list, not a certificate.
The same engine is framed for DORA: a different regulatory context, not a second collection.
NIS2 · srv-erp-01
06/09 · 04:12
Supported operating system
Ubuntu 22.04 LTS · end of support 04/2027
compliant
Cleartext services
telnet listening — port 23, observed 06/09
critical
Service encryption
no check performed — run “Assess and check services”
not assessable
Software within lifecycle
2 packages past end of support
partial
No known vulnerabilities across 4 recognised packages of 380.
What an inventory cannot measure
Stated in its own section, because a report that stayed silent about it would walk you into an audit convinced you were covered.
Incidents
Detection, handling and reporting.
Supply chain
Suppliers and their own dependencies.
MFA and training
Authentication practice and staff awareness.
Resilience testing
Continuity exercises and recovery testing.
Censo does not make any organisation compliant. It measures what an inventory can measure, states what that is, and declares the rest.
Building the file
For the obligations an inventory cannot reach, the platform helps you assemble the evidence rather than pretending to measure it.
Self-assessment
Record your own answer on the controls that cannot be measured, with the reasoning attached.
Work plan
The non-compliant and not-assessable items become a list with owners, not a score.
Report and export
A printable report and a CSV export, dated, for the auditor and for your own records.
See your own NIS2 posture
Run the trial on one site: the controls are measured against your real inventory, and the ones that could not be assessed are named.