NIS2 on Azure
Azure NIS2 compliance, mapped to Article 21 with audit-ready evidence
Microsoft tells you what is misconfigured. NIS2 asks you what it means for Article 21, who owns it, and what evidence you can show an auditor. Cloudivence, formerly Governator, is the layer between the two.
What NIS2 actually requires from your Azure environment
The NIS2 Directive (EU 2022/2555) became enforceable in Belgium on 18 October 2024. For organisations that operate cloud infrastructure, the operative text is Article 21, which lists ten technical and organisational measures every essential or important entity must implement and document. There is no Annex with a checklist. The measures are framed as outcomes, and the burden of proof sits with you.
On Microsoft Azure, the underlying controls usually exist somewhere: Defender for Cloud, Azure Policy, Conditional Access, Key Vault, Sentinel, Azure Backup. What does not exist out of the box is the mapping layer between those technical controls and the Article 21 measures, the ownership trail, and the audit evidence pack a regulator can read in five minutes.
Cloudivence is built for that gap. It reads findings and configuration from your Azure environment, relates them to the Article 21 measures, lets you give each finding an owner and track the fix, and produces an Excel evidence pack when you need one.
How Cloudivence relates Azure to NIS2 Article 21
Each Article 21 measure calls for its own Azure evidence. The table shows what a measure calls for, and what Cloudivence reads for it today each time an assessment runs. Several measures also need evidence from outside Azure, which is attested.
| Reference | Measure | Azure evidence the measure calls for | What Cloudivence reads today |
|---|---|---|---|
| Article 21(2)(a) | Risk analysis & information system security policies | Azure Policy assignments, Defender for Cloud regulatory compliance dashboard, exemption registry with business justification. | Defender recommendations on security policy and posture, the secure score, and who holds the Security Admin and Security Reader roles. |
| Article 21(2)(b) | Incident handling | Sentinel incidents, Defender alert workflow, runbook attestation, post-incident review evidence. | Defender recommendations on logging and alerting, and monitoring role assignments. Incident records themselves are not read. |
| Article 21(2)(c) | Business continuity & crisis management | Azure Backup vault policies, Azure Site Recovery configuration, geo-redundant storage, tested DR runbook attestation. | Defender recovery recommendations, Key Vault soft delete, purge protection and retention, and backup protection per resource. |
| Article 21(2)(d) | Supply chain security | Service principal inventory, third-party RBAC assignments, federated identity audit, partner Lighthouse delegation review. | Defender recommendations on external accounts, foreign principals with privileged roles, and service principals with Owner or Contributor. |
| Article 21(2)(e) | Acquisition, development, and maintenance security | AVM module versions, pipeline secret scanning, Defender for DevOps findings, IaC review evidence. | Defender recommendations on secure configuration, and storage settings such as minimum TLS, HTTPS only and public access. |
| Article 21(2)(f) | Effectiveness of cybersecurity risk-management measures | Secure Score trend, control effectiveness metrics, exemption decay rate, MTTR per finding category. | The secure score and the trend of open findings. There are no dedicated checks for this measure. |
| Article 21(2)(g) | Cyber hygiene & training | Conditional Access posture, MFA coverage, Privileged Identity Management activations, training attestation register. | Accounts disabled in Entra ID that still hold roles, and tag compliance. Training is attested by a person. |
| Article 21(2)(h) | Cryptography | Key Vault inventory, TLS minimum-version policy, customer-managed key (CMK) coverage, certificate expiry monitoring. | Defender encryption recommendations, storage TLS and HTTPS settings, and the Key Vault access model. |
| Article 21(2)(i) | Human resources, access control, asset management | RBAC role assignments, joiner-mover-leaver process evidence, service principal lifecycle, just-in-time access logs. | Defender access recommendations, the number of subscription owners, and group based against direct role assignments. |
| Article 21(2)(j) | Multi-factor authentication & secured communications | Entra Conditional Access reports, MFA registration coverage, Private Link & private endpoint inventory, public exposure analysis. | Users holding privileged roles directly, and Defender security contact and alert notification settings. MFA itself is not read, because Conditional Access is not collected. |
The Belgian NIS2 timeline
Belgium implemented NIS2 through the law of 26 April 2024, with the CCB (Centre for Cybersecurity Belgium) as the supervisory authority. The CCB has aligned NIS2 enforcement with the CyberFundamentals framework: organisations demonstrate Article 21 compliance by reaching the appropriate CyFun assurance level (Basic, Important, or Essential).
- Registration deadline: 18 March 2025 (passed). All in-scope entities must be registered with the CCB.
- CyFun self-assessment due: 18 April 2026 (passed). Most "important" entities are working toward CyFun Important; "essential" entities need CyFun Essential.
- Reclassification: Critical entities become essential entities on 17 July 2026.
- Progress report due: 18 April 2027.
If you operate on Azure and your CyFun self-assessment is on the calendar, matching Defender findings, policy compliance and role assignments to the CyFun control set is what Cloudivence does. See the dedicated CyFun on Azure page for the assurance-level mapping.
What Microsoft gives you, and what Microsoft does not
Microsoft gives you
- ✓Defender for Cloud regulatory compliance dashboard with NIS2 initiative
- ✓Secure Score and recommendation engine
- ✓Azure Policy compliance state per assignment
- ✓Sentinel for incident logging and detection
- ✓Activity Log with 90-day retention per resource
Microsoft does not give you
- ✓Per-finding mapping to Article 21 measures (a)–(j)
- ✓An owner and a due date per finding, and its age against a target per severity
- ✓Attestations, control exceptions with expiry dates, and evidence links per control
- ✓CyFun assurance-level export with control-evidence matrix
- ✓An assurance view of readiness blockers and deadlines
Defender's NIS2 view tells you which Azure controls are technically configured. It does not tell you what the gap means for your Article 21 obligation, who owns the remediation, or what your auditor will accept as proof. That is the layer Cloudivence provides.
Where to start
Most organisations start with a NIS2 readiness assessment: a one-time engagement in which GenioCT uses Cloudivence to produce a point-in-time picture with expert interpretation, identify the highest-risk gaps and scope the roadmap. With the assessment behind them, organisations can continue with Cloudivence in an assisted pilot on their own Azure subscriptions.
Related
Start with an Azure Health Check
Not sure where to begin? A quick architecture review gives you a clear picture. No obligation.
- ✓ Risk scorecard across identity, network, governance, and security
- ✓ Top 10 issues ranked by impact and effort
- ✓ 30-60-90 day roadmap with quick wins