The NIS2 Directive and Slovak Act No. 69/2018 on cybersecurity, as amended, require operators of essential services to implement security measures, report incidents on time and demonstrate compliance in an audit. GRIS keeps this entire agenda in one place, the Compliance module – measures, deadlines, evidence and reports – and draws on the IT asset data you already maintain in the system.
Category, sector, notification and registration dates with the NBÚ (Slovak National Security Authority), and your cybersecurity manager.
Set the status of each of the 151 measures and record the reason for any that do not apply.
An owner, a due date and evidence for every measure, with progress by domain.
An incident register with tracked deadlines and the data needed for each report.
Evidence, change history and documentation ready for the auditor and management.
Entity profile (PZS or PKZS, sector under the Act) and the deadlines GRIS tracks for you: notification to the NBÚ within 60 days, measures within 12 months of registration, audit within 2 years and, for PZS, self-assessment.
All 151 security measures from Annex 1 of NBÚ Decree No. 227/2025, with relevance for PZS and PKZS, ICT and OT. The gap analysis shows what is met, partially met or not met; measures that do not apply are excluded with a justification. Each measure has an owner and a due date, and you follow progress by domain. The catalogue can be adapted to other national transpositions.
Attach a file with its SHA-256 fingerprint, a link to a device in the inventory or a URL. The change history shows who changed what and when. The “NIS2 Readiness” PDF summarises the status for the management body.
A security incident register with a timeline and tracked deadlines: early warning within 24 hours, incident notification within 72 hours, final report within one month and, for a personal data breach, notification to the data protection authority within 72 hours. GRIS alerts you before a deadline and when one is missed. Data structured according to Decree No. 226/2025 is produced as a PDF or as text for the Slovak JISKB portal or the data protection authority. Incidents can be opened directly from the helpdesk, monitoring or syslog.
Devices, networks, credentials and passwords in the Secret module with an access audit. Every asset carries criticality, owner, data class and NIS2 scope.
Availability and ports under watch, central syslog with 12-month retention. Daily integrity seals make it possible to verify that the records have not been altered afterwards.
Backup status from NAKIVO and endpoint protection from ESET in one view. Restore tests are recorded with their result, and GRIS reminds you of the next one.
GRIS continuously checks antivirus, backups, patches, MFA and asset classification. Every month it produces an evidence PDF with a hash for the audit trail.
Import of vulnerability scanner results, remediation deadlines by severity and alerts for items past their deadline.
Policies, directives and continuity plans with versions, approvals, reviews and confirmed employee acknowledgement. Multi-factor sign-in (MFA): authenticator app (TOTP), FIDO2/WebAuthn security keys and passkeys (YubiKey, Windows Hello, Touch ID) and push approval on your phone with number matching; trusted devices and a sign-in audit. MFA is mandatory for access to IT documentation and passwords.
The VDA ISA catalogue (versions 6 and 2027) lives in the same module: information security, prototype protection and data protection controls are rated by maturity 0–5 against target level 3, with the scope set by assessment level AL1–AL3 and labels. One piece of evidence serves both a NIS2 measure and an ISA control, so a company under both regimes keeps a single record and prepares for the ENX audit provider.
Your company manages compliance itself on its own GRIS instance. Measures, evidence and reports are handled by your internal team or cybersecurity manager.
Your IT service provider manages compliance for several companies in GRIS, each kept separate. You see your own status, deadlines and documents in the client portal.
GRIS is software that helps you implement, evidence and maintain NIS2 compliance – it records measures, tracks deadlines, keeps evidence and prepares the data for incident reports. It does not replace legal advice or your cybersecurity manager.
Book a NIS2 consultationWe will show you the system using examples from your day-to-day work and propose a deployment tailored to your company’s needs.