NIS2 compliance Microsoft 365
NIS2 gives you 24 hours. Could you say what happened in 10 minutes?
NIS2 sets the clocks: an early warning in 24 hours, a notification with indicators of compromise in 72, a final report in a month, and management personally liable for the measures behind them. 1Security turns the detection into the record and generates all three documents from it, with the deadlines computed. Article 21 is measured live from the tenant, on the licences you already own.
- 24 hearly warning - whether a malicious act is suspected, whether the impact may be cross-border
- 72 hincident notification - initial severity and impact, the indicators of compromise known so far
- 1 monthfinal report - detailed description, root cause, applied and ongoing mitigation
- 10 minutesto know what happened: detector, actor, device, country, data touched, actions taken - from one drawer
The scenario
The 24 hours start when you become aware. Most of them go on finding out what happened.
NIS2 (EU 2022/2555) covers essential and important entities across 18 sectors, with fines up to 10 million euro or 2 percent of worldwide turnover and management bodies that can be held personally liable. On the day, nobody asks for a policy. The authority wants four answers: what happened, who was affected, is it still happening, what have you done, and it wants the first version within 24 hours.
That is where the clock is lost. The sign-in sits in one console, the file activity in another, the device in a third, and the history that explains the first move is gone. A team spends the first day stitching exports into a timeline, and the early warning goes out with “under investigation” where the facts should be.
In 1Security the moment you become aware already has a record: one timeline across identities, files, links, devices, locations, apps and agents, with up to three years of history on a standard licence. The early warning, the notification and the final report are generated from that same detection, the Article 23 deadlines are computed from when you knew, and Article 21 is measured rather than asserted. Six silos, one timeline, nobody on your side a specialist.
The walkthrough
From the detection to the authority, on screens.
Each beat is a screen with a button and an artifact at the end, not a workshop. Run it as a drill first.
- 01
The clock starts with a detection
On Anomalies a detector fires - a download spike against the account's own 30-day baseline, a high-risk sign-in, a prompt injection attempt, active access from a country your location list does not name. It opens as an episode with an effective severity: escalated by an extreme score, lifted when a second detector holds an open episode on the same entity, replaced by your verdict. The queue puts correlated entities first, so the row to open is at the top.
- 02
Know what happened in one drawer
The drawer answers the authority's first questions: the detector and the entity, the baseline against what was observed, the activity in the incident window with each event attributed to actor, resource, application, device and location, and the IP addresses, network providers and countries that become the indicators of compromise. Locations says whether the place is a home network, a VPN, Tor or a datacenter and whether a cross-border impact is plausible; the travel trail marks an impossible hop as such.
- 03
Contain it and leave a record
Respond offers curated containment for the entity - disable the account, revoke the grants, quarantine the agent - running through the Action Center with who requested it, when it ran, whether Microsoft confirmed it and the revert that undoes it. Every status change, severity verdict, requested action and comment lands on History & Comments as it happens: the incident-handling record Article 21(2)(b) expects, written by the work itself.
- 04
Generate the early warning, then the notification, then the final report
Report in the drawer opens the report builder on that one detection. Three templates follow Article 23(4) point by point: the NIS2 early warning, the NIS2 incident notification and the NIS2 final report. The drawer's tabs become sections, you write what no system can know - description, impact, root cause, mitigation, the significance and cross-border assessment, printed as Yes, No or Not established - and download PDF, PowerPoint, HTML, CSV or JSON in seven languages. The Reporting obligation section computes the three deadlines from when you became aware and marks each one On time or After the deadline, reading the earlier reports back from History & Comments.
- 05
Show when you knew
Alerting keeps a notification log of decisions, not just of mail: every alert sent, every one withheld with the exact reason, every failure, kept as long as your activity history, up to three years. Severity on each row is explainable - the detector's level, the lift from the score, the lift from correlated detections, the manual verdict and who made it. When the authority asks when you knew, there is a timestamp.
- 06
Prove Article 21 with a dated pack
Compliance scores the tenant against NIS2 article by article - measured statuses for log retention, access control, dormant accounts, device compliance, Conditional Access coverage and the supply-chain inventories of apps, agents and external domains; attested statuses for the four documents. Where you know the whole picture differs, record your own assessment with a note and the measured status stays beside it. The status is captured every Monday and on demand, and the per-framework evidence pack exports as a dated document, also over the read-only REST API.
What it takes
Business Premium is enough. No agents, no migration, no E5 to start.
Every NIS2 measure 1Security checks runs on a standard Microsoft 365 licence, Business Premium or Microsoft 365 E3, through a read-only consent given in the first meeting. There is nothing to install and nothing to migrate: it reads the tenant you already run, beside Entra, Purview, Defender and your SIEM, and answers the questions that sit between them.
Activity history is kept for up to three years in the licence price, on any tier, so the early warning, the incident timeline and the auditor’s evidence have the record behind them without a retention add-on.
It is also the cheaper route to compliance. Most organisations buy their way to the NIS2 measures with the top Microsoft tier. With 1Security on the standard tier they get there for about a quarter less, with more of the work done, on a licence they already pay for.
- Business Premium is enough
- No E5 requirement
- Read-only consent
- 3 years of logs in the price
- About 25% less than the licence route
- Our cloud, your cloud, on premise
The building blocks
One read-only connection. Every NIS2 measure on one screen.
Access control, incident handling, logging, supply chain, AI oversight: each block below is a screen that answers one of the questions the directive and the auditor ask, from the same connection.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
Measured against the old way
What changes on the day of the audit and the day of the incident.
The same team, the same tenant, a different week: evidence comes from the map instead of a spreadsheet, and the incident story is one history instead of a dozen queries.
- Business Premiumenough for every measure we check
- 3 yearsof logs and evidence kept, on any licence
- Same dayfirst NIS2 readiness picture after the read-only connection
- 10 minutesto know what happened, from one drawer
Numbers in the panel are measured with existing customers; your tenant will differ. The first readiness snapshot is the one to compare against.
The tools you already have
Whatever you already run for NIS2, 1Security makes it worth more.
1Security produces the one thing no Microsoft 365 tool holds: the join across identities, files, sharing, devices, locations, logs and agents. It hands that join to the tools you already pay for and reads what they produce. The more you have, the more there is to join, and nothing is replaced.
- Microsoft PurviewLabels get coverage numbers, with our own classifier as a second opinion.
- Microsoft 365 CopilotWhat Copilot will see, measured before the rollout and watched after.
- Microsoft Agent 365Every agent with its owner, its reach and the data it may touch.
- Copilot AutopilotWhich permissions an autonomous Copilot inherits, and from whom.
- Copilot StudioCustom agents inventoried with their connectors and reach.
- Azure AI FoundryModels and agents built on Foundry, mapped to the tenant data they reach.
- Microsoft Entra SuitePolicy coverage measured against observed sign-ins, not configured ones.
- Entra ID GovernanceAccess reviews fed with what each identity actually reaches and uses.
- Microsoft Defender XDRAlerts arrive with access and sharing context from the permission graph.
- Defender for Cloud AppsApp consent and reach joined with the files each app can read.
- Microsoft SentinelDetections, locations and access changes as a feed, ready for playbooks.
- Microsoft IntuneDevices seen in activity but missing from enrolment, attributed to users.
- SplunkThe same feed into Splunk: logs, detections, users, files, reports.
- SailPointEntitlements enriched with real usage and reach from the tenant.
- One Identity Active RolesDirectory changes reconciled with who can reach what today.
- CyberArkPrivileged accounts seen with their real blast radius in Microsoft 365.
- VeeamBackups paired with knowing what was exposed before the restore.
- All pairingsEvery tool 1Security pairs with, in one list
Each pairing has its own page you can send to the team that owns that tool.
What makes it work
Six parts of the platform behind the NIS2 answer.
One incident object runs through all of them, and the same 15 requirements score GDPR, DORA, ISO/IEC 27001 and the EU AI Act in the same pass - one fix moves every framework that cites it.
Anomaly detection
Every account, app and AI agent measured against its own 30-day baseline, incidents that alert on one occurrence, severity earned from score and correlation, episodes with History & Comments.
Explore the feature →Alerting
Instant alerts, digests and overrides down to one person, with a notification log of every decision - sent, withheld and why, failed - kept up to three years.
Explore the feature →Locations
Every sign-in and action resolved to a country, city and network, an allow or block list that opens an incident on unlisted active access, and travel trails with impossible-travel verdicts.
Explore the feature →Reports
The NIS2 early warning, notification and final report generated from the detection, in five formats and seven languages, with the deadlines computed - also over REST and MCP.
Explore the feature →Compliance monitoring
Eleven frameworks measured continuously from tenant data, with own assessments, Monday snapshots, a worklist and a per-framework evidence pack.
Explore the feature →Audit and evidence
Up to three years of unified activity history with per-actor attribution on standard licenses - the record under every indicator of compromise and every timeline.
Explore the feature →
Microsoft Innovation Alley
Recommended by Microsoft’s own innovation programme.
Microsoft’s Innovation Alley partners with 1Security and recommends it to the ecosystem, which answers the question a NIS2 project raises first: whether a vendor can be trusted read-only inside the tenant that holds the evidence.
Bring it to the steering meeting. It answers the trust question before it is asked.
FAQ
Common questions.
Are we even in scope for NIS2?
Scope covers essential and important entities across 18 sectors, generally from 50 employees or 10 million euro turnover, with national transpositions deciding the edges. That call belongs to your counsel. The practical point: the measures NIS2 asks for are the ones a well-run tenant needs anyway, so measuring readiness costs you nothing even if the scoping answer turns out to be no.
Does the report decide whether the incident is significant?
No. Significance under Article 23(3), which national authority receives the report and how your sector transposition applies are calls for your counsel. The templates carry the facts the drawer holds and print every assessment you have not made as Not established rather than guessing, so counsel works from a measured, dated record instead of a questionnaire.
How do the deadlines get computed?
From the moment you became aware - the detection's first-seen time unless you set it. The early warning is due 24 hours later, the notification 72 hours later, the final report one month after the notification was generated. Each generated report is an event on History & Comments, and the next report's timeline reads those events to say On time or After the deadline. Nothing about the deadlines is typed.
Can our SOC pull the notification document?
Yes. The same incident templates render over the read-only REST API and the MCP tools by detection id, in PDF, PowerPoint, HTML, CSV or JSON and in seven languages, so a SOC platform working the detection can pull the early warning straight from it. The detections themselves, the notification log and the compliance status are on the same API.
Do we need E5 licenses for this?
No. The detections, the retained history, the incident reports and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
What about systems outside Microsoft 365?
We measure the Microsoft 365 side: identities, files, mail, apps, agents, devices, locations and the audit trail around them. For most office-work organisations that is where the majority of NIS2-relevant evidence lives, but OT networks and on-premises systems need their own evidence sources. The evidence pack and the incident report are honest about what they cover.
How fast do we get the first readiness picture?
The same day the tenant is connected read-only. Readiness is computed from data the platform collects on its own, with deliberately conservative statuses - not evaluated never counts as a pass - so the first picture is one you can already show internally, and weekly snapshots start accumulating from there. Detections start as soon as the activity history is in.
The 1Security platform
NIS2 Compliance is just the beginning
NIS2 Compliance is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Run the 72-hour drill before an incident runs it for you.
Connect read-only and the first detection's drawer, its report and the NIS2 requirement statuses land the same day - open one anomaly, contain it, generate the early warning and the notification, and time it.
Or find out what happened the hard way, with the clock already running.