NIS2 compliance Microsoft 365

NIS2 gives you 24 hours. Could you say what happened in 10 minutes?

NIS2 sets the clocks: an early warning in 24 hours, a notification with indicators of compromise in 72, a final report in a month, and management personally liable for the measures behind them. 1Security turns the detection into the record and generates all three documents from it, with the deadlines computed. Article 21 is measured live from the tenant, on the licences you already own.

Book a demoLive demo
  • 24 h
    early warning - whether a malicious act is suspected, whether the impact may be cross-border
  • 72 h
    incident notification - initial severity and impact, the indicators of compromise known so far
  • 1 month
    final report - detailed description, root cause, applied and ongoing mitigation
  • 10 minutes
    to know what happened: detector, actor, device, country, data touched, actions taken - from one drawer

The scenario

The 24 hours start when you become aware. Most of them go on finding out what happened.

NIS2 (EU 2022/2555) covers essential and important entities across 18 sectors, with fines up to 10 million euro or 2 percent of worldwide turnover and management bodies that can be held personally liable. On the day, nobody asks for a policy. The authority wants four answers: what happened, who was affected, is it still happening, what have you done, and it wants the first version within 24 hours.

That is where the clock is lost. The sign-in sits in one console, the file activity in another, the device in a third, and the history that explains the first move is gone. A team spends the first day stitching exports into a timeline, and the early warning goes out with “under investigation” where the facts should be.

In 1Security the moment you become aware already has a record: one timeline across identities, files, links, devices, locations, apps and agents, with up to three years of history on a standard licence. The early warning, the notification and the final report are generated from that same detection, the Article 23 deadlines are computed from when you knew, and Article 21 is measured rather than asserted. Six silos, one timeline, nobody on your side a specialist.

The walkthrough

From the detection to the authority, on screens.

Each beat is a screen with a button and an artifact at the end, not a workshop. Run it as a drill first.

  1. 01

    The clock starts with a detection

    On Anomalies a detector fires - a download spike against the account's own 30-day baseline, a high-risk sign-in, a prompt injection attempt, active access from a country your location list does not name. It opens as an episode with an effective severity: escalated by an extreme score, lifted when a second detector holds an open episode on the same entity, replaced by your verdict. The queue puts correlated entities first, so the row to open is at the top.

  2. 02

    Know what happened in one drawer

    The drawer answers the authority's first questions: the detector and the entity, the baseline against what was observed, the activity in the incident window with each event attributed to actor, resource, application, device and location, and the IP addresses, network providers and countries that become the indicators of compromise. Locations says whether the place is a home network, a VPN, Tor or a datacenter and whether a cross-border impact is plausible; the travel trail marks an impossible hop as such.

  3. 03

    Contain it and leave a record

    Respond offers curated containment for the entity - disable the account, revoke the grants, quarantine the agent - running through the Action Center with who requested it, when it ran, whether Microsoft confirmed it and the revert that undoes it. Every status change, severity verdict, requested action and comment lands on History & Comments as it happens: the incident-handling record Article 21(2)(b) expects, written by the work itself.

  4. 04

    Generate the early warning, then the notification, then the final report

    Report in the drawer opens the report builder on that one detection. Three templates follow Article 23(4) point by point: the NIS2 early warning, the NIS2 incident notification and the NIS2 final report. The drawer's tabs become sections, you write what no system can know - description, impact, root cause, mitigation, the significance and cross-border assessment, printed as Yes, No or Not established - and download PDF, PowerPoint, HTML, CSV or JSON in seven languages. The Reporting obligation section computes the three deadlines from when you became aware and marks each one On time or After the deadline, reading the earlier reports back from History & Comments.

  5. 05

    Show when you knew

    Alerting keeps a notification log of decisions, not just of mail: every alert sent, every one withheld with the exact reason, every failure, kept as long as your activity history, up to three years. Severity on each row is explainable - the detector's level, the lift from the score, the lift from correlated detections, the manual verdict and who made it. When the authority asks when you knew, there is a timestamp.

  6. 06

    Prove Article 21 with a dated pack

    Compliance scores the tenant against NIS2 article by article - measured statuses for log retention, access control, dormant accounts, device compliance, Conditional Access coverage and the supply-chain inventories of apps, agents and external domains; attested statuses for the four documents. Where you know the whole picture differs, record your own assessment with a note and the measured status stays beside it. The status is captured every Monday and on demand, and the per-framework evidence pack exports as a dated document, also over the read-only REST API.

Соответствие требованиям: NIS2, DORA, GDPR, EU AI Act, SOC 2 и HIPAA как требования с живым статусом, подтверждения, датированные снимки и пакеты доказательств.

What it takes

Business Premium is enough. No agents, no migration, no E5 to start.

Every NIS2 measure 1Security checks runs on a standard Microsoft 365 licence, Business Premium or Microsoft 365 E3, through a read-only consent given in the first meeting. There is nothing to install and nothing to migrate: it reads the tenant you already run, beside Entra, Purview, Defender and your SIEM, and answers the questions that sit between them.

Activity history is kept for up to three years in the licence price, on any tier, so the early warning, the incident timeline and the auditor’s evidence have the record behind them without a retention add-on.

It is also the cheaper route to compliance. Most organisations buy their way to the NIS2 measures with the top Microsoft tier. With 1Security on the standard tier they get there for about a quarter less, with more of the work done, on a licence they already pay for.

  • Business Premium is enough
  • No E5 requirement
  • Read-only consent
  • 3 years of logs in the price
  • About 25% less than the licence route
  • Our cloud, your cloud, on premise

The building blocks

One read-only connection. Every NIS2 measure on one screen.

Access control, incident handling, logging, supply chain, AI oversight: each block below is a screen that answers one of the questions the directive and the auditor ask, from the same connection.

Местоположения

Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.

Местоположения: Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.
ПодробнееПолучить доступ

Measured against the old way

What changes on the day of the audit and the day of the incident.

The same team, the same tenant, a different week: evidence comes from the map instead of a spreadsheet, and the incident story is one history instead of a dozen queries.

  • Business Premium
    enough for every measure we check
  • 3 years
    of logs and evidence kept, on any licence
  • Same day
    first NIS2 readiness picture after the read-only connection
  • 10 minutes
    to know what happened, from one drawer

Numbers in the panel are measured with existing customers; your tenant will differ. The first readiness snapshot is the one to compare against.

The tools you already have

Whatever you already run for NIS2, 1Security makes it worth more.

1Security produces the one thing no Microsoft 365 tool holds: the join across identities, files, sharing, devices, locations, logs and agents. It hands that join to the tools you already pay for and reads what they produce. The more you have, the more there is to join, and nothing is replaced.

Each pairing has its own page you can send to the team that owns that tool.

What makes it work

Six parts of the platform behind the NIS2 answer.

One incident object runs through all of them, and the same 15 requirements score GDPR, DORA, ISO/IEC 27001 and the EU AI Act in the same pass - one fix moves every framework that cites it.

  • Anomaly detection

    Every account, app and AI agent measured against its own 30-day baseline, incidents that alert on one occurrence, severity earned from score and correlation, episodes with History & Comments.

    Explore the feature →

  • Alerting

    Instant alerts, digests and overrides down to one person, with a notification log of every decision - sent, withheld and why, failed - kept up to three years.

    Explore the feature →

  • Locations

    Every sign-in and action resolved to a country, city and network, an allow or block list that opens an incident on unlisted active access, and travel trails with impossible-travel verdicts.

    Explore the feature →

  • Reports

    The NIS2 early warning, notification and final report generated from the detection, in five formats and seven languages, with the deadlines computed - also over REST and MCP.

    Explore the feature →

  • Compliance monitoring

    Eleven frameworks measured continuously from tenant data, with own assessments, Monday snapshots, a worklist and a per-framework evidence pack.

    Explore the feature →

  • Audit and evidence

    Up to three years of unified activity history with per-actor attribution on standard licenses - the record under every indicator of compromise and every timeline.

    Explore the feature →

Microsoft Innovation Alley

Recommended by Microsoft’s own innovation programme.

Microsoft’s Innovation Alley partners with 1Security and recommends it to the ecosystem, which answers the question a NIS2 project raises first: whether a vendor can be trusted read-only inside the tenant that holds the evidence.

Bring it to the steering meeting. It answers the trust question before it is asked.

Сертификат ISO/IEC 27001:2022Сертификат № 30954151 ISMS22Система управления информационной безопасностьюISO/IEC 27001:2022
Grzegorz Tworek, Microsoft MVP and Member of Microsoft Security Trusted Advisors, in conversation with 1Security on the NIS2 question.

FAQ

Common questions.

Are we even in scope for NIS2?

Scope covers essential and important entities across 18 sectors, generally from 50 employees or 10 million euro turnover, with national transpositions deciding the edges. That call belongs to your counsel. The practical point: the measures NIS2 asks for are the ones a well-run tenant needs anyway, so measuring readiness costs you nothing even if the scoping answer turns out to be no.

Does the report decide whether the incident is significant?

No. Significance under Article 23(3), which national authority receives the report and how your sector transposition applies are calls for your counsel. The templates carry the facts the drawer holds and print every assessment you have not made as Not established rather than guessing, so counsel works from a measured, dated record instead of a questionnaire.

How do the deadlines get computed?

From the moment you became aware - the detection's first-seen time unless you set it. The early warning is due 24 hours later, the notification 72 hours later, the final report one month after the notification was generated. Each generated report is an event on History & Comments, and the next report's timeline reads those events to say On time or After the deadline. Nothing about the deadlines is typed.

Can our SOC pull the notification document?

Yes. The same incident templates render over the read-only REST API and the MCP tools by detection id, in PDF, PowerPoint, HTML, CSV or JSON and in seven languages, so a SOC platform working the detection can pull the early warning straight from it. The detections themselves, the notification log and the compliance status are on the same API.

Do we need E5 licenses for this?

No. The detections, the retained history, the incident reports and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.

What about systems outside Microsoft 365?

We measure the Microsoft 365 side: identities, files, mail, apps, agents, devices, locations and the audit trail around them. For most office-work organisations that is where the majority of NIS2-relevant evidence lives, but OT networks and on-premises systems need their own evidence sources. The evidence pack and the incident report are honest about what they cover.

How fast do we get the first readiness picture?

The same day the tenant is connected read-only. Readiness is computed from data the platform collects on its own, with deliberately conservative statuses - not evaluated never counts as a pass - so the first picture is one you can already show internally, and weekly snapshots start accumulating from there. Detections start as soon as the activity history is in.

Платформа 1Security

Соответствие NIS2 — это только начало

Соответствие NIS2 — один экран платформы 1Security для Microsoft 365. Локации, устройства, приложения, ИИ-агенты, журналы, разрешения, чувствительные данные, соответствие, отчёты и действия работают на том же подключении только для чтения, на лицензии, которая у вас уже есть.

Run the 72-hour drill before an incident runs it for you.

Connect read-only and the first detection's drawer, its report and the NIS2 requirement statuses land the same day - open one anomaly, contain it, generate the early warning and the notification, and time it.

Book a demoLive demo
Or find out what happened the hard way, with the clock already running.