Compliance / By country / NIS2

NIS2 Directive and Microsoft 365

The EU-wide cyber resilience law (2024) with binding MFA, access-control, and incident-reporting duties. Siemserva by Senserva maps 252+ Microsoft 365 and Entra ID checks to the areas NIS2 emphasizes, so a scan of your tenant doubles as evidence.

European UnionEssential and important entities252+ mapped checks

What NIS2 is

NIS2 raises the baseline of cybersecurity and incident reporting for essential and important entities across the European Union, and each member state transposes it into national law. Its technical measures, multi-factor authentication, access control, logging, and prompt incident detection and reporting, land squarely on Microsoft 365 and Entra ID configuration.

Official reference: NIS2 Directive

How Siemserva maps to NIS2

NIS2 asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:

Multi-factor authentication (42 checks)
Auth User Not MFA Registered Auth Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Password Authentication Method In Use But Not Allowed By Senserva Security Manager Auth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Require Passwordless But Its Not Used By User Auth Software Oath Authentication Method In Use But Not Allowed By User
Conditional Access (60 checks)
Conditional Access Admin Portal Missing MFA Conditional Access Break Glass Account Covered By Policy Conditional Access Group Critical Coverage Gap Conditional Access MFA Policy Bypassed Conditional Access User Critical Coverage Gap Conditional Access Block Legacy Exchange Active Sync Not Found
Identity and access management (60 checks)
At Risk With High Risk User Break Glass Account Disabled User Break Glass Account Is Not Highly Privileged User Break Glass Account Last Password Change User Break Glass User Not Enabled User High Risk User
Privileged access (PIM) (34 checks)
PIM Alerts No MFA On Activation Alert PIM Policy Expiration Required PIM Policy Missing For User Role Ai Administrator Assigned Role Standing High Privilege Assignment PIM Alerts License Suspended
Logging and audit (43 checks)
Log Blocked Signin Bad IP Or Too Many Invalid Attempts Log Flagged For Review Log Legacy Auth Protocol Audit CA Change Audit CA Failed Conditional Access Change Audit Failed Authorization Change
Threat detection and risky sign-ins (13 checks)
Risk Detection Anomalous Token Risk Detection Leaked Credentials Risk Detection Malicious IP Address Risk Detection Offline Risk Detection State Confirmed Compromised Risk Detection Token Issuer Anomaly

See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.

Evidence NIS2 in your own Microsoft 365

Siemserva by Senserva runs the identity, access, privileged-access, and logging checks above, and 650+ others, against your own tenant: it shows where you meet or miss each requirement, ranks the gaps by Severity, and produces audit-ready evidence and validated fixes to close them.

Scan your tenant free See the product Frameworks crosswalk

NIS2 and Microsoft 365: common questions

Does NIS2 apply to Microsoft 365?

NIS2 Directive does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.

How does Siemserva map to NIS2?

Siemserva runs 252+ Microsoft 365 and Entra ID checks across the areas NIS2 emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.

Is this an official NIS2 certification?

No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.

More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.

NIS2 Directive and Microsoft 365

What NIS2 is

How Siemserva maps to NIS2

Multi-factor authentication (42 checks)

Conditional Access (60 checks)

Identity and access management (60 checks)

Privileged access (PIM) (34 checks)

Logging and audit (43 checks)

Threat detection and risky sign-ins (13 checks)

Evidence NIS2 in your own Microsoft 365

NIS2 and Microsoft 365: common questions

Sponsored by Senserva