Guide

Tenable finds vulnerabilities. NIS2 still needs the paper trail. What CIR 6.5/6.6 and Lumin’s exposure score do — and don’t — prove to an auditor.

Which NIS2 Article 21(2) letters does Cloudflare’s Magic Transit and WAF actually cover — and which six do they miss?

Okta NIS2 compliance mapped to Article 21(2)(i)-(j): which product covers what, and why CIR Annex Section 11, not “6.3,” is the requirement that applies.

Your Palo Alto stack won’t pass a NIS2 audit alone — see which Article 21 measures it covers, and the 7 that still need documentation.

Your Splunk dashboard isn’t audit evidence. See which correlation searches and retention settings satisfy CIR 2024/2690 Section 3.2 and Article 23.

CrowdStrike Falcon covers real detection and logging for NIS2 Article 21 — but the directive also demands documented policies no SOC tool writes for you.

Cisco’s security portfolio maps to only 4 of NIS2’s 10 Article 21(2) measures — and a popular “DNS security” citation doesn’t exist. Here’s the accurate mapping.

Microsoft Defender covers 4 of NIS2’s 10 Article 21(2) measures — not all 10. See exactly which, and what still needs a policy, not a product.

What an ISO 27001 gap analysis covers, how it differs from an internal audit and SoA, and a practical 0-5 maturity scoring method to prioritize fixes.

The hub gives the ballpark range. Here is the real ISO 27001 certification cost by phase, company size, hidden costs, and a worked SME budget.