Generic GRC tools treat NIS2 as one checklist for a whole continent. It is not: it is 27 national laws, each with its own controls, portals, terms and taxonomies. Tracedir models YOUR transposition as data, with the legal source attached to every rule, and walks you from scoping to the signed report.
Every point below is a national transposition on our regulatory radar. The Italian profile is live and the deepest anywhere: decree, authority determinations, portal tracks, incident taxonomy. The next profiles follow on the same engine, because in Tracedir a regulation is a data profile, not a rewrite.
27 EU member states · one engine · profiles switched on country by country
One guided path. Every step feeds the next, because everything lives in the same place.
Answer plain questions about sector, size and services. Tracedir tells you if you are in scope, in which category, and what that implies, with the legal article behind every conclusion.
The guided assessment on your country's official control framework. Coverage, maturity and priority computed as the national methodology prescribes, consistency gates included.
A prioritised plan generated from your actual gaps: severity, effort, deadlines, owners. It updates as you work and feeds every document downstream.
Policies, procedures, registers and the board-grade Technical Report, generated from your data. Exports shaped for your national portal, verified before upload.
Deadlines watched, reviews scheduled, incidents classified against the official taxonomy, suppliers monitored. The calendar never sleeps, so your file never expires.
Policies, procedures, remediation plans and the board-grade Technical Report are generated from your real results, version by version, with a full audit trail. Documents that agree with each other, because they come from the same place.
Tracedir classifies the incident against your country's official taxonomy, tells you which notifications are due and when, and assembles them from data you already have. You handle the incident; the platform handles the paperwork and the deadlines.
A wizard in plain language maps your incident onto the official significance criteria. No guessing whether it is notifiable at 2 a.m.
Early warning, notification, final report: each with its own countdown, each pre-filled from your incident record and entity data.
Every decision, timestamp and communication is versioned. If the authority asks why you classified it that way, the answer is already written.
If you operate in one of the 18 sectors in the annexes and exceed the size thresholds (generally 50+ employees or EUR 10M+ turnover, with important exceptions that apply regardless of size), very likely yes. Tracedir's scoping module answers it precisely for your country's transposition, article by article.
Both face the same security measures; the differences are supervision (proactive for essential, ex-post for important), deadlines and sanction ceilings. Your classification drives everything downstream, which is why it is step one in Tracedir.
Partially, and the overlap is real: Tracedir maps your existing ISO controls onto the NIS2 framework so you only close the actual gaps. But NIS2 adds national registration, incident notification terms and board accountability that no certificate covers.
NIS2 notification runs on clock terms from detection (early warning within 24 hours, notification within 72, final report within one month, in most transpositions). Tracedir classifies the incident against the official taxonomy and assembles the notification while the clock runs.
Regulatory rules live in Tracedir as versioned data with their legal source, not as code. When a determination changes, the profile updates, your data stays, and the exports change shape. That is the point of the architecture.
Tell us where you are in your journey: we reply within one business day with concrete next steps, no strings attached.
Prefer email? hello@tracedir.com