NIS2
How XoT helps you with the requirements in NIS2
NIS2 is the EU directive on cybersecurity. It lists ten areas in which organisations must take measures. Here we go through all ten and show where XoT helps.
The law in Sweden
The Swedish Cybersecurity Act has applied since January 2026
In Sweden, NIS2 applies through the Swedish Cybersecurity Act. The Act came into force on 15 January 2026. The Swedish Civil Defence Agency coordinates the work. Each sector also has one or more supervisory authorities of its own.
Whether the Act applies to your organisation depends on your sector and size. We do not make that assessment for you.
Point by point
The ten points in Article 21.2
The table shows the ten areas that the directive lists in Article 21.2. The last column shows whether XoT helps. The rows where XoT helps are highlighted in green.
| Point | Area | XoT |
|---|---|---|
| a | Risk analysis and information system security | No |
| b | Incident handling | Partly |
| c | Business continuity, backups and crisis management | No |
| d | Supply chain security | Partly |
| e | Security in acquisition, development and maintenance, including vulnerability handling | Partly |
| f | Procedures to assess whether the measures work | No |
| g | Basic cyber hygiene and training | No |
| h | Cryptography and encryption | Partly |
| i | Human resources security, access control and asset management | Partly |
| j | Multi-factor or continuous authentication, secure communications | Partly |
XoT helps with part of the requirements in six of the ten points. The remaining four concern work in your organisation that no product can do for you.
Where XoT helps
Six points where XoT helps with part of the requirements
h – cryptography and encryption
XoT encrypts the traffic to the equipment with WireGuard. The point also covers your company's procedures for using encryption. You need to draw those up yourself.
Point h is often confused with point j. Encryption is point h. Multi-factor authentication and continuous authentication are point j.
i – access control
Each authorisation applies to a specific user, specific equipment and a specific period. XoT has no shared logins and no passwords of its own. The point also covers human resources security and asset management. XoT does not help with those.
j – continuous authentication
The point mentions multi-factor authentication, where users show at least two different kinds of proof of identity. It also mentions continuous authentication, where identity is checked throughout the connection.
In XoT, the user and the Lock check each other twice a minute while the connection is open. XoT can also require multi-factor authentication through your identity service. The point also covers secure voice, video and text communication. XoT does not help with that.
d – supply chain
The point covers security in your relationships with suppliers. XoT limits what a vendor can reach. Browser sessions are recorded, so you can see what the vendor did. Contracts, follow-up and audits of vendors remain your company's work.
The point also applies to us as a supplier. Our description of how we work with quality, a software bill of materials (SBOM) and penetration test reports are available on request.
b – incident handling
The point covers preventing, detecting and handling incidents. XoT logs every connection and access decision and can send the log to your SIEM. If the SIEM detects a threat, it can revoke access or isolate a session in XoT. Incident procedures and reporting to authorities are your responsibility.
e – vulnerability handling
XoT does not remove vulnerabilities in the equipment. But the Lock stops all traffic to the equipment from anyone without an authorisation. This is called a compensating control, because it reduces the risk without removing the vulnerability. Describe the protection in those terms in your documentation.
Traceability
The log shows that access was controlled
Controlling access is only half the job. You also need to be able to show it afterwards.
The XMS keeps two logs. The event log shows every connection: who connected, to what, from where, when and for how long. The audit log shows every change to policies and access rights: who made the change, when and what was changed. The audit log is protected against later changes.
Browser sessions are recorded automatically. The XMS keeps logs for up to 36 months. The logs can be forwarded to a SIEM system, which collects logs from across the organisation, for example Splunk, IBM QRadar or Wazuh.
Penalties
Fines under the directive
The directive divides organisations into two groups: essential and important entities. The Swedish Act calls them essential and important operators.
Article 34 of the directive sets how high the fines must be able to go. For essential entities, the maximum fine must be at least EUR 10 million or 2 per cent of global annual turnover. The higher of the two amounts applies. For important entities, the corresponding levels are EUR 7 million and 1.4 per cent.
These are the directive's levels. Swedish law and the supervisory authorities decide how they are applied in Sweden.
Common questions
Do we comply with NIS2 if we use XoT?
No, not through XoT alone. XoT helps with part of the requirements in six of the ten points in Article 21.2. The rest is work in your organisation.
Can we use XoT for equipment that cannot be updated?
Yes. The Lock stops traffic to the equipment from anyone without an authorisation. State in your documentation that the vulnerabilities remain but that unauthorised users cannot reach them.
Do you help with the documentation?
We describe exactly what XoT does. You assess whether your company complies with the law yourselves, ideally together with a lawyer or auditor.
Does NIS2 apply to our organisation?
It depends on your sector and size. We do not make that assessment for you.
How does NIS2 relate to CER?
CER is the EU directive on the resilience of essential services. An entity identified as critical under CER is also in scope of NIS2.
What we write here is our interpretation of the directive. It is not legal advice.
Xertified as a supplier
Assess us as a supplier
This page shows how XoT helps you. Xertified itself is not covered by NIS2, as the company is below the size threshold. We still meet the requirements customers place on their suppliers.
Ask for material
We are happy to explain how XoT can be described in your NIS2 documentation.