NIS2 Compliance — Architecture Mapping

How the Connected Trade Network architecture maps to NIS2 Directive obligations, and what gaps remain.

Why this document exists

The NIS2 Directive (EU 2022/2555) replaces NIS1 and significantly tightens cybersecurity requirements for “essential” and “important” entities across the EU. In the Netherlands it is implemented through the Cyberbeveiligingswet (Cbw), in force since mid-2025.

CTN is touched by NIS2 on multiple layers simultaneously:

• Most CTN participants (logistics service providers, freight forwarders, shipping lines, terminal operators) are themselves NIS2-obliged entities under the Transport sector.
• DIL as the orchestrator of CTN may itself fall under “Digital Infrastructure” / “ICT service management” as a B2B platform operator running shared sectoral infrastructure.
• Several connected systems (KvK, eHerkenning, sectoral data spaces) are operated by entities that are themselves NIS2-obliged.

Even where DIL is not directly NIS2-obliged, participants must perform supply-chain security assessments on CTN under Article 21(2)(d). CTN must therefore be designed and operated such that participants can confidently include CTN in their own NIS2 attestations.

Scope and key obligations

NIS2 imposes ten categories of risk-management measures (Article 21(2)) that registered entities must implement, plus governance, reporting, and supervision obligations. The ten measures are:

#	Article 21(2) measure	CTN relevance
a	Risk analysis & information system security policies	CTN architecture risk register, security policies
b	Incident handling	CTN-wide incident response, CSIRT-DSP coordination
c	Business continuity & crisis management	RTO/RPO targets, DR plan, backup strategy
d	Supply-chain security	Strongest CTN driver — participants assess CTN as supplier
e	Security in acquisition, development, maintenance	Secure SDLC, code review, dependency management
f	Policies for assessing effectiveness	Security testing, audit cadence, KPIs
g	Cyber hygiene & training	Operations team training, secure ops practices
h	Cryptography policies	TLS 1.3, key management, rotation, JWS algorithms
i	Human resources, access control, asset management	RBAC, least privilege, joiner/mover/leaver flow
j	MFA, secured comms, secured emergency comms	M2M auth, MFA on admin surfaces, secure runbooks

In addition: 24-hour early warning to CSIRT, 72-hour incident notification, one-month final report; mandatory registration with the competent authority (RDI in NL); management body accountability with personal liability and training obligations.

Penalties: up to €10M or 2% of worldwide turnover for essential entities, €7M or 1.4% for important entities.

Architecture mapping — Article 21(2) measures

(a) Risk analysis and information security policies

Aspect	Status	Reference
Architecture-level risk register	✅ Maintained	11-risks
Security architecture documentation	✅ Published	08-crosscutting
Information Security Policy (DIL-level)	⚠️ Gap	DIL to publish; CTN inherits
Acceptable Use / participant obligations	⚠️ Gap	Participation agreement to extend

Gap actions: DIL-level Information Security Policy needs to be published and referenced from this document. Participant obligations regarding security must be made part of the CTN participation agreement.

(b) Incident handling

Aspect	Status	Reference
Centralised logging (auth, authorisation, admin)	🚧 In design	Azure Monitor / Sentinel target
Detection rules for anomalous token use	🚧 In design	Sentinel analytics rules
Incident response runbook (24h/72h/1M)	⚠️ Gap	Owner: DIL operations
CSIRT-DSP communication template	⚠️ Gap	Aligned with NCSC-NL guidance
Participant notification mechanism	⚠️ Gap	Status page + email distribution

Gap actions: Document the 24h/72h/1M reporting flow (who decides, who signs, who notifies); set up the CSIRT-DSP contact path; define participant notification channels.

(c) Business continuity and crisis management

Aspect	Status	Reference
RTO/RPO targets per component	⚠️ Gap	To define: ASR, IdP
Backup strategy (PostgreSQL, config, secrets)	🚧 Partial	Azure Flexible Server backups; Key Vault soft-delete
Multi-region / failover plan	⚠️ Gap	Active/passive design needed
DR test cadence	⚠️ Gap	Annual full DR test recommended
Crisis communication plan	⚠️ Gap	Together with (b)

Gap actions: Define RTO/RPO per critical component, document Azure region-failover design, schedule the first DR test.

(d) Supply-chain security — strongest driver

CTN’s role here is dual: CTN is supplier to its participants, and CTN itself depends on suppliers (Azure, KvK, KBO, VIES, GLEIF, eHerkenning, identity providers, etc.).

As supplier to participants:

Aspect	Status	Reference
ISO 27001 / SOC 2 attestation	⚠️ Gap	Roadmap item for DIL
Penetration test reports	⚠️ Gap	Annual pentest recommended
SBOM for ASR containers	⚠️ Gap	Generate via Syft in CI/CD
Vulnerability disclosure policy (security.txt)	⚠️ Gap	Publish on every CTN-operated portal
Audit log accessibility for participants	🚧 In design	Per-participant audit trail export

As consumer of suppliers:

Aspect	Status	Reference
Supplier inventory with criticality assessment	⚠️ Gap	Owner: DIL operations
Contractual security requirements (DPA, SLA)	🚧 Partial	Azure: enterprise agreement
Continuous monitoring of supplier security posture	⚠️ Gap	Periodic review process

Gap actions: Pursue ISO 27001 certification, publish CVD policy with security.txt, establish SBOM generation in CI/CD, create supplier inventory.

(e) Security in acquisition, development, and maintenance

Aspect	Status	Reference
Secure SDLC defined	🚧 Partial	Code review, branch protection in GitHub
Dependency scanning in CI/CD	🚧 Partial	Maven dependency audit; expand to full SCA (e.g. OWASP Dependency-Check, Dependabot, Snyk)
Container image scanning	⚠️ Gap	Trivy or Defender for Containers
Patching SLA for runtime / images	⚠️ Gap	Define max-age per severity
Secure coding standards	✅ Documented	08-crosscutting/ctn-coding-standards

Gap actions: Add container image scanning to CI/CD, define and document patching SLA, expand dependency scanning to SCA-grade tooling.

(f) Policies for assessing effectiveness

Aspect	Status	Reference
Security KPIs / metrics	⚠️ Gap	Define: MTTR, patching latency, etc.
Internal audit cadence	⚠️ Gap	Annual minimum
External audit / pentest cadence	⚠️ Gap	Annual external pentest
Tabletop exercises	⚠️ Gap	Annual incident response drill

Gap actions: Define security KPIs and reporting cadence, schedule first external pentest and tabletop exercise.

(g) Cyber hygiene and training

Aspect	Status	Reference
Operations team security training	⚠️ Gap	Annual baseline + role-specific
Phishing simulation	⚠️ Gap	Quarterly
Awareness for management body	⚠️ Gap	NIS2-specific board training is mandatory

Gap actions: Establish annual training programme for operations and management body (Cbw makes the latter a personal-liability matter for directors).

(h) Cryptography policies

Aspect	Status	Reference
TLS 1.3+ enforced on all interfaces	✅ Constraint	02-constraints
Encryption at rest (AES-256)	✅ Constraint	Azure default; Key Vault for keys
JWS signing for VAD tokens	✅ Implemented	08-crosscutting
Key rotation policy	⚠️ Gap	Document per key type (token signing, TLS, secrets)
Cryptographic algorithm policy	⚠️ Gap	Approved-algorithms list; deprecation procedure

Gap actions: Document key-rotation policy and cryptographic algorithm policy as architecture decisions (ADRs).

(i) Human resources, access control, asset management

Aspect	Status	Reference
RBAC enforced on all admin surfaces	✅ Constraint	02-constraints
Least privilege on Azure subscriptions	🚧 In design	RBAC review needed
Joiner/Mover/Leaver process for CTN ops staff	⚠️ Gap	DIL HR + Entra ID lifecycle
Asset inventory (Azure resources, secrets, certificates)	🚧 Partial	Azure Resource Graph; needs curation
Privileged Access Management (PAM / PIM)	⚠️ Gap	Entra PIM for Global Admin / Owner roles

Gap actions: Implement Entra PIM for elevated roles, define and document JML process, curate asset inventory.

(j) MFA, secured communications, secured emergency communications

Aspect	Status	Reference
MFA on all admin / management surfaces	✅ Constraint	Keycloak MFA / federated IdP MFA (per ADR-00008)
M2M authentication via OAuth 2.0 client credentials	✅ Implemented	08-crosscutting
Secured communications (TLS, JWS)	✅ Implemented	Already covered in (h)
Out-of-band emergency communication channel	⚠️ Gap	E.g. Signal-based DIL ops bridge

Gap actions: Establish out-of-band crisis communication channel for DIL operations team.

Authorisation specifics (2026)

CTN’s 2026 authorisation model — VAD validated locally at every data provider — keeps the trust surface small. From a NIS2 perspective two artefact categories are critical:

1. JWKS endpoints for the VAD signing key are critical infrastructure. Compromise = ability to forge tokens. Hardening: HSM-backed signing keys (Azure Key Vault Managed HSM or equivalent), documented rotation procedure, monitoring of key-usage anomalies.

2. Trust list management. Adding or removing parties from the association trust list is a privileged operation — requires its own change-control process equivalent to CA root operations.

Both points warrant their own ADRs.

When later phases introduce additional artefacts (an OPA-based policy engine, dual-token validation) those will bring their own NIS2 controls; design notes are parked under docs/_out-of-scope-2026/.

NIS2 readiness summary

Category	Items	✅ Met	🚧 Partial / In design	⚠️ Gap
(a) Risk analysis & policies	4	2	0	2
(b) Incident handling	5	0	2	3
(c) Business continuity	5	0	1	4
(d) Supply-chain security	8	0	2	6
(e) SDLC security	5	1	2	2
(f) Effectiveness assessment	4	0	0	4
(g) Cyber hygiene & training	3	0	0	3
(h) Cryptography	5	3	0	2
(i) HR / access / assets	5	1	2	2
(j) MFA / secure comms	4	3	0	1
Totals	48	10	9	29

Roughly 21% of NIS2 control points are met today, 19% partially in place, and 60% remain as gaps. This is consistent with a project still in active build-out and is not unusual at this stage; the value of this document is to make the gaps explicit and actionable.

Recommended next steps

Short term (Q3 2026):

• Publish DIL-level Information Security Policy and reference from CTN docs.
• Document 24h / 72h / 1M incident reporting flow with named owners.
• Define RTO / RPO per critical component.
• Publish vulnerability disclosure policy (security.txt) on all CTN portals.
• Establish SBOM generation and container image scanning in CI/CD.

Medium term (Q4 2026 / Q1 2027):

• Pursue ISO 27001 certification for DIL operations.
• First external pentest and tabletop exercise.
• Implement Entra PIM for elevated roles.
• Document key-rotation and cryptographic algorithm policies as ADRs.
• Establish supplier inventory and supplier-security review process.

Strategic positioning:

• A complete NIS2-readiness pack (this mapping + ISO 27001 + pentest reports + SBOM + CVD policy) makes CTN a stronger commercial proposition to participants who feel NIS2 pressure themselves.

References

• EU Directive 2022/2555 (NIS2)
• Cyberbeveiligingswet (NL implementation, in force mid-2025)
• ENISA NIS2 implementation guidance
• NCSC-NL CSIRT-DSP reporting guidance
• 02-constraints — Security and integration constraints
• 08-crosscutting — Cross-cutting security concepts
• 10-quality — Quality requirements
• 11-risks — Risk register