CISO

The CISO problem

EU cybersecurity regulation has shifted from framework-level guidance to article-level legal obligations. CRA Annex I mandates specific product security controls. NIS2 Article 21(2) lists 10 security measure categories with management personal liability. The AI Act introduces new obligations for AI systems in your product stack. Each regulation has its own scope, timeline, and evidence requirements.

You cannot delegate this to legal. Legal cannot interpret what "software integrity verification" means in your CI/CD pipeline. You need article-level obligation mapping — what each regulation requires, which controls satisfy it, and what evidence to produce.

What NexCyber gives CISOs

Article-level obligation mapping

The NexCyber Engine maps 144 obligations across CRA, NIS2, AI Act, DORA, and RED to specific controls. Not framework-level ("implement access control") — article-level ("CRA Annex I Part I §2(5): minimise attack surface, disable unused interfaces by default").

Every obligation has:

• The regulatory article it comes from
• The control that satisfies it
• The evidence artefact it requires
• Whether it overlaps with another regulation

SBOM — from spec to compliance artefact

CRA Annex I Part II §1 requires a machine-readable SBOM for every product with digital elements. NIS2 Article 21(d) requires supply chain security measures that an SBOM supports.

NexCyber maps the SBOM requirement to both regulations, identifies the format and depth that satisfies CRA Annex I, and tracks SBOM completeness as an evidence artefact. One SBOM. Two regulations satisfied.

→ SBOM requirements under CRA

CVD policy — from template to operational process

CRA Article 14 requires a coordinated vulnerability disclosure policy publicly accessible and operationally active. ETSI EN 303 645 §5.2 (RED) requires the same for IoT products.

A PDF policy on a website does not satisfy this. You need: a monitored disclosure channel, a triage process, a defined response timeline, ENISA notification workflow for actively exploited vulnerabilities (from 11 September 2026).

NexCyber maps CVD policy requirements to both CRA and RED, tracks the operational components as evidence, and flags when the 24h ENISA early warning obligation is triggered.

→ CRA Article 14 vulnerability reporting workflow

NIS2 Article 21 — 10 security measures mapped

NIS2 Article 21(2) lists 10 mandatory security measure categories. Under Article 20, management bodies are personally liable for approving them. NexCyber maps each category to specific controls and evidence:

1. Risk analysis and IS policies
2. Incident handling
3. Business continuity and crisis management
4. Supply chain security
5. Security in network and IS acquisition
6. Policies and procedures for IS effectiveness
7. Cybersecurity hygiene practices and training
8. Policies on cryptographic use
9. Human resources security, access control, asset management
10. Multi-factor authentication

→ NIS2 implementation guide

Audit-ready evidence — not a checklist

Regulators do not want a compliance checklist. They want: a technical file, SBOM, vulnerability log, CVD policy with disclosure history, test reports, EU declaration of conformity, ENISA notification records.

NexCyber's Evidence Layer maintains these artefacts with hash verification, 10-year retention, and continuous SBOM trust layer. The Compliance Cockpit gives you a per-regulation evidence completeness view.

→ Audit-ready evidence for CRA

Key dates CISOs must track

| Date | Obligation | |---|---| | 1 August 2025 | RED Article 3(3) IoT cybersecurity — mandatory for new products | | 2 February 2025 | AI Act Article 5 prohibited practices — in force | | 17 January 2025 | DORA — in force for financial entities | | 11 September 2026 | CRA Article 14 vulnerability reporting to ENISA | | 11 December 2027 | Full CRA obligations for products with digital elements |

MRCC — your external compliance signal

The Machine-Readable Compliance Certificate (MRCC) is a NexCyber-issued readiness attestation per product × regulation × version. Cryptographically signed (Ed25519 + ML-DSA-65 post-quantum hybrid + SHA-256 manifest). Buyers and regulators can verify in 30 seconds at nexcyber.eu/verify.

For CISOs: the MRCC is not paperwork — it is the machine-readable output of your evidence layer, shareable with procurement teams, enterprise buyers, and regulators without disclosing your internal technical file.

→ MRCC platform

Tools

• CRA Scope Checker — 60-second applicability verdict for your product
• NIS2 Applicability Checker — essential or important entity determination
• SBOM Readiness Checker — CRA Annex I completeness check
• EU Market Access Score — cross-regulation readiness score

Related answers

• NIS2 × CRA overlap — shared evidence strategy
• SBOM under CRA — format, depth, signing
• CRA Article 14 vulnerability reporting
• AI Act × CRA overlap

NexCyber — EU Market Access Compliance Platform