The Management page gives, each month, one page in plain words for the people who run the company: where the security of your internet-facing systems stands, what changed, what is late and what to decide. NIS2 asks management to approve the security measures and to oversee them. Approving this page each month keeps a dated record of that oversight.

The page for management is included from the Solo plan. It is an aid to inform management and record its approval, not legal advice: what NIS2 requires of your management depends on your country’s law.

What the page says

Choose a month at the top: the last twelve, and the current one, in progress.

The state of the month, in three words, and why:
- Under control: nothing serious is open or late.
- Needs attention: serious problems open, fixes past their due date, accepted risks to review, a weak supplier, an open incident or a site down for an hour or more.
- Needs a decision: a critical problem open, a domain graded E or F, a serious fix past its due date, or an incident report sent late.
Exposure: your domains, their average score and how it moved over the month, the problems open by severity, those fixed and those new, and each domain’s grade.
Follow-up: the remediation plan and what is late, the accepted risks due for review, the incidents of the month, the watched suppliers with a weak grade, and the outages.
To decide: the three actions that would improve security the most.

The page shows the outside view of your internet-facing systems only; your internal measures are not on it.

Record the approval

Once the month is over, from the first day of the next one:

Open Management and choose the month.
Show the page to management, on screen or with Download (PDF).
Enter the name of the person who approved it and their position in management, and if you like the decisions taken.
Tick the confirmation and press Record the approval.

Owners and admins of the workspace record the approval. The person who approves does not need an account.

Frozen and sealed

Once approved, the month’s page is frozen: it shows the figures as they were at the approval, even if things change afterwards. It is dated and sealed with a SHA-256 fingerprint of its content, the name, the position, the decisions and the date. The fingerprint is checked each time the page is shown: if anything changed since, the page says so.

An approval cannot be changed or withdrawn, because it serves as evidence. The PDF of an approved month carries the approval and its fingerprint. The decisions written are encrypted, and the activity log records the approval with its fingerprint.