NIS2 and ITSM - practical requirements
for help desk systems

NIS2 (Network and Information Security Directive 2 - Directive (EU) 2022/2555) is the EU directive on the security of network and information systems. The deadline for its transposition into national law expired on 17 October 2024 - in Poland it is being implemented through an amendment to the Act on the National Cybersecurity System (legislative process ongoing). If you run an energy, banking or manufacturing company, or you are a digital service provider, NIS2 most likely covers you. What does it mean for ITSM? Art. 21 NIS2 lists cybersecurity risk management measures - from access control through change management to the obligation to report significant incidents. In this article I show how ManageEngine ServiceDesk Plus supports these requirements, plus a practical checklist for IT managers.

Which companies does NIS2 cover?

Essential entities - sectors of highest importance:

• Power plants and electricity grids
• Railways and public transport
• Banks and financial institutions
• Hospitals and healthcare services (critical systems)
• Water and wastewater supply
• Gas production and distribution facilities

Important entities - other sectors covered by the directive:

• Factories and manufacturing (outside the above categories)
• Postal and courier services
• Waste management
• Digital service providers (cloud, hosting, DNS, SSL certificates)
• Public marketplaces

Scope: NIS2 as a rule applies to medium and large entities (from around 50 employees or a corresponding turnover threshold) operating in the listed sectors. Some types of entities - DNS providers, domain registries, public communications network providers - may be covered regardless of size. The final scope and any exclusions follow from the national implementing act, so the status of your company is best verified individually.

NIS2 Art. 21 - 10 security requirements for IT

Every entity covered by NIS2 MUST implement these 10 requirements:

How ITSM helps you meet NIS2

A modern ITSM system (like ManageEngine ServiceDesk Plus) is the foundation of NIS2 compliance:

• Incident Management - every security incident is logged with timestamp, escalation and status.
• Change Management - every change (patch, update) is tracked: who, when, what changed, whether testing was performed, whether approval was obtained.
• Asset Management - catalog of every system: servers, laptops, software, licenses, vendor, version, vulnerabilities.
• Audit Trail - ITSM logs all actions: logins, changes, IT actions, communication. That is evidence for a NIS2 auditor.
• Reporting - ITSM generates reports: number of incidents per month, mean time to resolve, number of changes approved, whether SLAs were met.

Without ITSM you are at risk for NIS2 compliance - you have no proof you manage incidents, changes and assets. A detailed checklist for the IT department is in a separate article: NIS2 - IT manager checklist.

The 72h incident reporting obligation - how ITSM makes reporting easier

Art. 23 NIS2: A NIS2-covered entity MUST report a "serious incident" (for example ransomware, data breach) to the security authorities within 72 hours of detection.

What does "detection" mean? The moment the IT team discovered the incident (not when it started, but when they noticed). That is why an ITSM with accurate timestamping is critical - you must be able to say: "Incident detected 2024-05-15 08:30, reported to authorities 2024-05-16 14:00" - proof you had a 30-hour buffer.

ManageEngine ServiceDesk Plus automatically logs report time and every incident status change. You can generate a report from time of opening to time of notifying authorities - that is compliance documentation. To strengthen security further, also see our article on ManageEngine CVE and vulnerability management.

NIS2 × ManageEngine ServiceDesk Plus checklist

Below is a practical implementation list:

• Install ManageEngine ServiceDesk Plus Professional/Enterprise (Incident, Change and Asset Management modules required)
• Configure Incident Management: categories (security, confidentiality, availability), priorities, SLAs for serious incidents (max 72h to report to authorities)
• Enable Change Management: every change requires a request, testing, CAB approval, audit trail
• Configure Asset Management: import all IT systems (servers, laptops, software, licenses)
• Audit Trail: make sure ITSM logs all actions (minimum 12 months of history)
• ITSM backup: the ManageEngine server must be backed up daily, offline copy weekly. DR plan with RTO max 4 hours
• MFA: enable Multi-Factor Authentication for all ITSM users
• RBAC: set roles - IT Manager, Incident Manager, Change Manager, Auditor. Access segregation.
• Reporting: generate a monthly report - number of incidents, number of changes, audit trail excerpt, compliance check
• Training: annual training for the IT team on ITSM, incident response, NIS2 compliance