NIS2 Directive
20 rules checking EU NIS2 Directive (2022/2555) compliance for essential and important entities. NIS2 requires organizations to implement appropriate and proportionate technical measures for network and information system security.
| Rule ID | Severity | NIS2 Reference | Category | Summary |
|---|---|---|---|---|
| NIS2-NET-001 | HIGH | Art. 21(2)(h) | Insecure Protocols | Unencrypted protocol detected |
| NIS2-NET-002 | CRITICAL | Art. 21(2)(g) | Deprecated Protocols | Deprecated or broken protocol detected |
| NIS2-NET-003 | HIGH | Art. 21(2)(h,i) | Insecure Authentication | Insecure authentication protocol detected |
| NIS2-NET-010 | CRITICAL | Art. 21(2)(a) | Overly Permissive | Any-to-any unrestricted traffic |
| NIS2-NET-011 | CRITICAL | Art. 21(2)(i) | Overly Permissive | Overly broad source address |
| NIS2-NET-012 | CRITICAL | Art. 21(2)(i) | Overly Permissive | Overly broad destination address |
| NIS2-NET-013 | CRITICAL | Art. 21(2)(a) | Overly Permissive | All ports or wide port range allowed |
| NIS2-NET-014 | HIGH | Art. 21(2)(a) | Overly Permissive | All protocols (ANY) allowed |
| NIS2-NET-020 | CRITICAL | Art. 21(2)(a) | Network Segmentation | Direct internet-to-internal access |
| NIS2-NET-021 | CRITICAL | Art. 21(2)(a,i) | Database Exposure | Database ports exposed from broad source |
| NIS2-NET-030 | CRITICAL | Art. 21(2)(i,j) | Remote Access | Remote admin from external without VPN |
| NIS2-NET-031 | HIGH | Art. 21(2)(i,j) | Administrative Access | Admin protocols from broad sources |
| NIS2-NET-032 | CRITICAL | Art. 21(2)(a) | ICS/SCADA Isolation | ICS/SCADA protocol ports permitted |
| NIS2-NET-033 | HIGH | Art. 21(2)(d) | Supply Chain Security | Unrestricted outbound to internet |
| NIS2-NET-034 | CRITICAL | Art. 21(2)(a,i) | Container Exposure | Container/orchestration APIs exposed |
| NIS2-NET-035 | CRITICAL | Art. 21(2)(a,i) | Out-of-Band Management | IPMI/BMC hardware control exposed |
| NIS2-NET-036 | MEDIUM | Art. 21(2)(a) | DNS and Covert Channels | DNS as covert channel from internal segment |
| NIS2-NET-037 | CRITICAL | Art. 21(2)(a,i) | Risky Service Exposure | High-risk service from broad source |
| NIS2-NET-038 | HIGH | Art. 21(2)(i) | Administrative Access | Management traffic crossing untrusted segments |
| NIS2-NET-039 | MEDIUM | Art. 21(2)(f) | Rule Documentation | No application name or business justification |
The Severity column, like the Rules tab, shows the worst-case severity a rule can emit. Some rules emit a lower severity in less exposed cases:
- NIS2-NET-011 and NIS2-NET-012 are CRITICAL for an
anyor /16-or-wider address, and HIGH for a /17 to /20. - NIS2-NET-013 is CRITICAL when all ports are permitted, and HIGH for a range of more than 100 ports.
ICMP flows
ICMP has no ports, so an ICMP flow never triggers NIS2-NET-013 ("all ports or wide port range") or NIS2-NET-033 ("unrestricted outbound to internet"). The address rules still apply.
L2TP (UDP 1701)
NIS2-NET-002 fires on any rule that permits UDP 1701, even when IKE (UDP 500) and NAT-T (UDP 4500) are permitted as well. With L2TP/IPSec, L2TP packets travel inside ESP (IP protocol 50), or inside UDP 4500 with NAT-T, so a firewall never needs to permit cleartext UDP 1701. A rule that does permit it allows unprotected L2TP sessions. For L2TP/IPSec, permit only UDP 500, UDP 4500 and ESP.
ICS/SCADA protocols
NIS2-NET-032 fires for any flow that permits Modbus (502), S7comm (102), EtherNet/IP (44818) or BACnet (47808), including traffic within a single subnet. This is by design: these protocols have no authentication or encryption, so every rule that permits them deserves review. Confirm that the path stays inside a dedicated, segmented OT network.