NIS2 controls built into your Terraform modules. Enforced before apply.
Article 21 asks for technical measures for cryptography, access control, incident handling and network security. The modules enforce these controls before apply and list the section of the NIS2 implementing regulation each one maps to, where the catalog names one.
Modules enforce 53 of 101 NIS2 controls in the catalog. Of the 76 that cite a NIS2 clause, they enforce 36. The controls they do not enforce stay with your team, with risk policies, incident reporting, supply chain assessments and training.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex H: NIS2
- Framework
- NIS2 Directive (EU 2022/2555)
- For
- Your team, on Terraform
Scope for NIS2
NIS2 applies to essential and important entities operating in the EU, in sectors such as energy, transport, healthcare, digital infrastructure and ICT services.
Covers
- Infrastructure controls on AWS resources that map to sections of the NIS2 implementing regulation, by section in H.3.
- terraform-aws-modules through the NIS2 framework host or your org endpoint. Once your team switches to the compliance.tf provider, resources written by hand outside modules are checked against its built-in CIS controls, not the NIS2 set.
Stays with your team
- Risk analysis and information system security policies (Art. 21(2)(a)).
- Incident handling and reporting to CSIRTs (Art. 21(2)(b), Art. 23).
- Business continuity and crisis management beyond backup configuration (Art. 21(2)(c)).
- Supply chain security assessments (Art. 21(2)(d)).
- Cybersecurity training and basic cyber hygiene (Art. 21(2)(g)).
- Human resources security and access control policies (Art. 21(2)(i)).
- Registration with national competent authorities (Art. 3).
- Resources outside compliance.tf module coverage, and every control H.4 lists as Mapped: 40 with a NIS2 clause and 8 without one.
The source line
Point a module at the NIS2 framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "nis2.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and NIS2 comes from your org's configuration.
Enforced and mapped, by section
Of the 76 NIS2 controls in the documented catalog that cite a clause, modules enforce 36. A control appears once under each section it maps to.
The catalog maps 25 more controls to NIS2 without naming a clause, 17 of them enforced. They are listed apart at the end of H.4 and left out of these counts.
Every row is a control your auditor can look up.
Filter the register, or search by control name or clause, for example Cryptography.
76 of 76 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Enforced or mapped without a named NIS2 clause
The catalog lists these 25 controls under NIS2 but names no NIS2 clause for them, so the register and the counts in H.3 leave them out. Each still links to its docs page.
Clause IDs for the auditor. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your auditor
- The NIS2 clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, the comparisons with other tools, and the NIS2 framework registry at nis2.compliance.tf.
Plans for NIS2
NIS2 is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.
Questions about NIS2
Which NIS2 requirements does this cover?
Compliance.tf enforces the technical cybersecurity measures from Article 21(2): cryptography and encryption (Art. 21(2)(h)), access control (Art. 21(2)(i)), logging and incident detection (Art. 21(2)(b)), and backup/business continuity infrastructure (Art. 21(2)(c)). These are the requirements that translate directly to AWS resource configuration. The control register groups controls by the sections of the NIS2 implementing regulation, for example 9 Cryptography, not by these Art. 21(2) letters.
Does NIS2 apply to my organisation?
NIS2 applies to entities in 18 critical sectors operating in the EU. Essential entities include energy, transport, banking, health, digital infrastructure, and public administration. Important entities include postal services, waste management, manufacturing, food, chemicals, and digital providers. If you have 50 or more employees or EUR 10 million or more in turnover and operate in a covered sector, NIS2 likely applies.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.