VNClagoon as a NIS2 enabler for EU organisations

The obligation is now operational

The EU's NIS2 directive turns cybersecurity from a policy document into a set of controls you have to run — and prove. Risk management, access control, cryptography, incident handling, governance and supply-chain security must be implemented in practice and demonstrated to regulators. Since enforcement began, management is personally accountable for whether those measures are adequate.

Most organisations arrive at the same question: which tools and processes make NIS2 manageable — without another wave of tool sprawl, without surrendering data sovereignty, and without pushing sensitive material into public AI services?

VNClagoon is an EU-sovereign, integrated collaboration and communication suite with Confidential AI, deployable on-premises or in an EU private cloud. This post sets out, concretely, how VNClagoon helps you implement NIS2 — and why that matters equally to the CISO, IT leadership, and management.

What NIS2 actually requires

NIS2 defines minimum cybersecurity measures, among them:

Risk management and security policies
Access control, authentication and identity management
Cryptography and protection of communications
Incident handling and reporting duties, including a 24-hour initial notification
Business continuity and crisis management
Supply-chain security and supplier due diligence
Governance, training and management accountability

The important point: NIS2 does not mandate specific products. It requires measures that are adequate and demonstrable. VNClagoon is not a "NIS2 compliance tool" — it is the platform that makes many of these measures practical to implement and straightforward to audit.

How VNClagoon supports NIS2 implementation

1. Data sovereignty as the foundation. VNClagoon runs entirely on-premises or in an EU private cloud. Data flows, admin access and operational processes stay under your control — the basis for NIS2-compliant risk and supply-chain governance. Because the core is open source, security can be assessed independently, which also simplifies supplier due diligence during procurement.

2. Central identity and access control (VNCdirectory). VNCdirectory provides central user and group management, SSO via SAML/OIDC, integration with existing AD/LDAP directories, and technical enforcement of two-factor authentication. In practice that means role-based access control enforced centrally, mandatory 2FA for all users or specific roles, automated and documented joiner/mover/leaver processes, and permission structures you can export for an audit.

3. Secure communication and cryptography. VNClagoon supports end-to-end encrypted email, digital signatures, and closed communication groups — so incident and crisis-team communication stays confidential, authenticity is provable through digital signatures, and sensitive topics live in defined, controlled spaces.

4. Incident handling and crisis management. VNCproject, VNCmail, VNCtalk and VNCsafe let you stand up a crisis-team room in seconds, assign tasks and owners, and log decisions — supporting NIS2's requirement for structured incident response and making the mandatory reporting deadline easier to meet.

5. VNClagoon AI — Confidential AI for NIS2 processes. VNClagoon AI is the suite's integrated Confidential AI. It runs entirely inside the organisation's own EU tenant — no data leaves your infrastructure. Three use cases matter for NIS2: securely prompting your internal knowledge pool, so teams find policies, runbooks and SOPs with source references and no data leakage; processing content, turning meeting recordings into summaries and generating owned tasks in VNCproject; and agentic AI in VNCproject that prioritises open security and compliance tasks, escalates what's due, and drafts status reports for management and audits.

What this means for your role

For the CISO and IT security. VNClagoon gives you the technical controls NIS2 asks for, and makes them auditable: central enforcement of 2FA, role rights and lifecycle processes via VNCdirectory; end-to-end encrypted communication and closed incident groups via VNCtalk and VNCmail; secure prompting of internal security documents and AI-assisted incident analysis via VNClagoon AI — all on-premises or in an EU private cloud. Typical evidence artefacts: role and rights concept, 2FA policy, cryptography concept, incident runbook.

For IT leadership and operations. One stack, one identity: AD/LDAP/SSO integration across every app; automated provisioning and deprovisioning so offboarding is secure and traceable; an incident war room that keeps tasking, communication and logging in one tool; and VNClagoon AI turning meeting summaries into VNCproject tasks. Typical artefacts: architecture documentation, operations manual, provisioning process, data-processing agreement.

For management and compliance. NIS2 is a governance matter, and VNClagoon makes it manageable: EU-sovereign operation with data flows under your control; central policy storage, clear responsibilities and approval processes; crisis readiness with a response team live in seconds and decisions logged; and compliance status on demand. Typical artefacts: ISMS policies, responsibility matrix, incident logs, management reports.