skills/arckit-eu-nis2/SKILL.md
[COMMUNITY] Assess NIS2 Directive compliance obligations for EU member state operators of essential services and important entities
npx skillsauth add tractorjuice/arckit-codex arckit-eu-nis2Install this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate a NIS2 Compliance Assessment (EU Directive 2022/2555) for an organisation that may qualify as an Essential Entity or Important Entity under the NIS2 framework. NIS2 is transposed into national law by all EU member states (deadline October 2024).
$ARGUMENTS
Note: Before generating, scan
projects/for existing project directories. For each project, list allARC-*.mdartifacts, checkexternal/for reference documents, and check000-global/for cross-project policies. If no external docs exist but they would improve output, ask the user.
MANDATORY (warn if missing):
RECOMMENDED (read if available, note if missing):
OPTIONAL (read if available, skip silently):
external/ — extract existing ANSSI correspondence (OIV/OSE designation letters), sector-specific security orders (arrêtés sectoriels), existing incident response plans, business continuity plans000-global/policies/ — extract security policy, incident response policy, supplier security policy, BCM policyIdentify the target project from the hook context. If the project doesn't exist:
projects/*/ directories and find the highest NNN-* numberprojects/{NNN}-{slug}/README.mdPROJECT_ID and PROJECT_PATHRead all documents from Step 0. Identify:
Read the template (with user override support):
.arckit/templates-custom/eu-nis2-template.md exists in the project root.arckit/templates/eu-nis2-template.mdBefore generating the assessment, determine entity classification:
Annex I — Essential Entities: Energy (electricity, gas, oil, hydrogen), Transport (air, rail, water, road), Banking, Financial market infrastructure, Health, Drinking water, Wastewater, Digital infrastructure (IXPs, DNS, TLD, cloud, CDN, datacentres), ICT service management (B2B MSPs), Public administration, Space
Annex II — Important Entities: Postal and courier, Waste management, Chemicals, Food, Manufacturing (medical devices, computers, transport equipment), Digital providers (online marketplaces, search engines, social networks), Research
Size thresholds:
Show entity classification before generating the full document.
CRITICAL: Use the Write tool to create the assessment document.
Detect version: Check for existing ARC-{PROJECT_ID}-NIS2-v*.md files:
Auto-populate Document Control:
ARC-{PROJECT_ID}-NIS2-v{VERSION}Section 1: Entity Scoping
Section 2: Governance Obligations (Article 20)
Section 3: Risk Management Measures (Article 21)
Section 4: Incident Reporting (Articles 23–24)
Section 5: Supply Chain Security (Article 21(2)(d) + Article 22)
Section 6: Business Continuity (Article 21(2)(c))
Section 7: National Transposition — Member State Specifics
Section 8: Gap Analysis and Roadmap
Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks pass.
Write the document to:
projects/{project_id}/ARC-{PROJECT_ID}-NIS2-v{VERSION}.md
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ NIS2 Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-NIS2-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 Entity Classification
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Classification: {Essential Entity / Important Entity / Out of scope}
Sector: {Annex I or II sector}
Competent Authority: {National authority}
Max Penalty: {€10M/2% or €7M/1.4%}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Gap Summary (Article 21 — Ten Measures)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
{Compliance status for each of the 10 measures}
Total Gaps: {N} ({N} high, {N} medium, {N} low)
Incident Reporting: {Ready / Gap — 24h/72h capability needed}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
1. {If OIV/OSE (France): Run $arckit-fr-secnumcloud}
2. {If financial sector: Run $arckit-eu-dora for DORA overlap}
3. Run $arckit-secure to implement Article 21 controls
4. Run $arckit-risk to register NIS2 gaps
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Document | Publisher | URL | |----------|-----------|-----| | NIS2 Directive (2022/2555) — full text | EUR-Lex | https://eur-lex.europa.eu/eli/dir/2022/2555/oj | | ENISA — NIS2 guidance and resources | ENISA | https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive-new | | ANSSI — French NCA for NIS2 (and OIV/OSE authority) | ANSSI | https://cyber.gouv.fr/ | | CERT-FR — incident reporting contact (France) | CERT-FR / ANSSI | https://www.cert.ssi.gouv.fr/ | | NIS Cooperation Group — member state guidance documents | NIS CG | https://ec.europa.eu/digital-single-market/en/nis-directive | | ENISA NIS Investments report (sector benchmarks) | ENISA | https://www.enisa.europa.eu/publications/nis-investments |
Note for reviewers: NIS2 replaced the original NIS Directive (2016/1148) in January 2023, with member state transposition deadline of October 2024. France transposed NIS2 through amendments to the Loi de Programmation Militaire (LPM), building on an existing OIV/OSE framework — ANSSI is the single competent authority for both regimes. "OIV" (Opérateurs d'Importance Vitale — critical infrastructure operators) is a French national designation that predates NIS2 and carries stricter obligations; "OSE" (Opérateurs de Services Essentiels) is the NIS/NIS2 designation. Entities can be both.
projects/{project_id}/ARC-{PROJECT_ID}-NIS2-v{VERSION}.md$arckit-eu-nis2 Assess NIS2 obligations for a French regional energy distribution operator (DSO), Essential Entity under Annex I Energy sector, existing OIV designation, planning cloud migration to SecNumCloud-qualified provider
$arckit-eu-nis2 NIS2 scoping for 001 — Dutch healthcare provider with 300 employees, operating across NL and BE, considering Essential Entity classification under health sector
$arckit-eu-nis2 NIS2 assessment for a managed service provider (MSP) operating across 6 EU member states, ICT service management Annex I
After completing this command, consider running:
$arckit-fr-secnumcloud -- Assess SecNumCloud alignment for French entities with OIV/OSE designation (when Entity is French and has OIV or OSE designation)$arckit-eu-dora -- Map overlapping ICT resilience obligations for financial sector entities (when Entity is in the financial sector and subject to both NIS2 and DORA)$arckit-risk -- Integrate NIS2 gap findings into the project risk register$arckit-secure -- Implement security controls addressing NIS2 Article 21 ten minimum measurestools
Procurement market intelligence — award-value benchmarks, top suppliers, incumbency and concentration, from the UK Tenders MCP
tools
Competitor landscape — rival suppliers, awarded-value market share, head-to-head and concentration, from the UK Tenders MCP
development
[COMMUNITY] Generate a SOCI Act Critical Infrastructure Risk Management Program (CIRMP) governance and evidence pack for Australian critical infrastructure assets.
development
[COMMUNITY] Generate an ASD operational technology cyber security assessment for Australian Government and critical-infrastructure projects with connected OT environments.