Evidence for every NIS2 report, ready within the deadline.
NIS2 compliance now reaches thousands of medium and large organisations across 18 sectors, from energy and health to manufacturing and public administration. It asks for incident handling, business continuity and fast reporting, with management accountable for all of it. Helm contains ransomware at the data layer, verifies recovery and records every step, so you can show what happened within the 24-hour, 72-hour and one-month deadlines.
Ransomware is the most impactful cyber threat in the EU, according to ENISA’s 2025 Threat Landscape, which analysed 4,875 incidents between July 2024 and June 2025.
NIS2 turns that threat into a legal responsibility. It widens EU cyber rules from a narrow set of operators to medium and large organisations in 18 sectors, and makes the management body approve the security measures, oversee them and answer for them. Fines can reach €10 million or 2% of worldwide turnover for essential entities.
National laws are now in force in most member states. The question for the board has moved on from whether you are covered to whether you can prove you are ready.
NIS2 applies to medium and large organisations in 18 critical and important sectors across the EU. The NIS2 Directive, Directive (EU) 2022/2555, is the EU’s main cybersecurity law for those sectors. Member states had until 17 October 2024 to turn it into national law. By October 2026, 24 of the 27 had done so.
Sectors of high criticality include energy, transport, banking, health, drinking water and public administration, and other critical sectors include manufacturing, chemicals, food and digital providers. Some organisations are covered whatever their size.
Entities are either essential or important. Both follow the same security and reporting rules. Essential entities face proactive supervision and higher fines, while important entities are supervised after the fact. Financial entities covered by DORA follow DORA instead.
NIS2 does not name ransomware. Article 21 sets ten minimum security measures, and a ransomware attack tests several at once. They include incident handling, business continuity such as backup management, disaster recovery and crisis management, and policies to assess whether your measures work.
NIS2 incident reporting runs on fixed deadlines under Article 23. For a significant incident, you send an early warning to your CSIRT or competent authority within 24 hours of becoming aware of it, an incident notification with an initial assessment within 72 hours, and a final report within one month, including the root cause and the mitigation applied.
An incident is significant when it causes, or could cause, severe operational disruption or financial loss, or considerable damage to others.
Your NIS2 compliance programme stays yours. Helm strengthens the part a ransomware attack puts under most pressure, the hours after encryption starts, measured against the NIS2 clock.
Before the early warning. Helm spots active encryption in under a second and isolates the accounts and devices involved on rules your team set in advance, with no AI in containment. That is Article 21 incident handling in practice, and your services stay up.
Before the notification. Within 72 hours you need an initial assessment of severity and impact. Helm’s timestamped record shows which accounts, devices and files were involved and what was contained, so the assessment rests on facts.
Before the final report. Recovery under Article 21’s business continuity measures starts from systems Helm has verified as clean. The same record supplies the root cause and mitigation the final report asks for.
Before any of it. Helm can also assess whether your current tools would catch live encryption and isolate compromised users and devices, as input to your Article 21 risk analysis. [TBC]
NIS2 asks essential and important entities to keep their services running through an incident and to report what happened, fast. Continuity is the requirement. Helm is how you hold to it, containing ransomware in seconds, bringing systems back only once they are verified clean, and giving your team the facts each NIS2 report needs, on time.
Many manufacturers are now important entities under NIS2. To see what the evidence looks like for your organisation, talk to us.
