How do I set up an NIS2 compliance report?

This article describes how to set up an NIS2 compliance report in Security Center. First, create a report template with the settings required for NIS2 compliance. Then, use that template to generate the report. 

Create the template

1. Log in to Security Center.
2. Hover over Reports > Templates, then click + Create template.
3. Enter a name for the template, e.g., "NIS2 compliance template".
4. Optionally, under Filters, check Only include non-compliant assets to limit the report to assets that are non-compliant.
5. Under Max remediation time, review or adjust the default number of days allowed to remediate vulnerabilities by severity: Critical, High, Medium, and Low. Vulnerabilities must be remediated within this timeframe to maintain compliance.
6. Optionally, under Max remediation time by tag, click + Add tag to override the default remediation times for assets with specific tags.
7. Under EPSS threshold, set the default Exploit Prediction Scoring System (EPSS) threshold. Vulnerabilities with an EPSS score above this threshold are considered non-compliant.
8. Optionally, under EPSS threshold by tag, click + Add tag to override the default EPSS threshold for assets with specific tags.
9. Click OK to create the template.
10. Done!

Generate the report

1. Hover over Reports > Reports, then click + Create report.
2. Under Select assets, select what to include in the report: Include all assets, Select with tags, Select assets, or Select IP network. Click Continue.
3. Under Filters & constraints, under Asset types, check the asset types to include: Network assets, Web applications, and Devices. Click Continue.
4. Under Layout, enter a name for the report and select the template you created earlier from the Layout template drop-down, e.g., "NIS2 compliance template".
5. Alternatively, click Customize layout to build a custom layout instead of using a saved template.
6. Click Generate report.
7. Done!

Schedule a report

1. Hover over Reports > Schedules, then click + Create schedule.
2. Under Select assets, select what to include in the report: Include all assets, Select with tags, Select assets, or Select IP network. Click Continue.
3. Under Filters & constraints, under Asset types, check the asset types to include: Network assets, Web applications, and Devices. Click Continue.
4. Under Layout, enter a name for the report. Optionally, select a template from the Layout template drop-down, e.g., "NIS2 compliance template". If no template is selected, a custom layout is used.
5. Optionally, click Customize layout to build a custom layout instead of using a saved template.
6. Click Schedule settings.
7. Under Schedule, optionally check Skip empty reports to avoid generating a report when no data is available.
8. Set the Start date, Time, Time zone, and Repeat settings to define when the report should run.
9. Make sure Active is turned on to enable the schedule.
10. Click Submit.
11. Done!

Rerun a report 

1. Hover over Reports > Reports.
2. Click on the rerun icon next to the report you want to run again. This opens the New compliance report wizard.
3. Complete the Select assets, Filters & constraints, and Layout steps as described above, then click Generate report.
4. Done!