# NIS2 index

> What the NIS2 evidence index of a SpectrAI report is, the article 21 controls it organises, and why it is neither an attestation nor a certification.

## What it is

Each report includes an index that classifies its evidence according to selected controls of article 21 of the NIS2 directive (cybersecurity risk management measures). For each selected control, the index indicates which evidence from the pentest relates to it: an access control finding, a configuration proof, a recommendation.

## What it is for

- Quickly find, in a report, the elements that feed an internal file or a discussion with an auditor.
- Give management a reading by theme, in addition to the reading by severity.
- Keep, from one report to the next, the same reading grid.

## Limits of the index

> [!IMPORTANT]
> The NIS2 index describes a classification of the evidence. It does not attest your organisation's compliance, does not replace a regulatory audit, a qualification or a certification, and does not cover the controls that the pentest of an application cannot observe (governance, business continuity, supply chain, training).

SpectrAI does not describe itself as prepared for NIS2 and issues no attestation. If your organisation is subject to NIS2, the index provides you with dated technical evidence; your compliance process remains your own.

## Where to find it

In the online report and in its PDF export, in the part dedicated to compliance evidence.

---

https://docs.spectr-ai.eu/en/resultats/nis2