OpenPerimeter continuously maps everything your company exposes to the internet against the minimum measures of NIS2 Article 21, and runs the rest of the programme with you: gap assessment, incident deadlines, supplier security and a monthly report your management body signs.
NIS2 lists ten minimum cybersecurity risk-management measures. Here is how much of each an outside-in platform can prove. Every finding we raise is tagged with the measure it belongs to and the matching ISO/IEC 27001:2022 control.
Continuous technical risk input (rating, risk vectors, prioritised findings), NIS2 applicability classification and a guided gap assessment with evidence uploads.
Incident register with Art. 23 deadline timers (24 h / 72 h / 1 month), significance helper, pre-filled report drafts, reminders, plus alerts on new exposures and lookalike domains.
Nameserver redundancy checks, and gap-assessment questions with evidence uploads for backups, recovery tests and crisis plans (not visible from outside).
Supplier register with criticality, passive security ratings, a security questionnaire suppliers answer by private link, and contract-clause tracking.
Continuous discovery of exposed services and vulnerabilities, remediation deadlines, owners, risk acceptance and a coordinated-disclosure (security.txt) check.
Rating trend, time-to-fix and SLA compliance metrics, monthly management report with sign-off.
Hygiene checks: exposed RDP/SMB/databases, missing security headers, SPF/DMARC. Training is out of scope.
Certificate validity and expiry, deprecated TLS versions, HTTPS enforcement, CAA records.
Continuously discovered inventory of internet-facing assets under verified domains and IP ranges.
Exposed remote-access gateways (where MFA must be enforced), email transport security (MTA-STS, DKIM, DMARC).
A monthly one-page report with NIS2 status, overdue fixes and accepted risks, plus a recorded sign-off by your management body.
Incident register with live 24 h / 72 h / one-month timers, a significance helper, pre-filled reports for the authority, and reminders.
Supplier register, passive security ratings, a questionnaire your suppliers answer by private link, and contract-clause tracking.
Deadlines by severity, 7 days for actively exploited CVEs (CISA KEV), owners, and justified risk acceptance that expires.
We see you the way an authority's scan does, every day. One click exports a hashed evidence pack for your auditor.
A free applicability check tells you if you're likely essential or important, and records it with your gap assessment.
Create an account. No agents to install, no network changes.
Add your domains with one DNS TXT record each. Add IP ranges, verified through the internet registry, reverse DNS or our team. We never scan anything you haven't proven you own.
We find your subdomains, services, certificates and weaknesses, rescan daily, map every finding to NIS2 and alert you when something new appears.
Every internet-facing hostname, IP range, open port, web service and certificate under your verified domains. That's your 21(2)(i) asset evidence.
Exposed RDP and databases, VPN gateways, weak TLS, missing HSTS/CSP, SPF/DMARC/MTA-STS gaps, zone transfers, dangling DNS, security.txt.
Versions seen on your servers matched to public CVEs, ranked by CISA's known-exploited list and EPSS, with end-of-life and unsupported operating system releases flagged. Distribution builds are labelled honestly as "possibly affected".
Owners, due dates, risk acceptance with justification and expiry. Time-to-fix and deadline compliance measured for 21(2)(f).
The ten Art. 21 measures as 36 control questions with maturity scores and evidence uploads. Questions our scans can prove answer themselves.
Record an incident and the Art. 23 clock starts: early warning, notification and final report, with drafts pre-filled from your record.
Rate suppliers from public evidence only (we never scan them), send questionnaires, and track security, incident and audit clauses.
Typo and homoglyph domains imitating yours, flagged for your information when they appear, noting which ones can send email.
Print or save as PDF: rating trend, NIS2 status and maturity per measure, overdue and accepted risks, with recorded management sign-off.
Every decision is linked into a SHA-256 hash chain, and one click exports a hashed evidence pack for your auditor or DNSC.
MFA coverage across your tenant and the administrators without MFA, answering the 21(2)(j) question with evidence.
Invite colleagues and auditors. Consultants and MSSPs manage every client organisation from one login.
Email and Slack alerts on new exposures and incident deadlines, plus a 250–900 rating with A–F grades across six risk vectors.
Energy, transport, health, digital infrastructure, ICT service management, manufacturing, food, waste, public administration and the other NIS2 sectors.
One place to see what is exposed, what is overdue, and what management has approved, without spreadsheets.
Manage every client organisation from one login, with objective, timestamped, hash-verified evidence for gap assessments and DNSC-style audits.
No tool can do that on its own. NIS2 also requires governance, policies, incident handling, business continuity and supplier management. OpenPerimeter gives you continuous, objective evidence for the technical measures it can observe, and shows clearly which measures need your own records.
Never. A domain is scanned only after you publish a DNS TXT record proving control of it, or, if you can't change its DNS, after our team reviews your evidence and approves it. An IP range is scanned only once the internet registry, reverse DNS or our team confirms it is yours. Shared infrastructure such as CDNs and third-party SaaS is never port-scanned.
No. Suppliers have not given us permission, so their rating uses only public information: DNS and mail records, one normal visit to their website, and their certificate. Combine it with the questionnaire they answer for you.
Yes. One login can belong to several organisations, each with its own scope, findings, evidence and audit trail. Owners invite members and can create client organisations.
Scanning is light: DNS lookups, a top-ports connect scan, and ordinary HTTPS and TLS requests. Attack-style templates are off by default.
In the EU (AWS Frankfurt). We only store what we observe from the internet about your verified assets, plus your account and workflow data.
Romania transposed NIS2 through GEO 155/2024, supervised by DNSC. OpenPerimeter supports the risk-management, audit and management-training evidence those rules expect. Registration and incident notification are still done through DNSC's own channels.
About five minutes: sign up, add a domain, publish one TXT record. The first scan starts as soon as the record is visible.
Free for up to 10 assets. No credit card, no agents. See pricing →
Start your free NIS2 assessment