NIS2 file integrity monitoring
Config and backup files checked, with a record of every review.
NIS2 asks for incident handling and backup management, and the Commission's implementing regulation spells it out: log changes to critical configuration and backup files, and check backups for integrity. Alertica does both for the files on your servers, from outside, and records who reviewed each alert and why. There's a free plan that never expires.
- Agentless, nothing to install
- Supports Article 21 and 2024/2690
Who it's for
Essential and important entities with a small IT team and no SOC, and the providers that run IT for them.
Built for
- EU companies newly in scope of NIS2, such as manufacturers, logistics firms and food producers
- MSPs and the other digital providers that Implementing Regulation 2024/2690 names
- Servers, file exchanges and backup targets reachable over SFTP
What Alertica covers in NIS2
Parts of Article 21, and the file-level measures the implementing regulation spells out. Where a measure needs more than a file monitor, the last column says what.
| Reference | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| Art. 21(2)(b) Incident handling | Handle incidents. | Raises the alert that starts handling, and records who looked and what they did. | The rest of incident handling, from triage to recovery. |
| Art. 21(2)(c) Backup management | Business continuity, such as backup management and disaster recovery. | Alerts when a backup doesn't arrive, shrinks sharply, or a stored copy changes. | Write the recovery plans, and test restores. |
| Art. 21(2)(f) Assess your measures | Have policies and procedures to assess whether your measures work. | The weekly health email shows each rule ran, what it found and what is still open. | Assess your other measures. |
| Art. 23(4) Reporting deadlines | Send an early warning within 24 hours, and a notification within 72 hours, of becoming aware of a significant incident. | Tells you the scan after files change or go missing, so you become aware in time. | Decide whether it is significant, and notify. |
| 2024/2690 Annex 4.2.3 Backup integrity checks | Check backup copies for integrity regularly. | Fingerprints each stored backup on your server and alerts when one changes. | Test recovery (4.2.6). |
| 2024/2690 Annex 6.3.1 Configuration monitoring | Establish, document, implement and monitor configurations. | Alerts when a watched config file changes, contents included. | Set and document the configurations. |
| 2024/2690 Annex 3.2.5 Protect logs | Protect logs from unauthorized access or changes. | Alerts when archived logs change or disappear. | Restrict access to the logs. |
| 2024/2690 Annex 3.2.3(f) Log config and backup files | Logs include access to, or changes of, critical configuration and backup files. | Records every change to the config and backup files you watch, in 12 months of history. | Log who accessed them. |
What your authority sees
National authorities supervise NIS2 and ask for evidence that your measures work. They ask what happened on given dates. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note is your incident handling record, from the first look.
-
Twelve months of history
Pro keeps a year of alerts and scans, so any date an authority asks about has its record.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It shows week by week that the measure works, as Article 21(2)(f) asks you to assess.
-
The record in one download
Pick the period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
Only fingerprints leave
Alertica works out a fingerprint of each file on your server. File contents and backups never leave it.
-
One console for every client
MSPs see every client's servers, rules and alerts in one place, with nothing on each server to keep updated.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up backup and config monitoring with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept on record.
Questions about NIS2
What Alertica covers in NIS2.
-
Does Alertica make us NIS2 compliant?
Article 21 lists ten areas of measures. Alertica supports incident handling and backup management for your files, as the table shows.
-
Does the implementing regulation apply to us?
It applies to DNS, cloud, data centre, CDN, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers. Everyone else follows their own country's law for Article 21.
-
Does the 24-hour clock start when Alertica alerts?
It runs from when you become aware of a significant incident. Alertica shortens the time before you know.
-
Do you copy our backups?
No. Alertica works out each file's fingerprint on your server and reads back only that, with the file's name, size and date.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
Set up backup and config monitoring with our team
Tell us where your backups land and which configs matter. We'll set up the rules with you and go through the first scan together.