Syneto Syneto
White Paper · 2026

NIS2 Compliance — Mapping Syneto Controls to the Directive.

A control-by-control mapping of Syneto Hybrid Cloud Ecosystem capabilities against the technical security requirements of EU Directive 2022/2555 (NIS2).

Companies
5,000+
Partners
250+
CSAT
98%
Bytes lost
$0
SYNETO  |  WHITEPAPER-NIS2-COMPLIANCE  |  WHITE PAPER v1.0 EN-IT-ES
White Paper02
Legal imprint

About this document

Publisher

Syneto SpA

Via Cefalonia 70, Brescia 25124, Italy

VAT RO15999720 · REG J35/2971/2003

Contact: [email protected]

Phone: +39 051 095 3000

Web: https://syneto.eu

Offices

Italy (HQ) · Brescia

Romania · Timișoara

Spain · Madrid

Certifications

ISO 9001 — Quality Management

ISO/IEC 27001 — Information Security

Copyright & trademarks

© 2026 Syneto SpA. All rights reserved. "Syneto", the Syneto logo, "SynetoOS", "Syneto CENTRAL", "Hyperion", "HYPER Core", "HYPER Edge", and "HYPER Echo" are trademarks of Syneto SpA. All other trademarks are the property of their respective owners.

Document scope

This whitepaper maps Syneto controls against Article 21 (risk-management measures) and Article 23 (reporting obligations) of NIS2, with sample audit-log exports, the incident-notification timeline, the RPH-backed evidence chain and the dashboards an auditor sees.

syneto.euPage 2 of 9
Directive scope03
Chapter 01 · Directive scope

What NIS2 demands.

NIS2 (Directive (EU) 2022/2555) entered force October 2024. It expands the scope of NIS1 to ~10× more EU entities, raises minimum cybersecurity controls, and introduces personal liability for executives.

EU entities in scope
160k+
Max fine (essential)
€10M
Max fine (important)
€7M
Initial incident notice
24 h
Essential entities
  • Energy, transport, banking
  • Healthcare, water, public admin
  • Digital infrastructure, ICT mgmt
  • Space sector
  • Drinking & waste-water
Important entities
  • Postal & courier services
  • Waste management
  • Chemicals manufacturing
  • Food production / distribution
  • Digital providers (search, marketplaces)
  • Manufacturing of critical products
syneto.euPage 3 of 9
Compliance mapping04
Chapter 02 · Compliance mapping

Article 21 — Cybersecurity risk-management.

Article 21 requirementSyneto controlEvidence
(a) Risk analysis & policyCENTRAL audit log; ISO/IEC 27001 ISMSISMS export
(b) Incident handlingRP timeline; Rapid Data Revival™; forensic clonesIncident PDF
(c) Business continuity & DRSmart Replicator; declared failover; per-VM RPO/RTODR-test signed report
(d) Supply chain securitySigned firmware; verified-boot HYPER; SBOM availableSBOM CycloneDX
(e) System acquisition / maintenanceSynetoOS LTS; signed update channel; staged-rolloutPatch policy doc
(f) Effectiveness assessmentQuarterly DR-test workflowDrill report PDF
(g) Cyber hygiene & trainingSyneto Academy partner curriculum; certified adminsCert roster
(h) CryptographyAES-256 at-rest + in-transit; HSM key custodyKMS export
(j) Multi-factor authenticationNIS2 Package add-on: TOTP MFA; SSO-integratedLogin audit
syneto.euPage 4 of 9
Compliance mapping05
Chapter 03 · Compliance mapping

Article 23 — Incident reporting timeline.

NIS2 imposes a strict notification cadence after a significant incident. Syneto CENTRAL's incident timeline view is designed to produce these reports automatically.

01

T+24h — Early warning

Initial notification: nature of incident, suspected cause, current impact. CENTRAL exports as a PDF, no manual writing.

02

T+72h — Notification

Updated assessment: scope, impact, indicators of compromise. RP timeline + affected-VM list attached.

03

T+1m — Final report

Root cause, remediation, lessons learned. Full audit-log dump + DR-test evidence + RPH-pinned recovery point list.

CENTRAL · Incident export
Early (24h)Notification (72h)Final (1mo)
Auto-populated fields
Incident IDINC-2026-04-12-001
Detected at2026-04-12T14:23:01Z
TypeRansomware (suspected)
Affected VMs14 of 218
Data exfiltrationNot confirmed
Service disruption47 min · ERP layer
RPH statusAUTO-ENGAGED · 847 RPs
Filing recipients
IT · ACN (Italy)CSIRT.gov.it · queued
ES · CCN (Spain)INCIBE · queued
Sectoral regulatorEBA / health / ANSSI per sector
One signed PDF per filing window, generated from the same incident object — auditors trace every field back to a signed log line.
syneto.euPage 5 of 9
Evidence chain06
Chapter 04 · Evidence chain

How RPH + WORM produce auditor-grade evidence.

Event Admin action / IO / alert Sign Ed25519 + TPM seal Audit log Append-only SyFS RP WORM-committed Echo vault Air-gapped copy Recovery Point Hold (RPH) 2-person approval, kernel-enforced, fines-grade Signed PDF for the regulator Cryptographic chain back to T0
From a kernel event to a regulator-ready PDF: every step is signed, every signature is verifiable, every Recovery Point is held.
Signed audit log entry (excerpt)
{
"event": "recovery_point.hold.placed",
"ts": "2026-04-12T14:33:08.114Z",
"actor": { "user": "[email protected]", "mfa": "totp", "session": "s-21a..." },
"object": { "rp": "vm-erp-01@2026-04-12T14:18:08Z", "txg": 4218892 },
"params": { "duration_days": 90, "reason": "incident:INC-2026-04-12-001" },
"approver": { "user": "[email protected]", "mfa": "totp" },
"sig": "ed25519:5Hb4...J7tA",
"prev": "ed25519:9Vp2...Q3xC" // chain hash
}
syneto.euPage 6 of 9
NIS2 Package add-on07
Chapter 05 · NIS2 Package add-on

What the optional NIS2 Package adds.

MFA
TOTP enrolment QRSSO step-up authLost-token recovery flowAudit of every challenge
Conditional Access
IP allow/deny listsGeo-restrictionDevice-attestation gateTime-window enforcement
Recovery Point Hold
Legal-hold workflow2-person integrityAuto-engage on anomalyReason code + audit
Reporting
NIS2 PDF templatesCSIRT/CCN/ANSSI readyMulti-jurisdiction filingsAuditor portal access
Optional, but the easy answer

The NIS2 Package is an add-on so customers without NIS2 obligations don't pay for it. For in-scope entities, it turns compliance from a paperwork project into a config setting.

syneto.euPage 7 of 9
Support & contact08
Chapter 06 · Support & contact

About Syneto & next steps.

Syneto designs and manufactures the complete Hybrid Cloud Ecosystem — hypervisor, data management, data protection and disaster recovery in a single plug & play platform. Founded in 2008, headquartered in Brescia and Timișoara, serving 5,000+ European businesses.

5,000+
Companies served
250+
Channel partners
18+
Years building HCI
$0
Ransom ever paid
European engineering

Designed, built and supported in Europe. ISO 9001 and ISO/IEC 27001 certified operations.

Plug & play deployment

Production-ready in under 30 minutes. No multi-vendor integration, no professional services required.

Single-vendor support

One contract, one phone number, one SLA — for the entire stack. Local language support.

Zero ransom paid

Across 18+ years of customer deployments, no Syneto customer has ever paid ransom following a cyber incident.

Single-vendor support — one contract, one phone number, one SLA for the entire stack. Three response tiers, all delivered by Syneto engineers in your language.

PlanResponseCoverageWho it's for
EssentialNBD — 8×5Software + hardwareBranch offices, test & dev
Business4 h — 24×7Software + hardwareProduction workloads
Mission-Critical1 h — 24×7Software + hardware + TAMBusiness-critical sites, DR

Talk to Syneto

Customer Support Portal

support.syneto.eu

Help Center

help.syneto.eu

Syneto Academy

academy.syneto.eu

Partner Portal

partners.syneto.eu

syneto.euPage 8 of 9

Ready to simplify?.

Join 5,000+ European companies that trust Syneto.

Italy HQ
Via Cefalonia 70
Brescia 25124
Romania
Bastion Office
Timișoara 300054
Spain
Calle Antonio Arias 6
Madrid 28009
Web
syneto.eu
syneto.eu [email protected] +39 051 095 3000
SYNETO SPA · VAT RO15999720 · REG J35/2971/2003 · ISO 9001 · ISO/IEC 27001