NIS2Shield

1. Overview

NIS2Shield is an Atlassian Forge app that automates NIS2 Directive Article 23 incident reporting inside Jira Cloud. It helps EU organisations comply with mandatory cybersecurity incident notification requirements by providing:

• Structured incident reporting with all NIS2-required classification fields
• Automated deadline tracking for the 24-hour, 72-hour, and 30-day reporting cascade
• Pre-formatted CSIRT templates for Early Warning, Incident Notification, and Final Report submissions
• Automated escalation via Jira issue comments when deadlines approach or pass
• Full audit trail for compliance evidence and regulatory audits

2. Getting Started

Installation

1. Install NIS2Shield from the Atlassian Marketplace
2. A Jira administrator must grant the required permissions during installation
3. Once installed, NIS2Shield appears as a global page in your Jira navigation (Apps → NIS2Shield)
4. An issue panel is also added to all Jira issues for linking incidents

Initial Configuration

Before reporting your first incident, configure your organisation settings:

1. Open NIS2Shield from the Jira navigation menu
2. Click Settings in the top-right corner
3. Enter your organisation name (used in CSIRT templates)
4. Select your primary sector from the 18 NIS2 sectors
5. Choose your national CSIRT authority
6. Add a contact email for CSIRT communications
7. Configure notification thresholds (default: 75%, 90%, and 100% of deadline)

3. Incident Command Center

The dashboard provides a real-time overview of all NIS2 incidents across your organisation:

• Summary cards — Total incidents, overdue count, critical/high count, and resolved count
• Incident list — Each incident shows title, status, sector, severity badge, current reporting phase, and countdown timer
• Colour-coded timers — Green (on track), amber (approaching deadline), red (overdue)

Click any incident to open its detail view with full reporting timeline, incident information, and audit trail.

4. Reporting an Incident

Click + Report Incident from the dashboard to create a new NIS2 incident. Required fields:

Once submitted, NIS2Shield automatically starts the Article 23 reporting cascade with deadline timers.

5. Deadline Tracking & Escalation

NIS2 Article 23 requires a three-phase notification cascade to your national CSIRT:

Automated Escalation

NIS2Shield runs an hourly deadline checker that monitors all active incidents. When a deadline threshold is reached, the app:

1. Posts a WARNING, URGENT, or OVERDUE comment on the linked Jira issue
2. Includes the phase name, severity, deadline timestamp, and a link to the NIS2Shield dashboard
3. Escalation thresholds are configurable in Settings (default: 75%, 90%, 100%)

6. CSIRT Notification Templates

NIS2Shield generates pre-formatted notification templates for each reporting phase. From any incident detail view:

1. Click Generate CSIRT Templates
2. Select the template type (Early Warning, Incident Notification, or Final Report)
3. The template is auto-populated with your incident data and organisation details
4. Use Copy to Clipboard or Download .txt to export

Templates follow the structure recommended by ENISA and include:

• Reporting entity and national CSIRT identification
• Incident summary with classification and severity
• Initial assessment (malicious cause, cross-border impact)
• Impact scope (affected services, estimated users, geographic scope)
• Next steps and contact information

7. Jira Issue Integration

NIS2Shield integrates directly into your Jira workflow through two touchpoints:

Issue Panel

Every Jira issue displays an NIS2 Incident panel in the sidebar. From here you can:

• Link an existing NIS2 incident to the Jira issue
• View the linked incident's severity, current phase, and countdown timer
• See key details: sector, cross-border impact, malicious indicator
• Navigate directly to the full incident view in the dashboard

Automated Comments

When a deadline threshold is reached, NIS2Shield posts a comment directly on the linked Jira issue with the alert level (WARNING, URGENT, or OVERDUE), phase details, and a link to take action in the dashboard. This ensures your incident response team is notified within their existing Jira workflow.

8. Settings & Configuration

Access settings from the dashboard by clicking the Settings button. Configuration is divided into three sections:

Organisation

• Organisation Name — Used in CSIRT notification templates
• Primary Sector — Your NIS2 sector classification (determines which CSIRT to notify)

CSIRT & Contacts

• National CSIRT — Your designated national Computer Security Incident Response Team
• Contact Email — Primary contact for CSIRT communications

Deadline Notifications

• Warning Threshold — First alert when this percentage of the deadline has elapsed (default: 75%)
• Urgent Threshold — Escalated alert at this percentage (default: 90%)
• Overdue Threshold — Final alert when the deadline has passed (100%)

9. Audit Trail

Every incident maintains a complete audit trail for compliance evidence. Tracked events include:

• Incident created — With creation timestamp and creator
• Phase submitted — When a reporting phase is marked as submitted to CSIRT
• Incident updated — Any field changes with before/after values
• Issue linked — When a Jira issue is linked to the incident
• Escalation sent — When automated deadline notifications are posted
• Incident resolved — When the incident is marked as closed

The audit trail is visible in the incident detail view and provides the timestamped evidence trail required for NIS2 compliance audits.

10. NIS2 Article 23 Reference

NIS2Shield implements the reporting obligations defined in Article 23 of Directive (EU) 2022/2555 (the NIS2 Directive). Key provisions:

• Article 23(1) — Entities must notify their CSIRT of any significant incident without undue delay
• Article 23(3) — Defines what constitutes a "significant" incident (significant impact on service provision)
• Article 23(4)(a) — Early Warning within 24 hours of becoming aware of the incident
• Article 23(4)(b) — Incident Notification within 72 hours with severity assessment and indicators of compromise
• Article 23(4)(d) — Final Report within one month with root cause analysis and mitigation measures

Penalties for non-compliance: Up to €10,000,000 or 2% of global annual turnover, whichever is higher. Member states may also impose personal liability on senior management.

NIS2Shield does not provide legal advice. Users are responsible for verifying compliance with their specific national transposition of the NIS2 Directive.

11. FAQ

12. Support

Need help? Reach out through any of these channels:

• Email: support@ironclad-forge.com
• Atlassian Community: Ask questions or browse answers on the NIS2Shield community page
• Response time: We aim to respond to all support requests within 24 hours on business days