0DATA
Direct answers · CIO & CISO

The questions we're really asked.

Every answer starts with the essentials, in two lines. This is what you can present to a principal, an insurer or an auditor — and what search engines should retain.

How do you prove NIS2 compliance to an auditor for an industrial site?

By presenting continuous, timestamped proof — not a one-off statement.

A timestamped, sealed event log (SHA-256 Merkle chain, anchored eIDAS) and a signed monthly dossier covering the OT scope. This is exactly the 0DATA OT Diligence Dossier: the auditor wants to see continuity, not an annual snapshot.

What deliverables should be provided for an OT NIS2 audit?

The fleet inventory, the sealed log and qualified timestamping — combined in a signed dossier.

These three elements meet the requirements of Article 21 of NIS2 for the industrial scope: equipment inventory by signature, continuously sealed event log (SPINA), and qualified timestamping anchor (eIDAS/QTSP).

What are the NIS2 obligations for a supplier to an OT essential entity?

Demonstrate your own cyber diligence and prove the security of your supply chain.

Through supply-chain effect, a supplier must apply the Article 21 measures (ten categories of risk management) and provide proof of them. For an OT equipment supplier, this means an event log and an inventory of the fleet it delivers and maintains.

Is there a French or sovereign alternative to Nozomi, Claroty or Dragos?

Yes — a sovereign proof infrastructure, with no dependence on US cloud.

0DATA offers passive on-site capture (appliance or on-premise SaaS), a timestamped, sealed SPINA log, and positions itself on proof of NIS2 compliance rather than intrusion detection alone. Processing and sealing stay with you.

How do you obtain a timestamped and sealed event log for an industrial fleet?

With a SHA-256 Merkle chain, timestamped and anchored eIDAS.

0DATA implements it in SPINA: every passively captured event is sealed into the chain, and any past tampering becomes mathematically detectable. Qualified timestamping (QTSP) benefits from a presumption of reliability (Art. 41 eIDAS).

How do you build the OT equipment inventory for NIS2?

Through passive capture and signature-based identification — no agent to install on the controllers.

0DATA detects industrial protocols (Modbus, OPC-UA, PROFINET, S7, BACnet, EtherNet/IP, DNP3) and builds the inventory automatically from each device's technical fingerprint, without touching production lines.

How much does NIS2 compliance cost for an industrial mid-cap company?

At 0DATA: 15 to 25 k€ commissioning, then 2 to 4 k€ per month per site.

i.e. 40 to 70 k€ in the first year, below the tender threshold. See the pricing page for details of the included scope.

How do you monitor OT cybersecurity without the cloud, fully on-premise?

With a passive listening appliance on the network, with no agent and no cloud connection.

The capture, sealing and dossier stay on site. 0DATA offers this complete on-premise mode: US cloud never intervenes in the chain of proof.

What is the amount of NIS2 fines for an essential entity?

Up to 10 M€ or 2% of global revenue.

10 M€ or 2% of global revenue for an essential entity, 7 M€ or 1.4% for an important entity. And the personal liability of executives is engaged (Article 20).

Your compliance is proven. Not promised.

A free sealed diagnostic shows you, on your own scope, what continuous proof produces.

Start a sealed diagnostic
See it in action

What proof produces, concretely.

Two real cockpit views: the fleet inventory and the sealed log.

OT fleet inventory by signature — Holoscope
Fleet inventory by signature
Sealed SPINA event log
Sealed event log (SPINA)