Does NIS2 prescribe specific patch deadlines?

No. NIS2 sets no fixed deadlines in days for individual patches. Art. 21 does, however, require a risk-based process for handling vulnerabilities, along with its effectiveness and documentation — you derive deadlines from criticality.

What must NIS2 patch management be able to demonstrate?

A complete asset base, the patch status per system, the risk assessment of open vulnerabilities, the treatment applied and a complete history. What matters is the ability to provide evidence to supervisory authorities and management at any time.

Is patching alone sufficient for the NIS2 vulnerability obligation?

No. Where a patch is unavailable or cannot be applied, NIS2 requires a documented alternative risk treatment — such as isolation, hardening or compensating controls. This handling must be recorded traceably.

Does the vulnerability obligation also apply to the supply chain?

Yes. Art. 21 explicitly includes the security of the supply chain. Vulnerabilities in third-party software you use and at service providers must be captured and treated just like those in your own systems.

NIS2

Patch and vulnerability management under NIS2

NIS2 does not set a patch deadline; it requires a demonstrable process: detect, assess, treat and document vulnerabilities. What that means in practice — and how the evidence can be produced without maintaining spreadsheets by hand.

What NIS2 actually requires for patching

NIS2 contains no article that prescribes a specific patch interval. The obligation arises from Art. 21: operators must take technical and organisational measures to manage the risks to their network and information systems. These explicitly include vulnerability handling and disclosure, as well as policies for assessing the effectiveness of these measures.

In practice, that means: what counts is not the deadline but the demonstrable process. You must be able to show that you systematically detect vulnerabilities, prioritise them by risk, treat them on time and document the whole process.

The four stages of a robust process

Detect. A complete asset base and continuous reconciliation against known vulnerabilities (CVE data). Without a complete inventory, every patch report remains incomplete.
Assess. Prioritisation by system criticality and vulnerability severity — not every gap is equally urgent, but every one must be classified.
Treat. Apply the patch where possible. Where not: a documented alternative — isolation, hardening, compensating control. A “can’t be done” without justification is not an acceptable end state.
Evidence. A complete history of status, decision and timing — retrievable at any time for supervisory authorities and senior management.

Where it fails in practice

Most organisations do patch. What is missing is the evidence. Patch status lives spread across several tools, the asset base is out of date and the justification for unplanned exceptions sits — if anywhere — in an email. In an audit, no consistent risk treatment can be reconstructed from that.

Added to this is the tension between speed and stability: patching quickly increases security but risks operational disruption. Precisely this conflict leads to critical updates being postponed — and thus to the gap NIS2 aims to close.

How OneLog produces the evidence

OneLog does not treat patch management as an isolated function but as part of an end-to-end vulnerability workflow:

Inventory as foundation. Every asset is captured and linked to its patch status — the basis for every NIS2 report.
Automated rollout. Updates are rolled out via zero-touch patching, staged through canary deployment, so that stability and speed are not an either/or.
Risk-based prioritisation. Open vulnerabilities are classified by criticality rather than presented as a flat list.
Autonomous remediation. AI agents handle defined vulnerability tickets end-to-end — including a logged decision.
Audit-ready history. Every step — detection, assessment, treatment, exception — lands in continuous, exportable documentation.

The result is the one thing NIS2 requires at its core: you can demonstrate at any time what state your estate is in and why.

Sovereignly verifiable

OneLog is operated in the STACKIT Sovereign Cloud, headquartered in Germany and with no US cloud exposure. For a tool that processes patch and vulnerability data for your entire infrastructure, that is not a side issue but part of the NIS2 requirement for the security of the systems in use. Certified to ISO 27001:2022; the TOMs under Art. 32 GDPR are published.

Frequently asked questions

Does NIS2 prescribe specific patch deadlines?: No. NIS2 sets no fixed deadlines in days for individual patches. Art. 21 does, however, require a risk-based process for handling vulnerabilities, along with its effectiveness and documentation — you derive deadlines from criticality.
What must NIS2 patch management be able to demonstrate?: A complete asset base, the patch status per system, the risk assessment of open vulnerabilities, the treatment applied and a complete history. What matters is the ability to provide evidence to supervisory authorities and management at any time.
Is patching alone sufficient for the NIS2 vulnerability obligation?: No. Where a patch is unavailable or cannot be applied, NIS2 requires a documented alternative risk treatment — such as isolation, hardening or compensating controls. This handling must be recorded traceably.
Does the vulnerability obligation also apply to the supply chain?: Yes. Art. 21 explicitly includes the security of the supply chain. Vulnerabilities in third-party software you use and at service providers must be captured and treated just like those in your own systems.

Read on

See OneLog in your environment

Monitors and maintains your IT remotely and fixes many incidents automatically — hosted in the EU, with no dependency on US cloud providers. NIS2 requirements are built in from the start.

Try OneLog Talk to the founder