NIS2 Evidence Pack

Currency check 2026-10-07: owner paths/source placement verified against 3238bd511a37e199ae99d4f17be2f13eabec8dd7. The supported boundary is /api/offlinekit/v1/exports (src/OfflineKit/StellaOps.OfflineKit.WebService/Program.cs). Re-verify the host mount and owning endpoint extension together. This is source verification; deployment and broader audit coverage are separate evidence. Other dated findings retain their stated dates. Re-verify: rg -n "MapGroup|Map.*Endpoints|AddHostedService" src/OfflineKit/StellaOps.OfflineKit.WebService/Program.cs, then inspect the endpoint extension or library pointer cited at the operation.

This is the entry point for the NIS2 pack: start here, then follow the pack surfaces for the control register, Statement of Applicability export, Article 23 incident reporting, and the KPI dashboard.

The NIS2 Evidence Pack is an optional Assurance pack for customers/operators that need NIS2-oriented evidence views. Stella supplies control, evidence, export, timeline, and dashboard primitives; the customer/operator remains the regulated decision-maker.

Claim boundary: operator-support.

Primary evidence scope: operator-observed-estate.

The pack is software-estate assurance for systems Stella can monitor, deploy, scan, or control for the operator. It can package evidence from releases, container images, services, integrations, plugins, host agents, policy gates, SBOM/VEX, reachability, and EvidenceLocker bundles. Legal entity classification, governance ownership, physical security, HR/training, business-continuity process evidence, and non-Stella supplier contracts remain operator-supplied.

Pack Surfaces

ExportCenter Profiles

Reporting Timeline Profiles

Source Contracts And Module Docs

• Assurance Runtime
• Assurance Scope Model
• Assurance Pack v1
• Assurance Control Register v1
• Assurance Evidence Export v1
• Assurance Reporting Timeline v1
• Assurance Setup Prerequisites v1
• Policy NIS2 control register guide
• OfflineKit architecture
• Notify NIS2 CSIRT channel
• CLI export command guide
• Stella Supplier Evidence Profile v1

Product Boundary

This pack must not say that Stella itself is a customer’s NIS2-regulated entity. It should say that Stella helps a customer maintain evidence, produce signed exports, and prepare operator-owned reporting handoffs.

Do not use this pack as legal advice, automatic regulator submission, a human resources training system, or a physical-security system of record. Tenant supplied evidence remains labelled as tenant supplied.

When Stella Ops itself is part of the customer’s software estate, the stella.supplier-evidence profile may be attached as supplier evidence. That profile does not make Stella the customer’s NIS2-regulated entity.

Change Log