NIS2 Control Register

Part of the NIS2 Evidence Pack. Audience: an operator’s compliance officer mapping their NIS2 control posture in Stella Ops.

The NIS2 control-register surface helps an operator connect Stella Ops Policy controls, runbooks, metrics, and evidence references to the NIS2 thematic-area vocabulary used by the current gap-closure plan. It is the authoring foundation for the Statement of Applicability export.

Claim boundary: operator-support.

Operator Ownership

The customer/operator owns:

• applicability decisions;
• tenant-specific responsible roles;
• tenant-supplied evidence references;
• legal conclusions and auditor responses;
• publication of a Statement of Applicability.

Stella Ops owns the module-neutral Assurance control-register model, deterministic snapshots, evidence references, and read APIs that make those operator decisions repeatable. The NIS2 pack is an adapter over that model.

Source Docs

• NIS2 Control Register Contract v1
• Assurance Control Register v1
• Policy NIS2 control register guide
• NIS2 gap-closure research

Runtime Use

Policy remains the implementation owner. Product-facing Web and CLI surfaces read the live Policy API (or typed clients over it); they must not read Policy persistence tables or keep a second control-register store.

Unknown framework ids fail closed with UNKNOWN_FRAMEWORK.

The pack may show whether a control is Stella-native, tenant-supplied, or mixed. It must not turn tenant-supplied evidence into Stella-native telemetry.

Implementation Status (2026-06-16)

Verified against src/. This surface is shipped: author / publish / persist live in src/Policy/StellaOps.Policy.Engine/Endpoints/Nis2ControlRegisterEndpoints.cs (POST /api/policy/control-register/nis2 author, POST /api/policy/control-register/nis2/snapshot publish), with the regulatory ledger event (control:snapshot_published) and EvidenceLocker artifact-ledger rows. The snapshot publish enforces SoA completeness over all 13 thematic areas, failing closed with HTTP 422 SOA_INCOMPLETE when an area lacks an explicit applicability decision.

Change Log