NIS2 Control Register
Part of the NIS2 Evidence Pack. Audience: an operator’s compliance officer mapping their NIS2 control posture in Stella Ops.
The NIS2 control-register surface helps an operator connect Stella Ops Policy controls, runbooks, metrics, and evidence references to the NIS2 thematic-area vocabulary used by the current gap-closure plan. It is the authoring foundation for the Statement of Applicability export.
Claim boundary: operator-support.
Operator Ownership
The customer/operator owns:
- applicability decisions;
- tenant-specific responsible roles;
- tenant-supplied evidence references;
- legal conclusions and auditor responses;
- publication of a Statement of Applicability.
Stella Ops owns the module-neutral Assurance control-register model, deterministic snapshots, evidence references, and read APIs that make those operator decisions repeatable. The NIS2 pack is an adapter over that model.
Source Docs
- NIS2 Control Register Contract v1
- Assurance Control Register v1
- Policy NIS2 control register guide
- NIS2 gap-closure research
Runtime Use
Policy remains the implementation owner. Product-facing Web and CLI surfaces read the live Policy API (or typed clients over it); they must not read Policy persistence tables or keep a second control-register store.
| Endpoint | When to use |
|---|---|
GET /api/policy/control-register/nis2 | The UI needs the NIS2 compatibility shape with thirteen thematicAreas[] summaries. |
GET /api/policy/control-register/frameworks/nis2 | The UI or export flow needs the generic assurance-control-register-v1 shape with areaOrDomain and externalRefs. |
Unknown framework ids fail closed with UNKNOWN_FRAMEWORK.
The pack may show whether a control is Stella-native, tenant-supplied, or mixed. It must not turn tenant-supplied evidence into Stella-native telemetry.
Implementation Status (2026-06-16)
Verified against src/. This surface is shipped: author / publish / persist live in src/Policy/StellaOps.Policy.Engine/Endpoints/Nis2ControlRegisterEndpoints.cs (POST /api/policy/control-register/nis2 author, POST /api/policy/control-register/nis2/snapshot publish), with the regulatory ledger event (control:snapshot_published) and EvidenceLocker artifact-ledger rows. The snapshot publish enforces SoA completeness over all 13 thematic areas, failing closed with HTTP 422 SOA_INCOMPLETE when an area lacks an explicit applicability decision.
Change Log
| Date (UTC) | Update |
|---|---|
| 2026-06-16 | Reconciled to verified src/: confirmed author/publish/persist endpoints, the regulatory ledger event, and the 422 SOA_INCOMPLETE completeness gate are shipped. |