NIS2 Statement Of Applicability Export

Part of the NIS2 Evidence Pack. Audience: an operator’s compliance officer producing a signed Statement of Applicability for audit or regulator handoff.

The NIS2 Statement of Applicability (SoA) export turns a tenant control-register snapshot into a deterministic, signed evidence bundle. It is an operator-owned export for review, audit, or handoff; it is not a Stella Ops certification claim.

Claim boundary: operator-support.

Source Docs

• NIS2 Statement of Applicability Contract v1
• Assurance Evidence Export v1
• Assurance Setup Prerequisites v1
• ExportCenter architecture
• CLI export command guide
• Policy NIS2 control register guide

Readiness Boundary

Export readiness requires live tenant inputs and production signing trust roots. Missing Authority profile data, signing configuration, storage roots, or tenant export trust roots must fail closed with stable reason codes.

Fixture data can support local development and contract tests. It must never be reported as production SoA evidence.

The generic ExportCenter Assurance profile id is nis2.statement-of-applicability. It is discoverable through GET /v1/exports/assurance/profiles and keeps the typed compatibility routes GET /v1/exports/nis2/soa/profile, POST /v1/exports/nis2/soa/runs, GET /v1/exports/nis2/soa/runs/{runId}, and GET /v1/exports/nis2/soa/runs/{runId}/bundle.

Expected Operator Flow

1. Publish a Policy control-register snapshot via the Console “Publish SoA snapshot” action (NIS2 control-register page) or POST /api/policy/control-register/nis2/snapshot (scope policy:operate). The publish enforces SoA completeness — every one of the thirteen NIS2 thematic areas must carry an explicit applicability decision, or the publish is blocked with HTTP 422 SOA_INCOMPLETE listing the missing areas — and returns the pinned contentHash / soaExportHash that the ExportCenter SoA run consumes.
2. Confirm the tenant compliance profile and export trust roots are configured.
3. Check readiness via GET /v1/exports/assurance/profiles/nis2.statement-of-applicability/readiness before enabling the export action.
4. Run the typed ExportCenter NIS2 SoA route or compatible CLI command.
5. Verify the signed bundle and store the artifact with its evidence refs.

Setup Wizard Handoff

The optional setup assurance step shows the NIS2 SoA live-export prerequisite groups and links to the owning surfaces. It does not enable the pack by default and does not store export settings in browser state.

The NIS2 control-register export action must point blocked operators back to /setup-wizard/wizard?step=assurance when signed export prerequisites are missing. The action remains disabled until live Policy data and the owning readiness APIs report production-safe inputs.

Implementation Status (2026-06-16)

Verified against src/. This surface is shipped: the deterministic, signed SoA exporter (src/ExportCenter/.../Adapters/Nis2/Nis2SoaExporter.cs) and the typed ExportCenter routes (GET/POST /v1/exports/nis2/soa/..., in src/ExportCenter/.../WebService/Nis2Soa/Nis2SoaExportEndpoints.cs) are live. The hard HTTP 422 SOA_INCOMPLETE completeness gate over all 13 thematic areas is enforced at control-register publish time (POST /api/policy/control-register/nis2/snapshot); the SoA run consumes the pinned contentHash / soaExportHash from that publish.

Change Log