NIS2 (Directive (EU) 2022/2555) applies to medium and large entities in essential and important sectors. claimio processes insurance damage claims for insurers and car rental companies.

Preliminary assessment: claimio is likely an important entity under NIS2 as a digital service provider (SaaS) serving the financial/insurance sector. Full assessment requires legal review of Dutch NIS2 implementation (Cyberbeveiligingswet).

Action required: Obtain legal opinion on formal NIS2 scope applicability.

2. Art. 21 Security Measures Assessment

2.1 Risk Management (Art. 21(2)(a))

| Control | Status | Implementation | |---------|--------|----------------| | Risk assessment process | ✅ Implemented | Risk register maintained in /ocs/claimio/risk-assessment.md | | Regular risk reviews | 🔶 Partial | Triggered by incidents; formal annual review not yet scheduled | | BCDR plan | ✅ Implemented | /ocs/claimio/bcdr.md — RTO 4h, RPO 24h |

Gap: Schedule formal annual risk review. Owner: Tech Lead. Due: Q3 2026.

2.2 Incident Handling (Art. 21(2)(b))

| Control | Status | Implementation | |---------|--------|----------------| | Incident detection | ✅ Implemented | Application logging, k8s health checks, backup verify workflow | | Incident response procedure | ✅ Implemented | /ocs/claimio/processes/incident-handling.md | | Significant incident reporting | ✅ Implemented | AP notification procedure in incident handling doc | | Incident log | ✅ Implemented | Structured log template defined |

NIS2 Art. 23 reporting timelines:

Early warning: within 24h of awareness
Incident notification: within 72h
Final report: within 1 month

Gap: Identify and register as NIS2 entity with NCSC-NL once legally confirmed. Due: Q2 2026.

2.3 Business Continuity (Art. 21(2)(c))

| Control | Status | Implementation | |---------|--------|----------------| | Backup management | ✅ Implemented | Nightly pg_dump to S3 with Object Lock; 90-day retention | | Disaster recovery | ✅ Implemented | BCDR runbook; weekly automated restore test | | Crisis management | 🔶 Partial | Escalation matrix defined; formal crisis team not established |

Gap: Establish formal crisis management team and run tabletop exercise. Due: Q3 2026.

2.4 Supply Chain Security (Art. 21(2)(d))

| Control | Status | Implementation | |---------|--------|----------------| | Supplier/processor assessment | 🔶 Partial | TransIP and auditPic identified; DPA agreements pending | | Third-party access controls | ✅ Implemented | auditPic integration uses API key; no direct DB access | | Sub-processor register | 🔶 Partial | Documented in verwerkingsregister; DPAs to be concluded |

Gap: Conclude DPA agreements with TransIP and auditPic. See /ocs/claimio/processes/dpa-agreements.md. Due: Q2 2026.

2.5 Security in Network and Information Systems (Art. 21(2)(e))

| Control | Status | Implementation | |---------|--------|----------------| | Network segmentation | ✅ Implemented | k8s namespaces; ClusterIP services (no unnecessary exposure) | | Secure by default configuration | ✅ Implemented | readOnlyRootFilesystem, non-root containers, dropped ALL capabilities | | Vulnerability management | ✅ Implemented | OWASP dependency-check (CVSS≥7 fails build); OWASP ZAP scan in CI | | Patch management | ✅ Implemented | Dependabot configured for Maven, Docker, Flutter/pub, and GitHub Actions (.github/dependabot.yml) |

2.6 Access Control and Identity Management (Art. 21(2)(i))

| Control | Status | Implementation | |---------|--------|----------------| | Authentication | ✅ Implemented | JWT (HS256) with ≥32-char secret; bcrypt password hashing | | MFA | ❌ Not implemented | Single-factor for all users | | Least privilege | ✅ Implemented | DB limited user (claimio_app) with DML-only; role-based (CLAIMANT/REVIEWER/ADMIN) | | Session management | ✅ Implemented | Short-lived JWTs (24h) + refresh token rotation | | Access revocation | ✅ Implemented | Logout invalidates refresh token; JWT rotation workflow available |

Gap: Implement MFA for REVIEWER and ADMIN roles. Due: Q3 2026.

2.7 Cryptography (Art. 21(2)(h))

| Control | Status | Implementation | |---------|--------|----------------| | Encryption in transit | ✅ Implemented | TLS via cert-manager (Let's Encrypt) on ingress | | Encryption at rest — PII | ✅ Implemented | AES-256-GCM via EncryptedStringConverter; HMAC-SHA256 blind index | | Encryption at rest — passwords | ✅ Implemented | bcrypt (Spring Security default rounds) | | Key management | ✅ Implemented | Keys in 1Password → Bitnami Sealed Secrets; JWT_PREVIOUS_SECRET for rotation | | Photo integrity | ✅ Implemented | SHA-256 + HMAC-SHA256 via auditPic microservice |

2.8 Human Resources Security (Art. 21(2)(g))

| Control | Status | Implementation | |---------|--------|----------------| | Security awareness training | ❌ Not implemented | Currently a small team; no formal training program | | Background checks | 🔶 Partial | Informal; no formal screening process | | Security responsibilities defined | 🔶 Partial | Roles defined in code (CLAIMANT/REVIEWER/ADMIN); HR policy not documented |

Gap: Create security awareness training for all staff. Due: Q4 2026.

3. Gap Summary

| # | Gap | Priority | Due | |---|-----|----------|-----| | 1 | Legal NIS2 scope determination | High | Q2 2026 | | 2 | NCSC-NL registration (if applicable) | High | Q2 2026 | | 3 | DPA agreements with TransIP + auditPic | High | Q2 2026 | | 4 | MFA for reviewer/admin roles | Medium | Q3 2026 | | 5 | Annual risk review schedule | Medium | Q3 2026 | | 6 | Security awareness training | Low | Q4 2026 | | 7 | Tabletop incident/BC exercise | Low | Q3 2026 |

4. Document Maintenance

| Version | Date | Author | Changes | |---------|------|--------|---------| | 1.0 | 2026-03-30 | GloryLabs | Initial version | | 1.1 | 2026-04-14 | GloryLabs | Close gap #6: Dependabot enabled for all ecosystems. |

Reacties

Nog geen reacties

Athena — claimio/compliance/nis2.md

title: NIS2 Controls Assessment project: claimio version: 1.0 date: 2026-03-30 owner: GloryLabs classification: Internal

NIS2 Controls Assessment — claimio

1. Applicability