The NIS2 directive is fundamentally changing the rules for critical infrastructure enterprises. A formal approach to compliance based on static paper documentation is no longer sufficient. Regulators now require verifiable evidence of security controls in real-time. Auditors are not interested in the mere existence of an approved policy, but in the digital footprint that confirms this policy is being executed without deviation on a daily basis.
The fundamental problem for organizations lies in the gap between declared security policies and actual operations. Policies often exist in isolation from daily workflows that are performed manually. In this environment, shadow IT and human error are inevitable. Up to 49% of security incidents can stem from unauthorized deviations from established procedures. The solution is a transition to the Compliance-by-Design concept, where security requirements are integrated directly into executable process models using BPM systems.
Why paper-based compliance fails under NIS2 pressure
Traditional approaches to security validation that rely on manual logging, correspondence, or the memory of specialists are vulnerable. Manual recording does not ensure значна частина accuracy of events, and human-created records are easily altered or compromised retroactively. Only about 13% of organizations that rely exclusively on manual control are able to provide auditors with a consistent digital footprint without difficulty.
Compliance with NIS2 requirements is achieved through automation. Implementing a process engine ensures transparency for the state of every process instance. BPM platforms transform regulations from passive text into an active algorithm that cannot be bypassed. Each step is recorded by the system, creating a reliable and immutable audit trail.
BPMN 2.0 and DMN: Standardizing security logic
To ensure a process is understandable for business, auditors, and IT systems, the BPMN 2.0 modeling language is used. Published as the international standard ISO/IEC 19510:2013, BPMN 2.0 allows for the creation of executable models that simultaneously document and manage the flow of tasks.
To manage complex check logic, the DMN (Decision Model and Notation) standard is used. DMN allows organizations to separate business rules (such as access criteria or approval matrices) from the direct BPMN process. This enables compliance officers to promptly update regulatory rules without the need for complete redesign or process code development.
Compliance-by-Design in action: Eliminating human error
The Compliance-by-Design principle technically restricts process execution to pre-designed secure routes, reducing the risk of human error. This works most effectively in three critical scenarios:
- Configuration change management: Mandatory approval steps are implemented for any changes to system configurations. The BPM system blocks the action until confirmation is received from authorized personnel, and this step cannot be technically bypassed by the user.
- Automated offboarding: When an employee's status changes, access rights must be revoked immediately. Automated offboarding scenarios ensure the instant blocking of rights as soon as data is updated in the HR system, closing access to critical infrastructure.
- Cybersecurity incident response: Each action taken by a specialist is time-stamped and logged for subsequent investigation, forming an indisputable evidentiary base for audits.
Process Mining: Detecting shadow routes and logs
Reality often deviates from ideal models. To detect such deviations, Process Mining technology is used, which reconstructs the actual execution of processes based on the analysis of event logs. It allows for the identification of bottlenecks and unauthorized "shadow" routes.
It is important to understand that Process Mining does not replace formal security checks or human oversight, but it creates a solid evidentiary base for audits, helping companies eliminate vulnerabilities even before an official NIS2 inspection.
Architectural requirements for BPM in regulated industries
For critical infrastructure enterprises (energy, finance, telecom), the use of exclusively cloud-based SaaS solutions is often unacceptable due to strict requirements for data localization and information protection. The ability to deploy on-premises is a baseline requirement.
Within the ecosystem of the Intecracy Group technology alliance—an alliance of independent companies linked by partner agreements and share exchanges—a comprehensive approach is used to build such processes. Process orchestration and rule management (based on BPMN, CMMN, and DMN standards) are implemented using the Scriptum low-code platform. The technological foundation for building complex architectures is the UnityBase platform (a joint development by Intecracy Group companies, where InBase is one of the key developers). UnityBase provides mechanisms critical for NIS2 at the core level: a unified metadata model, role-based access control (RBAC), row-level security (RLS), and a mandatory audit trail. For high-load systems or objects with increased security requirements, the platform's official documentation recommends using commercial Enterprise or Defence editions, which support on-premises deployment within secure perimeters.
It should be emphasized that installing any BPM software does not automatically guarantee NIS2 certification. The technology only works if there is proper design, process configuration, and appropriate corporate security governance.
Matrix of NIS2 requirements and BPM tools
| NIS2 Requirement | BPM Tool | Result |
|---|---|---|
| Access control and authentication | Role-based model (RBAC) and row-level security (RLS) | The user sees and executes only permitted process steps. |
| Incident management | Automated incident response workflows with strict SLAs | Each action is time-stamped, creating an immutable audit trail. |
| Configuration change management | Executable BPMN 2.0 models with mandatory approval | Technical blocking of unauthorized changes in critical infrastructure. |
| Business continuity | Orchestration of backup and emergency scenarios | Rapid switching of processes to alternative routes in case of failure. |
FAQ
How can we prove to a NIS2 auditor that our security processes are actually being executed in accordance with regulations?
The best proof is the digital footprint (audit trail) automatically generated by the BPM system engine. It contains the exact time of each process step, the identifiers of the executors, and the results of checks, which cannot be altered manually.
Can a BPM system fully automate the revocation of access rights when an employee is terminated?
Yes, through the integration of executable process models with HR systems and identity and access management (IAM) tools. Changing an employee's status in the HR system automatically triggers a workflow to instantly block their accounts across all target systems.
What is the role of BPMN 2.0 and DMN standards in ensuring compliance with regulatory requirements?
BPMN 2.0 (ISO/IEC 19510:2013) allows for the creation of executable models that simultaneously document and manage the process. The DMN standard separates dynamic compliance rules from the process, simplifying their update without rewriting code.