NIS2 and certificate management
sslbrain supports compliance with NIS2 Article 21 through documented, monitored, self-healing certificate processes and an immutable audit log you can export as CSV or JSON.
NIS2 Article 21: how sslbrain covers the requirements
Mapping the NIS2 Article 21 controls that touch cryptographic infrastructure to concrete sslbrain features. sslbrain supports compliance; it does not replace your overall ISMS.
| NIS2 control | sslbrain feature |
|---|---|
| Risk analysis and information system security policies | Policy Management with pre-seeded templates, immutable audit log, documented renewal and remediation plans. |
| Incident handling | Notification relay with escalation, retry logic for renewals, audit log with full event history for the auditor. |
| Cryptography and encryption | Auto DNS, Auto DNS+, ACME automation, policy enforcement of TLS protocols, cipher suites, and key types. |
| Access control and RBAC | 10 RBAC users from Pro, AD/LDAP integration on Pro+, separate permissions for view, administration, and key access. |
| Asset management | Endpoint discovery, certificate inventory, ARI-aware expiry tracking, central view of all managed endpoints. |
| Supply-chain security | Module signing, agent inspectability, source-available appliance code, signed component distribution from sslbrain Cloud. |
| Audit logs | Immutable audit log with CSV and JSON export. Kept for two years and never less than one. A single NIS2 evidence bundle for auditors is in development. |
sslbrain supports compliance with the controls listed above. NIS2 compliance is contextual and determined by your overall control environment and supervisory authority.
Sample audit log line
sslbrain writes every event to an immutable audit log that you can export as CSV or JSON, filtered by time range, action, and user. Both formats below come from the same event.
[
{
"timestamp": "2026-04-27T14:32:11+00:00",
"user_name": "alice@example.dk",
"action": "auth.login",
"entity_type": "user",
"entity_id": null,
"ip_address": "10.0.4.17",
"detail": null,
"actor_type": "user",
"actor_id": "3",
"actor_name": "alice@example.dk",
"auditable_type": "user",
"auditable_id": "3",
"old_values": null,
"new_values": null,
"chain": "appliance",
"chain_seq": 18342
}
]The same event in the JSON export. The file is an array with one object per event.
Tidspunkt,Bruger,Handling,Entitet,"Entitet ID",IP,Detaljer,Aktørtype,"Aktør ID",Aktørnavn,Objekttype,"Objekt ID",Før,Efter,Kæde,Kædenummer
2026-04-27T14:32:11+00:00,alice@example.dk,auth.login,user,,10.0.4.17,null,user,3,alice@example.dk,user,3,null,null,appliance,18342The same event in the CSV export. Column headers are in Danish.
A NIS2 evidence bundle for auditors is coming
We are building a single export for auditors covering a chosen time range, mapped to NIS2 article 21. It has not shipped yet. Until it does, export the audit log as CSV or JSON for the period your auditor asks about.
What sslbrain provides
sslbrain is not compliance software. It is a certificate management tool that supports compliance with the requirements NIS2 places on cryptographic infrastructure.
Documented processes
Every certificate operation is recorded in an immutable audit log with timestamp, user, and outcome. Renewal plans live in the system, not in a script on someone's machine.
Monitoring and alerts
Dashboard with real-time status on every certificate. Notifications on failure, expiry, and unexpected behaviour. No silent failures.
Self-healing automation
Automatic renewal with retry logic and escalation. When a renewal fails, sslbrain retries and alerts the administrator.
Role-based access
RBAC with separate permissions for view, administration, and key management. Every action is traceable to a specific user.
Encrypted vault
Private keys live in an encrypted vault. Key material is never available in cleartext on disk.
Source-available code
sslbrain is source-available. The code can be inspected, reviewed, and assessed by your organisation or a third party.
Frequently asked questions
Which NIS2 Article 21 controls does sslbrain support?
sslbrain supports compliance with controls related to cryptography, incident handling, access control, asset management, supply-chain security, audit logging, and documented processes. It is concrete support for risk management, not a certification.
How long is the audit log retained?
The audit log is kept for two years, and sslbrain never prunes events younger than one year. To keep the log longer outside sslbrain, export it as CSV or JSON.
Which export formats are supported?
CSV and JSON. Each event carries timestamp, user, action, object, IP address, actor, values before and after the change, and its position in the hash chain. Forwarding straight to a SIEM over syslog has not shipped yet and is on the roadmap.
Is there a single evidence bundle for auditors?
Not yet. A NIS2 evidence bundle is in development for Pro and Enterprise. Until it is ready, export the audit log as CSV or JSON for the period your auditor asks for.
What does sslbrain not cover for NIS2?
sslbrain covers the cryptographic control surface around TLS certificates and their lifecycle. It is not a full ISMS platform. NIS2 compliance requires multiple controls across your organisation; sslbrain provides one concrete control for the part of the risk picture that concerns TLS.
Get started with sslbrain
Create a free account and choose Community or a paid edition. During pre-launch the account reserves your place, and we notify you the moment your edition is ready.