+ NIS2 Art. 21 mandates asset inventory, patch management, access
+ control, and audit trails as baseline technical measures. netOrk
+ doesn't bolt on a compliance layer — these are its day-to-day outputs.
+
diff --git a/src/pages/Nis2.tsx b/src/pages/Nis2.tsx
new file mode 100644
index 0000000..5d9cd7f
--- /dev/null
+++ b/src/pages/Nis2.tsx
@@ -0,0 +1,298 @@
+import { Link } from 'react-router-dom'
+import { ShieldCheckIcon } from '@heroicons/react/24/outline'
+
+type Coverage = 'covered' | 'partial' | 'roadmap' | 'na'
+
+type Requirement = {
+ article: string
+ label: string
+ coverage: Coverage
+ netork: string
+}
+
+const REQUIREMENTS: Requirement[] = [
+ {
+ article: 'Art. 21 (2a)',
+ label: 'Risk analysis & information system security policies',
+ coverage: 'partial',
+ netork:
+ 'Config drift detection, SNMP health metrics, and security agent coverage across all devices provide a continuous risk baseline. A formal risk register is out of scope for netOrk.',
+ },
+ {
+ article: 'Art. 21 (2b)',
+ label: 'Incident handling',
+ coverage: 'partial',
+ netork:
+ 'Wazuh alert history, CrowdSec decisions, and Graylog syslog per device surface incidents at the network layer. A structured incident record with NIS2 Art. 23 reporting timers is on the roadmap.',
+ },
+ {
+ article: 'Art. 21 (2c)',
+ label: 'Business continuity, backup management, disaster recovery',
+ coverage: 'roadmap',
+ netork:
+ 'Git-backed configuration snapshots (on roadmap) provide config-level recovery. Backup monitoring for individual devices is not yet implemented.',
+ },
+ {
+ article: 'Art. 21 (2d)',
+ label: 'Supply chain security',
+ coverage: 'partial',
+ netork:
+ 'Vendor, model, firmware, and OS version are tracked per device after every poll. EOL tracking against endoflife.date is on the roadmap to flag unsupported software.',
+ },
+ {
+ article: 'Art. 21 (2e)',
+ label: 'Vulnerability handling in acquisition, development & maintenance',
+ coverage: 'covered',
+ netork:
+ 'Per-device update status and installed package list tracked on every poll. Wazuh CVE counts by severity (critical / high / medium) linked directly to each device record. CVE cross-reference against NVD/OSV (without Wazuh) is on the roadmap.',
+ },
+ {
+ article: 'Art. 21 (2f)',
+ label: 'Assessing effectiveness of cybersecurity measures',
+ coverage: 'partial',
+ netork:
+ 'The audit log records all orchestration actions. A per-site compliance dashboard (on roadmap) will aggregate security agent coverage, drift status, and patch metrics into a single view.',
+ },
+ {
+ article: 'Art. 21 (2g)',
+ label: 'Basic cyber hygiene & cybersecurity training',
+ coverage: 'na',
+ netork:
+ 'Out of scope for a network orchestration platform. Training and hygiene policies are handled at the organizational level.',
+ },
+ {
+ article: 'Art. 21 (2h)',
+ label: 'Access control, asset management, human resources security',
+ coverage: 'covered',
+ netork:
+ 'Full device inventory maintained automatically via discovery and continuous polling. RBAC with four built-in roles (viewer / operator / engineer / administrator) and custom role combinations. Complete audit log of all orchestration actions.',
+ },
+ {
+ article: 'Art. 21 (2i)',
+ label: 'Multi-factor authentication',
+ coverage: 'roadmap',
+ netork:
+ 'TOTP-based MFA for netOrk user accounts is on the roadmap. Current authentication is JWT-based (username + password).',
+ },
+ {
+ article: 'Art. 21 (2j)',
+ label: 'Physical and environmental security',
+ coverage: 'na',
+ netork:
+ 'Out of scope. Physical security of the infrastructure hosting netOrk is an organizational and facility concern.',
+ },
+]
+
+const EVIDENCE = [
+ {
+ trigger: 'Every device poll',
+ produces: [
+ 'Installed package list with versions',
+ 'Available update count',
+ 'Interface status, ARP table, DHCP leases',
+ 'VLAN membership vs. desired state (drift)',
+ 'SNMP health metrics (CPU, memory, interface counters)',
+ 'Wazuh agent status and CVE counts by severity',
+ 'Graylog syslog forwarding status',
+ 'CrowdSec decisions and ban counts',
+ ],
+ },
+ {
+ trigger: 'Every user action',
+ produces: [
+ 'Audit log entry: user, timestamp, resource, action',
+ 'Before/after values for configuration changes',
+ ],
+ },
+ {
+ trigger: 'On demand',
+ produces: [
+ 'Topology graph — network segmentation view',
+ 'Subnet browser — IP space coverage',
+ 'VLAN matrix — which devices carry which VLANs',
+ 'Audit log export to PDF / CSV (roadmap)',
+ ],
+ },
+]
+
+function CoverageTag({ coverage }: { coverage: Coverage }) {
+ if (coverage === 'covered')
+ return (
+
+ ✓ Covered
+
+ )
+ if (coverage === 'partial')
+ return (
+
+ ⚠ Partial
+
+ )
+ if (coverage === 'roadmap')
+ return (
+
+ → Roadmap
+
+ )
+ return (
+
+ — N/A
+
+ )
+}
+
+export default function Nis2() {
+ return (
+
+
+
+ {/* Header */}
+
+
+
+
+
+ NIS2 & netOrk
+
+
+ NIS2 Art. 21 defines ten categories of technical and organizational
+ measures. Some of them are directly addressed by what netOrk does
+ every day. This page maps each requirement to netOrk's current
+ capabilities — honestly, including what's partial and what's not
+ applicable.
+
+
+
+ {/* Art. 21 mapping */}
+
+
+ Art. 21 — requirement by requirement
+
+
+ {REQUIREMENTS.map((r, i) => (
+
+
+
+ {r.article}
+ {r.label}
+
+
+
+
{r.netork}
+
+ ))}
+
+
+ {/* Legend */}
+
+ netOrk covers this today
+ partially covered — see description
+ planned — see roadmap
+ outside scope of a network management tool
+
+
+
+ {/* Evidence produced */}
+
+
+ What netOrk produces as evidence
+
+
+ NIS2 audits require demonstrable outputs, not just claimed controls. Here's
+ what netOrk generates automatically.
+
+
+ {EVIDENCE.map((e) => (
+
+
+ {e.trigger}
+
+
+ {e.produces.map((item) => (
+
+
+ {item}
+
+ ))}
+
+
+ ))}
+
+
+
+ {/* Roadmap callout */}
+
+
+ What's coming
+
+
+ {[
+ {
+ title: 'CVE tracking per device',
+ detail: 'Automatic cross-reference of installed packages against NVD / OSV — no Wazuh agent required.',
+ },
+ {
+ title: 'Configuration backup & versioning',
+ detail: 'Git-backed config snapshots after every poll. Detect unauthorized changes, compare over time.',
+ },
+ {
+ title: 'Compliance dashboard',
+ detail: 'Per-site Art. 21 checklist: asset coverage, patch status, agent deployment, drift, syslog, audit activity.',
+ },
+ {
+ title: 'Audit log export',
+ detail: 'PDF and CSV export filtered by date range, device, user, or action — ready to hand to an auditor.',
+ },
+ {
+ title: 'Incident workflow',
+ detail: 'Structured incident records with NIS2 Art. 23 reporting timers (24 h / 72 h) and external webhook delivery.',
+ },
+ {
+ title: 'EOL tracking',
+ detail: 'Flag devices running end-of-life firmware or OS versions via the endoflife.date API.',
+ },
+ {
+ title: 'MFA (TOTP)',
+ detail: 'Time-based one-time passwords as a second factor for netOrk user accounts (Art. 21 (2i)).',
+ },
+ ].map((item) => (
+
+
+
+
{item.title}
+
{item.detail}
+
+
+ ))}
+
+
+
+ Full roadmap →
+
+
+
+
+ {/* CTA */}
+
+
+ Start with the foundation.
+
+
+ Asset inventory, continuous polling, drift detection, RBAC, and a full
+ audit log — deployed in one command.
+
+
+ Get started →
+
+
+
+
+
+ )
+}
diff --git a/src/pages/Roadmap.tsx b/src/pages/Roadmap.tsx
new file mode 100644
index 0000000..f2a1802
--- /dev/null
+++ b/src/pages/Roadmap.tsx
@@ -0,0 +1,143 @@
+type Item = {
+ title: string
+ detail: string
+ nis2?: boolean
+}
+
+type Group = {
+ label: string
+ items: Item[]
+}
+
+const GROUPS: Group[] = [
+ {
+ label: 'Planned',
+ items: [
+ {
+ title: 'CVE tracking per device',
+ detail:
+ 'Cross-reference installed packages and OS versions against NVD / OSV. Surfaces "this device has 3 unpatched CVEs (CVSS ≥ 7)" without leaving netOrk.',
+ nis2: true,
+ },
+ {
+ title: 'Configuration backup & versioning',
+ detail:
+ 'Git-backed config snapshots on every poll. Detect unauthorized changes between snapshots and provide rollback targets.',
+ nis2: true,
+ },
+ {
+ title: 'Compliance dashboard',
+ detail:
+ 'Per-site Art. 21 checklist: asset coverage, patch status, security agent deployment, config drift, syslog forwarding, audit activity — aggregated into a single view.',
+ nis2: true,
+ },
+ {
+ title: 'Audit log export',
+ detail:
+ 'PDF and CSV export of the audit log, filtered by date range, device, user, or action type. For NIS2 audit submissions and internal reviews.',
+ nis2: true,
+ },
+ {
+ title: 'Webhook engine',
+ detail:
+ 'Outbound HTTP webhooks for events: device discovered, config change detected, job failed, alert threshold exceeded. HMAC-SHA256 payload signing. Integrates with n8n, Slack, PagerDuty.',
+ },
+ {
+ title: 'Live job log streaming',
+ detail:
+ 'WebSocket endpoint for real-time Celery task output in the UI. Currently streamed via SSE for fix-flows; full job log streaming for all long-running operations.',
+ },
+ {
+ title: 'NetBox sync — manual trigger & status view',
+ detail:
+ 'POST /api/v1/netbox/sync endpoint with progress feedback and a sync history view in the UI. Currently sync runs automatically; the manual trigger and status are missing.',
+ },
+ ],
+ },
+ {
+ label: 'Under consideration',
+ items: [
+ {
+ title: 'Incident workflow',
+ detail:
+ 'Structured incident record tied to devices and security events. Fristen-Tracker for NIS2 Art. 23 reporting windows (24 h early warning, 72 h full notification). Webhook to external ticketing systems.',
+ nis2: true,
+ },
+ {
+ title: 'EOL tracking for firmware and OS',
+ detail:
+ 'Flag devices running end-of-life software via the endoflife.date API. Covers OPNsense, OpenWRT, Debian, Ubuntu, and more — matched to the OS versions netOrk already polls.',
+ nis2: true,
+ },
+ {
+ title: 'MFA (TOTP) for netOrk login',
+ detail:
+ 'Time-based one-time passwords as a second factor for netOrk user accounts. Directly covers NIS2 Art. 21 (2i) MFA requirement for administrative access.',
+ nis2: true,
+ },
+ {
+ title: 'mDNS scanner',
+ detail:
+ 'Discover media devices (Apple TV, Chromecast, Sonos) via mDNS/Bonjour without needing a NAPALM driver. Inventory visibility and firewall segmentation suggestions.',
+ },
+ {
+ title: 'Prometheus metrics + Grafana dashboards',
+ detail:
+ 'Expose per-device SNMP health metrics as a Prometheus scrape endpoint. Pre-built Grafana dashboard for interface counters, CPU, memory, and poll lag.',
+ },
+ {
+ title: 'Kubernetes Helm chart',
+ detail:
+ 'Helm chart for production-grade deployments: horizontal scaling for the API and worker pods, Secrets via Vault Agent Injector, Ingress with TLS termination.',
+ },
+ ],
+ },
+]
+
+function Nis2Badge() {
+ return (
+
+ NIS2
+
+ )
+}
+
+export default function Roadmap() {
+ return (
+
+
+
+
Roadmap
+
+ What's being built and what's being evaluated. Items tagged{' '}
+ directly address NIS2 Art. 21 technical baseline requirements.
+