The regulator
As an essential entity you face supervision, reporting deadlines and the highest fee levels under NIS2.
Industries · Energy & infrastructure
Energy & infrastructure: essential services, run with evidence.
Electricity, district heating, gas, water and transport are sectors of high criticality under NIS2. Paragraf turns the duties into flows – with owners, suppliers and incident deadlines in the same place as your contracts.
NIS2Cybersecurity ActISO 27001Supply chain
Follow-up
- Supplier reviewProcurement · 30 days
- Access reviewIT · 14 days
The pressure
Three directions at once.
The supply chain
Contractors and technology suppliers reach deep into operations – and into your risk.
The board
Management must be trained and answers personally for the risk-management measures.
Where teams start
The situations we see most in energy & infrastructure.
A practical example
Example: an incident at a maintenance contractor.
Step 1 of 4
A contractor reports an incident.
The contractor reports through an external Form. The incident Process starts with its NIS2 deadlines.
Incident · Contractor access
- Reported byGrid Service AB
- ClassifiedSignificant
- OwnerSecurity Officer
Step 2 of 4
The deadlines are met.
The early warning and the notification are prepared, approved and logged.
NIS2 reporting
- Early warningSent · 9 h
- NotificationDue in 63 h
- Final reportDue in 1 month
Step 3 of 4
The contract is checked.
Luis shows what the contractor's agreement says about incident support and access.
Contract · Grid Service AB
- § 9 Incident support4 h response
- § 11 Access controlNamed staff only
Step 4 of 4
Follow-up gets an owner.
A supplier review and a new Control test are created as Obligation Tasks.
Follow-up
- Supplier reviewProcurement · 30 days
- Access reviewIT · 14 days
For the buying group
What each role gets.
One foundation, so each role sees its own part – and everyone sees the same truth.
- CISOControls, incidents and evidence for NIS2 in one place.
- CEO / BoardA status management can stand behind.
- ProcurementContractors reviewed, contracts followed up.
- OperationsIncident steps that run the same way every time.
Essential services, run with evidence.
Duties, suppliers and incidents follow the same flow every time – with the deadlines built in.
Before you decide
The questions that usually hold teams back.
Changing how work is followed up is a real decision. Here is how we make it a safe one.
Where do we start?
With one situation, not the whole organisation. We go through your systems and requirements together, set up the first flow with you, and then your teams build further on their own.
Do we have to change how we work?
No. Start from the contracts, templates and policies you already have. Paragraf takes over the follow-up – who does what, by when, and what proves it.
What happens to our data?
It stays yours. Everything follows your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you decide.
What if it isn't right for us?
Start with a limited first scope and clear acceptance criteria, agreed up front. You evaluate on your own data before you expand.
Go deeper
- Supplier contracts under NIS2 and DORAFind the gaps in what you have signed→
- Prepare for NIS2Duties mapped, owners assigned, evidence ready→
- Run supplier contracts end to endFrom request to signature to renewal→
Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.