Compliance
Security controls
Security
Security controls
These are built into the engine and the install package now:
- Tenant isolation: each company's data is kept separate, enforced inside the database, not only in application code.
- Audit log: every agent tool call is recorded with who, what, when and the outcome.
- PII masking, on by default for every model: before a request goes to a model, the anonymiser replaces the values in the columns your admin marks for masking, and the names, Norwegian national ID numbers, email addresses, phone numbers and IBANs it recognises, with placeholders; a call carrying an unprotected value is refused.
- Write control: every write the system makes is checked against the permissions of whoever asked for it, then signed off the way you set for each agent: automatically, by that person, or by a second person.
NIS2: what it asks of you, and how Fundarem is designed to help
NIS2, Directive (EU) 2022/2555, asks essential and important entities to manage cybersecurity risk (art. 21) and to report significant incidents in stages (art. 23). Fundarem does not decide whether NIS2 applies to you. Where it does, the duties are yours. Fundarem is designed to help with the records and controls behind them.
Who it covers
NIS2 covers the entity types in Annex I and Annex II, when they are medium-sized or larger, and some whatever their size (art. 2). As a directive it applies through each country's own law.
Risk-management measures (art. 21)
Article 21(1) requires "appropriate and proportionate technical, operational and organisational measures". Article 21(2) lists at least:
- risk analysis and information-system security policies (a)
- incident handling (b)
- business continuity (c)
- supply chain security (d)
- secure acquisition and development, including vulnerability handling (e)
- effectiveness assessment (f)
- cyber hygiene and training (g)
- cryptography (h)
- human-resources security, access control and asset management (i)
- multi-factor authentication (j)
Supply chain security (art. 21(2)(d) and 21(3))
"security-related aspects concerning the relationships between each entity and its direct suppliers or service providers"
Entities weigh each direct supplier's vulnerabilities and cybersecurity practices, "including their secure development procedures" (art. 21(3)).
Incident reporting (art. 23)
An early warning "within 24 hours of becoming aware of the significant incident" (art. 23(4)(a)).
An incident notification "within 72 hours" (art. 23(4)(b)).
A final report "not later than one month after the submission of the incident notification" (art. 23(4)(d)).
Status in Norway
Norway, checked 29 Oct 2026: the Digital Security Act (digitalsikkerhetsloven) has applied since 1 October 2025 and implements the first NIS Directive, (EU) 2016/1148. NSM says NIS2 is to be brought into Norwegian law later, together with the CER Directive.
How Fundarem is designed to help
| Duty | What Fundarem states | How that is designed to help |
|---|---|---|
| Access control, art. 21(2)(i) | Writes are checked against the requester's permissions, then signed off automatically, by that person or by a second person. Tenant isolation is enforced in the database. | Designed to help you limit what each agent and person can change. |
| Incident handling and reporting, art. 21(2)(b) and art. 23 | An audit log of every agent tool call (who, what, when, outcome) and an append-only history of every change to your data, in your own Azure tenant. | Designed to help you reconstruct what happened when you prepare a report. |
| Supply chain, art. 21(2)(d) | Fundarem runs in your own Azure tenant, in an EU/EEA region you choose, default Norway East. Connector credentials are designed to be held in your Key Vault, never printed or logged. Your company controls which outside tools are connected. Sub-processors are listed. | Designed to help you assess Fundarem as a supplier. |
| Information-system security, art. 21(2)(a) | Masking of personal data is on by default, and a call carrying an unprotected value is refused. | Designed to help limit what reaches a model. |
| Assessment | DPIA material is published. It is a GDPR record. It supports a NIS2 risk analysis. It is not that analysis. | Designed to help you start from a written record. |
What Fundarem does not do
It does not decide whether NIS2 applies to you, and it does not report incidents for you. Those duties are yours.
This page does not say whether Fundarem itself is an entity NIS2 covers. No source states that.
Questions
Does using Fundarem cover our NIS2 duties?
NIS2 duties sit with the entities it covers, not with a product. Fundarem does not decide whether NIS2 applies to you. It is designed to help with access control, audit trails and supplier checks.
Does NIS2 apply in Norway today?
Norway, checked 29 Oct 2026: the Digital Security Act (digitalsikkerhetsloven) has applied since 1 October 2025 and implements the first NIS Directive, (EU) 2016/1148. NSM says NIS2 is to be brought into Norwegian law later, together with the CER Directive.
What are the NIS2 reporting deadlines?
Article 23(4) sets an early warning within 24 hours, an incident notification within 72 hours, and a final report not later than one month after the incident notification.
How does Fundarem help with supply chain security?
It runs in your own Azure tenant in the EU/EEA. Credentials are designed to be held in your Key Vault. Your company controls which outside tools are connected. Sub-processors are listed.
EU rules · EU law: the sources · How data flows · DPIA · Sub-processors · Security · Sources