TL;DR: NIS2 Article 21 never names a network diagram. But three of its ten required risk-management measures (risk analysis, asset management, and business continuity) assume you have a current, accurate map of your network and assets. Automated network documentation produces that map and keeps it current on its own.
IT department, Motala Kommun (Swedish municipality)"With over 800 switches in our network, keeping topology documentation up to date by hand is almost impossible. We needed automation, especially with NIS2 raising the documentation requirements. Scanopy keeps it current for us."
Motala's IT department is describing exactly the problem NIS2 creates for essential entities: the directive raises what you have to document, while the network keeps changing faster than anyone can redraw a diagram.
Does NIS2 require a network diagram?
No. NIS2 Article 21 does not name a network diagram, an asset inventory, or any specific artifact. It's deliberately outcomes-based and technology-neutral: it tells essential and important entities what to achieve, and leaves the how to them, scaled to their size and risk (the proportionality principle in Article 21(1)).
So there's no line to point to that says "keep a diagram." What there is instead is a set of measures that assume you have one.
What NIS2 requires, and what Scanopy produces for it
Article 21(2) lists ten minimum risk-management measures. Three of them are hard to satisfy without a current, accurate model of your network, and each maps to something Scanopy discovers directly:
| NIS2 measure | Evidence it needs | What Scanopy produces |
|---|---|---|
| Risk analysis (21(2)(a)) | An accurate picture of the systems and assets you're assessing risk to | The full topology plus the Applications view, which maps how systems interconnect |
| Asset management (21(2)(i)) | An inventory of what's on the network, kept current | Discovered host, service, and device inventory, exportable as CSV; the Workloads view |
| Business continuity and recovery (21(2)(c)) | Knowing your infrastructure well enough to restore it | Physical (L2) and Logical (L3) topology |
| Assessing effectiveness (21(2)(f)) | A current baseline to evaluate against | Snapshots: a dated baseline you compare over time |
None of these say "diagram." All of them break down if your documentation is a drawing from the last audit. You can't analyze risk to assets you haven't inventoried, you can't restore infrastructure you can't describe, and you can't judge whether a control is effective against a baseline that no longer matches reality.
Scanopy discovers all of this from the network itself. Its daemon finds hosts, services, interfaces, and network devices, identifies vendors and models over SNMP, and maps the topology through LLDP, CDP, and ARP, then presents it as four views plus an exportable inventory, built from live data rather than memory. At the scale Motala describes (800-plus switches), keeping that current by hand is what their IT department calls "almost impossible."
The two that carry most of the compliance weight:
Explore all four on the live map:
Scanopy documents the network's structure, the devices and how they connect and depend on each other. It doesn't classify data or decide which assets are critical; that judgment is part of your risk analysis. It gives the analysis an accurate map to reason about.
Supervisory authorities want documentation that is demonstrable and maintained
NIS2 enforcement runs through national competent authorities, and while the exact evidence varies by country, the recurring theme is demonstrability: you have to show that a measure exists and works, not just assert it. For the documentation-adjacent measures that means:
- A current asset inventory, not a spreadsheet last touched a year ago.
- A network topology that reflects the environment as it is now.
- Evidence you can produce this on request, and that it's maintained rather than reconstructed for the occasion.
Manual documentation fails on maintenance. Automated discovery rescans on a schedule, so "current" is the default state rather than a pre-audit scramble.
How to turn discovery into evidence
Scanopy gets the current map out three ways:
- Export the map. A static copy: an image (PNG, SVG, PDF), a self-contained HTML page, wiki markup (Mermaid, Confluence), or CSV of the underlying host and service data. Drop the current diagram straight into a compliance document or evidence pack.
- Embed the live map. An iframe that puts the live map inside a wiki, dashboard, or intranet page. The page an auditor opens shows the current topology, not a stale attachment.
- Share a read-only link. A link to the live map, read-only, that stays current as the network rescans. Give an auditor a view without exporting or emailing anything.
Those show the network as it is now. Auditors and authorities also ask whether it is kept current over time. Save a dated snapshot: A saved, dated capture of the network state, taken at each audit or review. Show what the network looked like on a date and what changed since: the record that the documentation is maintained, not reconstructed for the assessment.
What Scanopy does not do for NIS2
Scanopy covers one part of the work. It does not do the rest:
- Scanopy does not make you NIS2 compliant. Compliance is an organizational program across all ten measures; no single tool delivers it.
- It does not perform your risk analysis. It supplies the current-state map the analysis reasons about.
- It does not handle incidents, manage your supply chain, run your backups, or train your staff. Those are other Article 21 measures and other tools.
- It does not do monitoring or alerting. It runs alongside those, not instead of them.
On self-hosting: the Community and commercial self-hosted editions run entirely on your infrastructure, so the discovery data, which describes your internal network, stays in your environment. For a European essential entity, that keeps data-residency questions simple.
Scanopy keeps the asset inventory and map current. It does not run your risk program.
Scanopy is network documentation software: a lightweight daemon discovers your hosts, services, interfaces, topology, and application dependencies, then builds an interactive map with four views that updates on a schedule and exports for evidence. For an entity under NIS2, its job is to keep the asset inventory and network map that the risk-analysis, asset-management, and continuity measures assume you maintain accurate on their own, so producing current documentation stops being manual work. It runs alongside the rest of your risk-management program, not in place of it.
The Community Edition is free and self-hosted. The commercial editions remove the seat and network limits and add support. Entities that fall under more than one regime map much of the same evidence twice: the guides to network documentation for ISO 27001 and network documentation for HIPAA cover those controls. For how Scanopy fits compliance work across standards, see the compliance overview, and for the broader category, the network documentation tools comparison.
Frequently Asked Questions
Does NIS2 require a network diagram?
Not by name. NIS2 Article 21 is outcomes-based and technology-neutral, so it lists what to achieve, not specific artifacts like a diagram. But three of its ten required measures (risk analysis, asset management, and business continuity) can't be done properly without a current, accurate picture of your network and assets. A network map is one way to meet that expectation.
What does NIS2 Article 21 actually require?
Article 21(2) sets out ten minimum cybersecurity risk-management measures for essential and important entities, including risk analysis and security policies, incident handling, business continuity and backup, supply chain security, secure network maintenance, cyber hygiene, cryptography, and human resources security, access control, and asset management. The measures must be proportionate to the entity's size and risk exposure.
How does network documentation support NIS2 asset management?
Asset management under Article 21(2)(i) starts with knowing what assets you have. You can't manage or secure devices you don't know exist. Automated discovery builds an inventory of hosts, services, and network devices directly from the network and keeps it current, which is the foundation the asset-management measure is built on. It answers the "what do we have and how does it connect" question that everything else depends on.
Does NIS2 apply to municipalities and public administration?
Often, yes. NIS2 covers essential and important entities across sectors including drinking water, wastewater, energy, and digital infrastructure, and it brings much of public administration into scope. A municipality that runs water, energy, or other essential services is typically an essential or important entity. National transposition determines the exact scope, so entities should confirm their status under their country's implementing law.
Does network documentation software make me NIS2 compliant?
No. NIS2 compliance is an organizational program, not a product you install. Network documentation software produces one input that several Article 21 measures assume you maintain: an accurate, current map of your systems and their connections. It supports the risk analysis, asset management, and continuity work. It does not perform risk management, handle incidents, or manage your supply chain.
Can I self-host network documentation for NIS2?
Yes, and for a European essential entity it's often preferable. Self-hosting keeps the discovery data, which describes your internal network, on your own infrastructure rather than with a third party, which simplifies data-residency questions. Scanopy's Community Edition is free and self-hosted; the commercial self-hosted edition removes the seat and network limits. Both run entirely in your environment.
How often should NIS2 network documentation be updated?
NIS2 expects risk-management measures to stay effective as the environment changes, which means documentation has to reflect the network as it is now, not as it was at the last review. Article 21(2)(f) specifically covers assessing whether measures remain effective. Automated discovery rescans on a schedule, so the map stays current without anyone maintaining it by hand.
Started as a homelabber, now deep in SNMP MIBs, Layer 3 topology, and service fingerprinting - building the network documentation tool I wished existed.