Skip to content
ContactRequest a demo

Europe & regulation

NIS2

NIS2 obliges companies in essential sectors to manage risk, report incidents and secure their supply chain. Univerx is a link in that chain and is designed to support your duties with documents and clear reporting lines.

Designed for
  • NIS2
Updated on 2 November 2026
Request documentsBack to the overview

At a glance

  1. Designed for

    The platform is built toward the requirement. Evidence such as an attestation does not exist yet – we name it as soon as it does.

  2. On request

    The documents exist. You receive them for your review through the contact form.

  3. Available

    Met and evidenced. We assign this level only once the evidence exists.

Documents on request
  • Technical and organisational measuresOn request
  • List of sub-processorsOn request
  • Description of incident reporting linesOn request
  • Information for your supplier assessmentOn request

#What NIS2 is about

Directive (EU) 2022/2555, NIS2 for short, raises the level of cybersecurity across the EU. It covers far more companies than the rules before it, including energy, transport, health, digital infrastructure, postal services, waste management and parts of manufacturing.

Germany implements the directive through its NIS2 Implementation and Cybersecurity Strengthening Act. It rewrites the BSI Act and has been in force since 6 December 2025. Companies in scope are classed as “important” or “particularly important” entities.

#Your contact centre is part of the supply chain

For an energy supplier or a hospital, customer service is not a side issue. During an outage it is the channel through which people are informed. If it fails or is compromised, your operations are hit.

That is why NIS2 asks you to assess your suppliers too: their security measures, their access, their own subcontractors. Univerx is one of those suppliers and is designed to make that assessment straightforward.

Platform architecture with a shared cloud and the Europe layer. Schematic view.

#What Univerx contributes

Your dutyWhat Univerx contributes
Risk analysis and security policyTechnical and organisational measures on request
Supply chain securityList of sub-processors, information for your supplier assessment
Incident handlingAgreed reporting lines and named contacts
Business continuityMulti-zone availability and continuity plans
Access control and cryptographyRole rights, encryption in transit and at rest

Every item is a design goal or a document on request. Which ones apply to your contract is stated in the offer. The technical basis is described in Security & availability.

#Reporting lines that hold in an emergency

The deadlines in Art. 23 are short. With 24 hours for an early warning, there is no time to find out whom to call at a supplier. Reporting lines belong in the contract and in your incident playbook.

Settle before signing

Who reports an incident to you, through which channel, within what time?
What does the first report contain?
How do you reach Univerx outside business hours?
How does your customer service become the information channel during an outage?

For the last point, the article When everyone calls at once shows how notifications and callbacks take the pressure off. The glossary explains NIS2.

#Sources

Products

Where the topic applies.

The product families this topic matters most for.

  • Univerx Cloud

    One cloud for every customer contact.

    • EU
    • BSI C5
    • NIS2
    Learn more

  • Univerx Contact Center

    Every contact in the right queue.

    • DSGVO
    • BFSG
    • EU
    Learn more

  • Univerx Trust Center

    Security and regulation as a design principle, not an appendix.

    • DSGVO
    • EU
    • AI Act
    • BSI C5
    • eIDAS
    • NIS2
    • DORA
    • BFSG
    Learn more

Trust & Europe

Every topic in the trust center.

Every topic carries a status. It tells you what is a design goal, which documents you can request and what is evidenced today.

Trust center topics with status, affected product families and number of documents on request
TopicStatus
GDPROn request
Data residency & hosting in GermanyDesigned for · German hosting planned
EU AI ActDesigned for
BSI C5Designed for · goal, no attestation
eIDAS & online IDDesigned for
NIS2Designed for
DORADesigned for
European Accessibility ActDesigned for · WCAG 2.1 AA as a goal
Responsible AIDesigned for · principles & controls
Security & availabilityDesigned for
United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPADesigned for

Frequently asked questions

Is Univerx itself covered by NIS2?

Whether a provider is covered itself depends on sector and size. What matters most for you: Univerx is part of your supply chain, and your risk management duties extend to that chain.

How quickly will we hear about an incident?

Reporting lines and deadlines are agreed in the contract. They are designed so you can meet your own deadlines: an early warning within 24 hours, a notification within 72 hours.

What belongs in a supplier assessment?

Typically security measures, access, subcontractors, locations, incident management and exit scenarios. Univerx compiles that information on request.

Does NIS2 apply to banks and insurers?

For financial entities, DORA takes precedence as the more specific law. The DORA page describes what Univerx contributes there.

  • Lit aisle between rows of servers
    Trust & Europe

    Security & availability

    Encryption in transit and at rest, identity and access management, network and API security, multi-zone availability and continuity plans: what Univerx is designed for so your customer service keeps running.

  • Lit office floors of a high-rise at night
    Trust & Europe

    DORA

    Since January 2025, DORA has required banks, insurers and other financial entities to manage their ICT providers rigorously. Univerx is designed to supply the documents you need for that.

  • An aisle between server cabinets in cool light
    Trust & Europe

    BSI C5

    The C5 criteria catalogue of Germany's Federal Office for Information Security sets minimum requirements for secure cloud services. Univerx is designed for it. We name an attestation only once it exists – with type, period and version.

  • The Frankfurt skyline on the river Main at night
    Trust & Europe

    Data residency & hosting in Germany

    The goal: data and media stay in the EU region you choose. Hosting in Germany is planned. What lives where, and who can reach it, is set out in documents you receive on request.

  • Berlin at blue hour with the TV tower
    Guides2 November 2026 · 11 min read

    Running a contact centre in Europe

    What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.

  • A control room with switch desks and display panels
    Contact centre2 November 2026 · 5 min read

    When everyone calls at once: communication during outages

    In an outage, the best answer is the one that arrives before anyone has to ask. A sequence for the first few hours.

  • A control room with switch desks and display panels
    Glossary

    NIS2

    The NIS2 directive obliges companies in many sectors to manage cyber risk, report incidents quickly and secure their supply chain. Service providers such as a contact centre platform are part of that supply chain.

  • An aisle between server cabinets in cool light
    Glossary

    BSI C5

    C5 is the German Federal Office for Information Security's criteria catalogue for secure cloud services. Independent auditors confirm compliance in a Type 1 or Type 2 attestation. Why designed for is not the same as attested.

See Univerx on your own example.

In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.

Request a demoGet in touch

Online, in German or English, with no preparation on your side.