Related · tier-1 reading. For what a portable artifact actually is, see Portable Artifact.
This is H33-74 — the portable 74-byte post-quantum evidence primitive that produces and anchors operational proof — applied to NIS2. The primitive is unchanged; only the application context differs, and the evidence it produces supports (does not by itself satisfy) the directive. Network and Information Security Directive (EU 2022/2555) requires verifiable evidence of operational controls. H33-74 produces that evidence as a chain-portable post-quantum proof that survives the systems and chains it was anchored to.
Network and Information Security Directive (EU 2022/2555) (European Union, essential and important entities across critical sectors) places obligations on organizations to demonstrate that operational controls were in place, that automated decisions were governed, and that an audit trail exists for regulatory inquiry. Most existing audit-log architectures meet the letter of the requirement but produce evidence tied to the operator's current systems. If those systems change or fail, the evidence weakens.
NIS2 expands the original NIS Directive to a wider set of essential and important entities including energy, transport, banking, financial markets, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal services, waste management, and several others. NIS2 requires risk management measures, incident reporting (24-hour early warning, 72-hour incident notification, one-month final report), and board-level oversight of cyber risk.
NIS2 incident reporting and risk management obligations require evidence of board-level cyber risk decisions, incident timelines, and the operation of risk management measures across multi-year inspection horizons. National competent authorities can compel evidence years after the events. H33-74 produces each risk management decision, each incident classification, each containment action, and each board-level cyber risk decision as a cryptographically verifiable proof. The competent authority verifies directly without operator infrastructure.
H33-74 is the same primitive across every regulation — only the crosswalk differs. Compare the sibling mappings for DORA and GDPR. Where security controls and incident handling must be shown to stay true continuously, HATS records that ongoing control evidence on this same H33-74 substrate.
Read the architectural concept underneath every H33-74 regulatory deployment.
Chain Portability Why Chain Migration Shouldn't Exist