H33-74 / Regulatory

H33-74 for NIS2

Network and Information Security Directive (EU 2022/2555) requires verifiable evidence of operational controls. H33-74 produces that evidence as a chain-portable post-quantum proof that survives the systems and chains it was anchored to.

Network and Information Security Directive (EU 2022/2555) (European Union, essential and important entities across critical sectors) places obligations on organizations to demonstrate that operational controls were in place, that automated decisions were governed, and that an audit trail exists for regulatory inquiry. Most existing audit-log architectures meet the letter of the requirement but produce evidence tied to the operator's current systems. If those systems change or fail, the evidence weakens.

H33-74 produces audit evidence that survives the system that produced it. The proof is cryptographically verifiable independent of the operator. The PQ signatures survive the quantum transition. The chain anchors survive any single chain's deprecation.

What NIS2 requires

NIS2 expands the original NIS Directive to a wider set of essential and important entities including energy, transport, banking, financial markets, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal services, waste management, and several others. NIS2 requires risk management measures, incident reporting (24-hour early warning, 72-hour incident notification, one-month final report), and board-level oversight of cyber risk.

Why H33-74 fits

NIS2 incident reporting and risk management obligations require evidence of board-level cyber risk decisions, incident timelines, and the operation of risk management measures across multi-year inspection horizons. National competent authorities can compel evidence years after the events. H33-74 produces each risk management decision, each incident classification, each containment action, and each board-level cyber risk decision as a cryptographically verifiable proof. The competent authority verifies directly without operator infrastructure.

Control mapping

Risk management measures (Article 21)
Each risk assessment, risk treatment decision, and residual risk acceptance emits a proof. Operation of the risk management measures becomes independently verifiable.
Incident reporting (Article 23)
The 24-hour early warning, 72-hour notification, and one-month final report are each cryptographically anchored to the underlying detection, classification, and disposition events.
Board-level cyber risk oversight
Each board approval of cyber strategy, each material risk acceptance, and each incident review emits a proof composing into a verifiable governance audit trail.
Supply chain risk (Article 21(2)(d))
Each supply chain risk assessment and supplier control decision emits a proof. Supply chain evidence survives supplier changes.
Information sharing
Threat intelligence shared with peer entities and CSIRTs can be anchored to H33-74 proofs for non-repudiation.

What this changes for the audit team

The NIS2 audit trail becomes chain-portable evidence. Each control's record outlives the system that produced it, the vendor that hosts it, and the chains it was anchored to.

The chain-portable evidence model

Read the architectural concept underneath every H33-74 regulatory deployment.

Chain Portability Why Chain Migration Shouldn't Exist

Related regulatory crosswalks