Viewing as , ,
Vendor access
This part is for Aigna staff
Vendors see their own installation and the device reference they need to build it: device types, setup guides and models. Everything else stays with Aigna.
Go to your installationKeia Method· Level 3 · How it fits · 4.8
ISO/IEC 27001 and NIS2
An information security management system standard, and the EU directive on cybersecurity duties.
- How Keia relates
- Companion: keeps evidence for some controls and duties
- Which version
- ISO/IEC 27001:2022, with Amendment 1:2024; its Annex A lists 93 controls in four themes (organizational, people, physical, technological). NIS2 is Directive (EU) 2022/2555, applied by member states from 18 October 2024. Keia makes no one compliant; these are the touchpoints where its record is evidence.
How the ideas map
Brief: the touchpoints.
| Keia idea | ISO/IEC 27001 controls and NIS2 articles | What Keia adds |
|---|---|---|
| Start from the building | 27001 A.5.9 Inventory of information and other associated assets. NIS2 Article 21(2)(i), asset management | Every networked unit with its place, model, firmware and owner |
| Capture, don't ask | 27001 A.8.8 Management of technical vulnerabilities. NIS2 Article 21(2)(e), vulnerability handling | Each networked model carries its security support end date, with warnings at 12, 6 and 3 months before it ends; each unit records whether its default password was changed |
| Answer first | NIS2 Article 23: an early warning within 24 hours, a notification within 72 hours, a final report within one month | Incident timers for 24 h, 72 h and one month on the record, with a timeline that can be exported |
| Own it, hand it on | 27001 A.5.19 Information security in supplier relationships; A.8.32 Change management. NIS2 Article 21(2)(d), supply chain security | The vendor access register: every grant tied to one job, from when to when, with no standing access. Standing rules have a named owner, and the audit log is never edited in place |
| Learn as you go | 27001 A.5.24 Information security incident management planning and preparation. NIS2 Article 21(2)(b), incident handling | The incident's story stays on the record: what was tried, what fixed it, and who held it when |
Use your normal process here
- The information security management system: scope, risk assessment and treatment, the Statement of Applicability, internal audit, management review
- Identity and access management
- Security monitoring and the security operations centre
- Registration with, and reporting to, the national authority (Keia keeps the timeline; you report)
- Laptops, phones and their security: outside Keia's scope
Words side by side
| Keia says | They say |
|---|---|
| Unit | Information and other associated assets (27001) |
| Vendor, Partner | Supplier; the supply chain (NIS2) |
| Major incident | Significant incident, when NIS2 requires it to be reported |
| Security support end date | The end of the manufacturer's vulnerability fixes; part of vulnerability handling |
Sources
Official source. ISO: ISO/IEC 27001:2022; EUR-Lex: Directive (EU) 2022/2555 (NIS2)
Checked 30 September 2026.
Try it in the demo
Opens as Declan, who owns the network and comms rooms. Everyone in the demo is made up; nothing you do leaves this browser.
- Open the Vendor access register: every grant a partner has had, tied to one job, from when to when.
- There is no standing access: a grant ends with its job.