The NIS2 24-Hour Clock Is a Telemetry Problem: An Executive Brief

NIS2's Article 23 starts a 24-hour early-warning clock the moment a regulated entity becomes aware of a significant incident. If your network telemetry still runs on five-minute SNMP polling, the clock is already eating into your response window before anyone in the NOC has seen the event. That gap, between regulatory cadence and telemetry cadence, is the part of NIS2 most European operators have not built for.

NIS2 in one paragraph

NIS2 is the European Union's second-generation Network and Information Security Directive (Directive (EU) 2022/2555). National rules apply from 18 October 2024. It brought roughly 160,000 entities into scope, regional ISPs, IXPs, sovereign-cloud and data-centre operators, MSSPs and trust service providers alongside the tier-one carriers. Article 23 starts a 24-hour early-warning clock the moment a regulated entity becomes aware of a significant incident, followed by a 72-hour incident notification and a one-month final report. Article 34 sets €10M or 2% of global turnover as the EU-wide floor (member states can exceed); personal executive liability is codified at the member-state level, including Section 38(2) of the BSIG (Germany's IT Security Act). First administrative penalties and proceedings have started in early 2026.

Three things the network layer either supplies or doesn't, that every NIS2 reporting decision rests on:

01 · AwarenessHow fast you actually see an event

SNMP polling lags an event by up to a full poll cycle. Under a 24-hour clock anchored on awareness, every minute of detection lag comes out of the reporting budget. gNMI ON_CHANGE subscriptions over gRPC push every state transition in sub-second time. Same network, different chance of meeting the deadline.

02 · Forensic depthWhat you can reconstruct for the regulator

The 72-hour incident notification and one-month final report assume a reconstructable timeline. SNMP polling captures last value only: fifty link flaps between polls become one sample. OpenConfig YANG over gNMI captures every transition and timestamps it. The audit record a BSI, ANSSI or DNSC assessor will ask for either exists or it doesn't, and the directive does not extend the deadline for telemetry that was never captured.

03 · Supply chainWhat you can show your auditor

Article 21(2)(d) requires each direct supplier's security practices to be assessed. A monolithic chassis is one closed bill of materials the operator cannot inspect or substitute. A disaggregated stack splits the network into independently sourceable layers (silicon, hardware, network OS and orchestration), each with its own SBOM. Germany's 5G Toolbox costs, Huawei out of 5G core by end-2026 and network management systems by end-2029, are what single-vendor lock-in looks like once a high-risk-vendor designation lands.

Already running in a transposed jurisdiction

eww ITandTEL operates a sovereign MPLS backbone in Upper Austria on disaggregated 400G ZR+ hardware running OcNOS. As a regional energy and telecoms group, eww sits squarely in the essential-entity profile under Austria's NISG 2026. The architecture was built for operational sovereignty; it is also the architecture the Austrian regulator will be assessing against from October 2026 onwards. Similar deployments are in production under Germany's NIS2UmsuCG, in Romania, and across Denmark.

The bottom line

OcNOS is not a compliance product, and no network OS makes anyone compliant on its own. NIS2 compliance depends on governance, processes and operational practices; what OcNOS supplies is the telemetry plane and the supply-chain transparency those processes need to be auditable against. The architectural work isn't new. Streaming telemetry, OpenConfig YANG, RPKI origin validation and per-layer SBOMs have existed for years. NIS2 is what turns them from architectural preference into regulatory prerequisite.

關於 IP Infusion · IP Infusion is the leader in disaggregated networking solutions. OcNOS is deployed in production by service providers, IXPs, data-centre operators and sovereign-cloud platforms across Europe, North America, APAC and EMEA. Learn more at ipinfusion.com.