Why You Need Security 'Paperwork' to Sell in the EU
Like the hygiene grade posted on a restaurant door, the EU judges security by paperwork, not by what you say. What NIS2 is, and why the word 'evidence' comes up at the contract table. Part 1 of the RMF·NIS2 series.
You have probably glanced at the door before walking into a restaurant. There is a hygiene grade posted there. The owner saying “our kitchen is clean” and a piece of paper where someone came, looked for themselves, and assigned a grade carry different weight. Words are a request to be trusted; paper is a record of what was checked.
This is exactly what happens when you sell goods or services into the EU.
FACT NIS2 is the EU’s cybersecurity directive. It requires security measures of customers within the EU and of their supply chains. Article 21 requires that risk management measures be documented and that they be demonstrated when a supervisory authority audits. In other words, what you have to produce is not “we are secure” but “this is how we checked, and these are the results.”
FACT What gets examined and how is written down in EU implementing regulation CIR 2024/2690 and the ENISA technical implementation guidance (June 2025). It is the same as a hygiene inspection having its own separate checklist.
Saying versus showing
| Saying | Showing | |
|---|---|---|
| Form | “We’re doing security well” | Inspection result documents |
| Basis | The staffer’s memory | Scan data · risk ratings |
| Where it works | Sales meetings | Contract review · regulator audits |
This is why EU customers send a thick security questionnaire before signing. They are subject to audits themselves, so they have to be able to explain their own supply chain on paper. If we cannot give them an answer, that customer is the one in trouble.
FACT SecurityHero RMF turns the raw material for that paperwork into data. We inspect AWS assets, IAM, and networks with Prowler, weigh actual exploitability with EPSS, then assign risk ratings using the NIST SP 800-30 and ISO 27005 methodologies and issue a report. Nothing is installed in the customer environment — we only attach a read-only IAM role.
INFERRED Which is why, in practice, the order often gets inverted. Companies start with legal review, wander for a long while, and only belatedly discover that the actual sticking point was “we can’t produce documentation of our technical measures.” Having the hygiene grade in hand first makes the conversation go much faster.
Things to Note
- This post is not legal advice. Whether our company falls under NIS2, and which provisions apply and how, is for legal experts to determine.
- An RMF report is not a certificate. It is supporting evidence used for submission and review. It does not include certificate issuance, incident notification (NIS2 Article 23 and others), or legal representation.
Series contents
- Why you need security paperwork to sell in the EU ← this post
- Why “risk assessment” sounds so difficult
- There are 3,000 things to fix — where do I start?
- How do you inspect anything without installing anything?
- What does “your data does not cross borders” actually mean?
- Facing multiple countries with a single set of documents