NIS2 and SQL Server: what you need to be able to show

Last updated 29 October 2026 · DB24 Team

NIS2 does not mention SQL Server or databases. It requires organisations in scope to manage the risks to the network and information systems they depend on, and in most organisations SQL Server holds the data those systems run on. In practice, you should be able to show, for every instance, that backups can be restored in time, that versions are current, who has access and what changed, and that you would notice an incident fast enough to report it.

Key takeaways

NIS2, Directive (EU) 2022/2555, places obligations on organisations and names no technology. The link to SQL Server on this page is our reading of Article 21.
In our reading, at least five Article 21 areas land in the database estate: backup and recovery, vulnerability handling, access control and asset management, incident handling, and the supply chain.
In Sweden, the Cybersecurity Act (2025:1506) applies, and the regulations on security measures, MCFFS 2026:11, have applied since 1 October 2026. They are now the responsibility of the National Cyber Security Centre (NCSC) at FRA.
Supervisors can ask for evidence. For SQL Server, most of it already exists inside the instances; the work is collecting, dating and keeping it.

This page explains the rules as we read them. It is not legal advice.

Does NIS2 apply to our databases?

NIS2 applies to entities, depending on sector and size (Annexes I and II of the directive). In Sweden, the Cybersecurity Act also covers every region, municipality and local government federation (Chapter 1, Section 3). Government agencies in scope, and municipalities and regions larger than a medium-sized enterprise, are essential entities (Chapter 1, Section 9).

Covered entities must take "appropriate and proportionate technical, operational and organisational measures" for the network and information systems they use (Article 21(1)). The directive's definition of such a system includes any device that automatically processes digital data, and security means protecting the availability, authenticity, integrity and confidentiality of stored or processed data (Article 6). A server running SQL Server behind payroll or case management fits that description. How far each measure reaches into a given database is for your own risk analysis to decide.

What does Article 21 mean for SQL Server?

Article 21(2) lists ten minimum areas. The Swedish Act repeats them (Chapter 2, Section 3), and MCFFS 2026:11 describes them in detail. The first column is the law. The other two are our reading.

NIS2 requirements and the SQL Server evidence behind them
NIS2 requirement (article)	What it means for SQL Server (our reading)	Evidence you should be able to show
Backup management and disaster recovery (Art. 21(2)(c)). Sweden: information must be restorable within set acceptable times (MCFFS 2026:11, ch. 4, s. 28)	Every production database has protected backups that match the downtime and data loss the business accepts, and restores are practised	Backup history per database; agreed recovery times; dated restore tests with the time taken; who can delete the copies
Vulnerability handling (Art. 21(2)(e)). Sweden: security updates applied promptly, unsupported software replaced without undue delay (ch. 4, s. 31)	Version and build are known for every instance, including which versions no longer receive security updates	Instance list with version and build; update records; a dated plan for out-of-support versions
Access control and asset management (Art. 21(2)(i)). Sweden: an up-to-date inventory, least privilege (ch. 4, s. 9 and 14–16)	Every instance and database has an owner, and sysadmin rights are held by few, named people	Inventory with owners; a dated review of sysadmin members; leavers' logins removed
Incident handling (Art. 21(2)(b)). Sweden: monitoring, alerts and logging of admin use and of permission and configuration changes (ch. 4, s. 20–22)	Login, role and configuration changes are logged, and someone is alerted	Audit log; alert history showing who was notified and when; log retention
Supply chain security (Art. 21(2)(d)). Sweden: assess whether suppliers can meet your cybersecurity requirements for the whole contract (ch. 4, s. 1)	The consultant, IT partner or vendor who manages SQL Server is part of your supply chain	Suppliers with access to each instance; security clauses in the contracts
Assessing effectiveness (Art. 21(2)(f)). Sweden: tests that systems run the latest approved version and published vulnerabilities are handled (ch. 4, s. 27)	Regular checks, instance by instance, that the rows above still hold	Dated reports over time, with deviations and actions
Governance (Art. 20). Sweden: management informed at least once a year (MCFFS 2026:11, ch. 3, s. 4)	Management approves the measures and sees database risk in terms it can act on	A dated status of the database estate that management has seen

Cryptography and multi-factor authentication (Article 21(2)(h) and (j)) reach SQL Server too, for example through multi-factor authentication for administrative access (MCFFS 2026:11, ch. 4, s. 17).

What evidence will a supervisor or auditor ask for?

For essential entities, Article 32 lets supervisors inspect, audit and ask for "evidence of implementation of cybersecurity policies". Important entities are supervised after the fact (Article 33). In Sweden, entities must hand over the information and documents that supervision needs (Cybersecurity Act, Chapter 3, Section 3).

Supervision now has dates. The Swedish Transport Agency begins supervising security measures at essential entities in its sectors in November 2026, based on MCFFS 2026:11. It starts by requesting documents that show compliance, then visits for interviews and a document review.

For the database estate, in our reading, that evidence comes in three kinds:

The inventory: which instances and databases exist, their versions and their owners.
The status: backups, versions and access as they are today.
The trail: changes, alerts and actions, over months rather than on the day of the visit.

How fast must incidents be reported?

Under Article 23(4), a significant incident is reported in three steps: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. Sweden uses the same deadlines (Cybersecurity Act, Chapter 2, Sections 5–8), and reports go to the national CSIRT at FRA (Cybersecurity Ordinance 2025:1507, Sections 6 and 31). MCFFS 2026:8 lists what each report must contain, including when and how the incident was discovered.

For SQL Server, that means fast answers: which instances are affected, when the last good backup was taken, what changed and who logged in.

What about Denmark?

The Danish NIS 2 Act has applied since 1 July 2025, and covered entities had to register on virk.dk by 1 October 2025 (SAMSIK). SAMSIK supervises central government bodies and municipalities, among others, and incidents are reported through virk.dk (SAMSIK). The Act implements the same directive, so the table applies by the same reading.

What to check this month

List every SQL Server instance with version, build, owner and the business system it supports.
On each instance, compare sys.databases with last night's rows in msdb.dbo.backupset. A database without a recent backup is a finding, whatever the job says. More in When backups fail during a ransomware attack.
Mark the instances whose version no longer receives security updates (Microsoft's lifecycle list), and write down the plan and date.
Export sysadmin members and logins per instance, remove what nobody can explain, and date the review.
Check that new logins, failed logins and role changes are logged, and who gets the alert.
Restore one critical database in full on another server and compare the time with what the business accepts.
Put the result on one dated page and take it to management.

How DB24 helps

DB24 keeps the database part of your NIS2 evidence ready, for every instance, every day. When a supervisor or auditor asks, you show what is already there instead of collecting it by hand:

Inventory and patch status (Art. 21(2)(e) and (i)): every managed instance and database with version, build and patch status, in patching and lifecycle reports kept current against Microsoft's releases.
Backups (Art. 21(2)(c)): backup status and alerts per database, so a backup that failed, fell behind, deviates in size or is damaged triggers an alert instead of surfacing during a restore. Where DB24 takes the backups, it checks each file with RESTORE VERIFYONLY straight after it is written.
Access and changes (Art. 21(2)(b) and (i)): change tracking of logins, server roles and schema, with alerts when a new login appears or someone gets new rights.
A trail for management (Art. 20): daily and monthly briefs that can be exported and kept, so the record covers months rather than the day of the visit.

DB24 collects only metadata and performance data, never the contents of your databases, and keeps it in your own datastore. Installing updates and full restore tests stay with your team; DB24 shows where they are needed and keeps the record.

To see it on your own instances, contact us.

Frequently asked questions

Does NIS2 set a deadline for installing SQL Server updates?

The directive does not. In Sweden, MCFFS 2026:11 requires security updates to be applied promptly, and software without vendor security updates to be replaced or upgraded without undue delay (Chapter 4, Section 31). Its non-binding general advice says work should start within 72 hours of the fix becoming available.

Is a successful backup job enough evidence?

Rarely. MCFFS 2026:11 requires that information can be restored within set acceptable times, and a green job does not show that every database was included. Microsoft notes that RESTORE VERIFYONLY checks that a backup is complete and readable, not the structure of the data in it. Only a restore shows how long a restore takes.

Who is responsible, IT or management?

Management is accountable. Article 20 requires management bodies to approve and oversee the measures and to follow training, and makes them liable for infringements.

Our IT partner runs SQL Server for us. Does that move the responsibility?

No. MCFFS 2026:11 requires you to assess whether a supplier can meet your cybersecurity requirements for the whole contract period and, where possible, to add cybersecurity requirements to contracts signed before 1 October 2026 (Chapter 4, Section 1).

Which Swedish authority supervises us?

It depends on the sector (Cybersecurity Ordinance, Section 7). Municipalities and regions are supervised by one of six county administrative boards (Sections 10–15). NCSC at FRA receives incident reports and issues most of the regulations.