· ReadyStack
Worked example
Real numbers from this tool, line by line.
Fifteen findings, eight of them errors, came back from a single 32-line incident-response runbook of the kind an AI assistant writes for an EU energy operator. The runbook read well. It named a deadline. It named the wrong one.
That is the shape of the NIS2 problem this quarter. Article 23 of Directive (EU) 2022/2555 does not set one reporting deadline, it sets a staged chain: an early warning to the CSIRT within 24 hours of becoming aware of a significant incident, a fuller incident notification within 72 hours, and a final report not later than one month after that notification.
Ask a general-purpose assistant to draft an incident plan and you will usually get "notify the authority within 72 hours". That is the GDPR Article 33 reflex, and it is the single most expensive sentence in the file, because it quietly deletes the 24-hour clock in front of it and the one-month clock behind it.
The sample runbook shipped with NIS2 Incident Runbook Lint is a real specimen of that habit. Checked against the 16 rules, it came back with an early warning "within 48 hours of the incident being contained" - wrong window and wrong trigger, since Article 23(4)(a) counts from awareness, not from containment. The notification was set at 5 days instead of 72 hours. The final report was set at 14 days, which is a Cyber Resilience Act number, not a NIS2 one. Nowhere did the text say whether the incident is suspected of being caused by unlawful or malicious acts or whether it could have a cross-border impact, both of which belong in the 24-hour message. Nowhere did it define a significant incident, so nobody on call could tell when the clock starts: Article 23(3) sets that as severe operational disruption or considerable financial loss for the entity, or considerable material or non-material damage to others. Two escalation contacts were still placeholders on the day of the check.
The same runbook, written correctly, returns zero findings. Both files ship with the extension so you can see both ends of the ruler before you point it at your own.
The 16 rules do more than search for words. The three deadline rules read the number that is actually on the line and compare it to the article: a line that says "early warning within 48 hours" fails, a line that says "within 24 hours of becoming aware" passes, and a line with no number at all fails too. The review-date rule compares against the date you check on, so the same file can be clean in February and stale in September - that is the point of checking it again.
Every finding carries a line number and the article it came from, and arrives as an ordinary editor diagnostic in the Problems panel. The rules are a JSON file inside the extension; you can read them, and nothing leaves the machine. The identical engine runs in the browser on the product page, so you can paste a runbook without installing anything.
Checking the runbook you have open is free, all 16 rules, no registration and no expiry. The licence covers a different axis: one command sweeps every Markdown runbook in the workspace and writes a single dated report file naming each file, each finding and the rule it failed - the artefact an auditor actually asks to see. For scale, the BDU consulting market survey puts the average NIS2 consultant day rate at EUR 1,300. Run the lint before you book the day, so the day goes on findings instead of on deadlines nobody wrote down.
15 seconds — what it actually does
Questions people ask
What does NIS2 Incident Runbook Lint actually do?
It reads an incident-response runbook written in Markdown and checks it against 16 rules taken from NIS2 Article 23: the 24-hour early warning, the 72-hour incident notification, the one-month final report, the CSIRT addressee, the significant-incident criteria, and the contents each report must carry. Every finding names the line and the article.
Who is it for?
Security leads, SREs and compliance owners at EU essential and important entities under Annex I and II, plus the managed service providers who write runbooks for them. Article 34 puts the penalty on the entity - up to EUR 10,000,000 or two percent of total worldwide annual turnover for essential entities - not on whoever drafted the file.
Why is a free chatbot not enough?
A chatbot drafts a runbook that reads well and usually names one deadline, most often the 72-hour one borrowed from GDPR Article 33. It cannot re-read your file every time it changes, it has no line numbers, and it gives a different answer each run. This linter applies the same 16 rules to the same file and is reproducible.
What is free and what needs a licence key?
Checking the runbook you have open, or any text pasted into the free web page, is free forever with all 16 rules and no registration. The licence key covers scope: sweeping every runbook in the workspace in one command and writing one dated audit report file you can hand to an auditor.
What would this cost if a person did it?
You would book a consultant to read the runbook. The BDU consulting market survey puts the average NIS2 consultant day rate at EUR 1,300, and partner-level work higher. The linter costs 29 dollars once and runs before you book the day, so the day is spent on findings rather than on missing deadlines.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Incident Response Runbook Lint - NIS2 24h/72h/1-month (Artic checks the file you open against 16 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.