NIS2 Incident Runbook Lint (Article 23)

It reads an incident-response runbook written in Markdown and checks it against 16 rules taken from NIS2 Article 23: the 24-hour early warning, the 72-hour incident notification, the one-month final report, the CSIRT addressee, the significant-incident criteria, and the contents each report must carry. Every finding names the line and the article.

Security leads, SREs and compliance owners at EU essential and important entities under Annex I and II, plus the managed service providers who write runbooks for them. Article 34 puts the penalty on the entity - up to EUR 10,000,000 or two percent of total worldwide annual turnover for essential entities - not on whoever drafted the file.

A chatbot drafts a runbook that reads well and usually names one deadline, most often the 72-hour one borrowed from GDPR Article 33. It cannot re-read your file every time it changes, it has no line numbers, and it gives a different answer each run. This linter applies the same 16 rules to the same file and is reproducible.

Checking the runbook you have open, or any text pasted into the free web page, is free forever with all 16 rules and no registration. The licence key covers scope: sweeping every runbook in the workspace in one command and writing one dated audit report file you can hand to an auditor.

You would book a consultant to read the runbook. The BDU consulting market survey puts the average NIS2 consultant day rate at EUR 1,300, and partner-level work higher. The linter costs 29 dollars once and runs before you book the day, so the day is spent on findings rather than on missing deadlines.