Securing Remote Access for NIS2 Compliance
Create a secure and controlled network environment for remote staff wherever they work. Loxada helps organisations meet their NIS2 obligations without adding operational burden.
The Problem
The EU’s NIS2 Directive, which has been in force since January 2023, imposes stricter cybersecurity obligations on a broader range of sectors than its predecessor. Entities in the energy, health, finance, digital infrastructure, manufacturing, and many other sectors are now required to demonstrate “appropriate and proportionate” measures for cybersecurity risk management.
While many organisations have updated firewalls, endpoint software, and internal access controls, the way staff connect remotely is often overlooked. Home Wi-Fi, serviced offices, and shared building infrastructure typically fall outside the scope of corporate IT oversight. Even if data is transmitted over a VPN, the risk of attack via a compromised or spoofed local network remains high.
This is especially relevant for hybrid workers, field staff, board members, and external collaborators who regularly access internal systems from outside managed networks. NIS2 compliance requires a rethink of how you secure the edge of your digital environment, not just your data centre or internal devices.
Loxada’s Solution
Loxada makes it simple to implement effective, proportionate network edge controls without relying on user behaviour or complicated IT processes.
Our managed routers are shipped pre-configured, with tamper-resistant firmware and zero user management needed. Staff working from home, client sites, or temporary offices connect through a secure, known-good network created by their Loxada device. The router connects wirelessly or via Ethernet to the existing connection, whether trusted or not, and establishes an always-on VPN to your internal systems.
This approach ensures:
- Device-based network separation: Users are shielded from other devices on the same physical network, preventing lateral threats
- Full operation on untrusted infrastructure: Even if the local router is compromised, the Loxada router maintains a secure and isolated path
- Always up-to-date firmware: Devices receive regular security updates centrally, without any user or local admin involvement
- No user override: Even after a factory reset, the device reverts to a secure Loxada configuration
It’s a practical way to satisfy the NIS2 requirement for secure access controls, especially in uncontrolled or third-party environments.
Benefits and Use Cases
Organisations covered by NIS2 must demonstrate that they’ve taken all reasonable steps to prevent cybersecurity incidents, not just centrally but across their entire working environment. Loxada helps make that easier.
Everyday use cases include:
- Remote and hybrid workers: Protect access when staff split time between office, home, and third-party locations
- Executives and board members: Ensure secure access to sensitive systems even when connecting from unmanaged home environments
- Staff in serviced or multi-tenant buildings: Eliminate exposure to misconfigured or shared building infrastructure
- Incident response readiness: Maintain secure access paths even during partial network shutdowns or ransomware containment
By establishing a controlled, centrally managed network path, Loxada extends your cybersecurity posture to where risk is greatest: at the edge.
Why It Matters for NIS2 Compliance
Article 21 of the NIS2 Directive outlines a range of technical and organisational measures, including:
- Security in network and information systems
- Access control policies
- Use of cryptography and secure communications
- Supply chain and third-party risk management
- Cyber hygiene and training
Loxada directly supports these requirements. It provides a verifiable and repeatable process for ensuring secure remote access, even when the staff member is connecting via a network that is entirely outside your control.
Unlike endpoint software or policy documents, it provides a practical, tamper-resistant technical control that can be rolled out quickly and cost-effectively across distributed teams. This is especially valuable for medium-sized organisations, non-IT-heavy teams, and suppliers who need to demonstrate good cyber hygiene to clients or regulators.