§30 nis2scan

For procurement and supplier reviews

Security self-disclosure

If your supply chain review under §30 (2) no. 4 BSIG has questions for us, here are the answers up front. As of July 2026. This page prints directly to PDF.

1. What nis2scan is and where it runs

nis2scan is an open-source command-line tool (Apache 2.0) that checks cloud environments against the ten measures of §30 (2) BSIG. It installs from the Python Package Index (PyPI) and runs entirely inside your environment. No server of ours is involved in the scan.

2. Data flows

  • The scan reads configuration data through the official APIs of AWS, Azure, and GCP and writes the report locally to your system.
  • nis2scan sends no telemetry and opens no connection to Letaible GmbH servers. We receive no scan results, no resource names, and no metadata.
  • For sharing reports with third parties there is an export profile that pseudonymizes identifying values (names, IDs, ARNs).

3. Permission model

  • Strictly read-only: nis2scan does not modify, create, or delete cloud resources and requests no write permissions.
  • The built-in permissions generator produces the minimal read rights per provider (IAM policy, Azure RBAC, GCP role), traceable line by line, also as a Terraform export.
  • Recommended access paths use short-lived credentials: SSO through your identity provider or cross-account roles with an ExternalId. Static keys are not required.

4. Development security

  • The full source code is public: github.com/letaible/nis2scan.
  • More than 750 automated tests run on every change, including around 190 integration tests against real cloud environments with intentionally built-in gaps that prove the checks actually find defects.
  • The CI/CD pipeline uses OIDC federation instead of stored cloud credentials; no static secrets exist for the test environments.
  • Releases are published through PyPI Trusted Publishing (no API token, provenance via OIDC).
  • Every legally phrased statement in the product goes through a documented four-eyes review; the protocol is public in the repository.

5. How the product handles uncertainty

nis2scan follows a fail-safe line: if a state cannot be determined reliably (API error, missing permission, ambiguous response), it never claims compliance. Errors are reported openly, and every check documents its scan limits.

6. Responsible provider

Letaible GmbH, Fichtenstraße 30A, 90763 Fürth, Germany · Fürth local court, HRB 20612 · Contact: info@letaible.de. When you use the free CLI tool, Letaible GmbH processes no personal data of your organization; no data processing agreement is required.

For deeper questions from your security or procurement team: write to us. We answer supplier questionnaires about nis2scan promptly.