SustainAI × NIS2 Agile

Integrazione SustainAI ← NIS2 Agile

Alimenta l'area Governance (G) e Sociale (S) dei report ESG/sostenibilità con i dati di compliance cybersecurity NIS2. La governance della sicurezza informatica è un KPI ESG rilevante (GRI 418, SASB, CSRD).

Mappatura NIS2 → ESG

I dati NIS2 Agile si mappano naturalmente ai framework ESG più diffusi:

Dato NIS2 AgileEndpointPilastro ESGFramework
Compliance score Art.21/services/compliance-summaryG GovernanceGRI 205, CSRD
Policy sicurezza approvate/services/policies-approvedG GovernanceISO 27001, GRI 418
Incidenti data breach / Art.23/services/incidents-feedS SocialeGRI 418 (Privacy)
Controlli di sicurezza implementati/services/controls-statusG GovernanceSASB
Rischio supply chain fornitori/services/suppliers-riskE Ambientale + GGRI 308
Segnalazioni whistleblowing/api/whistleblowing/statsS SocialeGRI 205 (Anti-corruzione)

Step 1 — API Key con scope minimi

Crea in NIS2 Agile una chiave con scope limitati per SustainAI:

Scope richiesti:
  read:compliance   ← score e controlli Art.21
  read:incidents    ← incidenti per KPI privacy/GDPR
  read:policies     ← policy approvate (governance evidence)
  read:supply_chain ← rischio fornitori ESG

Step 2 — Sync mensile per report ESG

// SustainAI — sync_nis2_esg.php (cron mensile)

$apiKey = getenv('NIS2_API_KEY');
$orgId  = getenv('NIS2_ORG_ID');
$base   = 'https://nis2.agile.software/api';

$headers = [
    'X-API-Key: ' . $apiKey,
    'X-Organization-Id: ' . $orgId,
];

// G — Compliance score (KPI governance cybersecurity)
$compliance = nis2Get($base . '/services/compliance-summary', $headers);
$cyberScore = $compliance['data']['overall_score'] ?? 0;
$policyCount = $compliance['data']['policies']['approved'] ?? 0;

// S — Privacy breaches (GRI 418)
$incidents = nis2Get($base . '/services/incidents-feed?significant_only=1', $headers);
$breaches = array_filter(
    $incidents['data']['incidents'] ?? [],
    fn($i) => $i['classification'] === 'data_breach'
);

// G — Supply chain risk (ESG fornitori)
$suppliers = nis2Get($base . '/services/suppliers-risk', $headers);
$highRiskSuppliers = $suppliers['data']['stats']['high'] +
                     $suppliers['data']['stats']['critical'];

// Aggiorna KPI ESG in SustainAI
EsgKpiService::updateCyberGovernance([
    'nis2_score'          => $cyberScore,
    'policies_approved'   => $policyCount,
    'data_breaches'       => count($breaches),
    'high_risk_suppliers' => $highRiskSuppliers,
    'period'              => date('Y-m'),
]);

Widget NIS2 per Report ESG SustainAI

<!-- SustainAI: sezione Governance → Cybersecurity KPIs -->
<div id="nis2-esg-widget" style="padding:20px; border:1px solid #e2e8f0; border-radius:8px; background:#f0fdf4;"></div>
<script>
fetch('https://nis2.agile.software/api/services/compliance-summary', {
  headers: { 'X-API-Key': 'nis2_YOUR_KEY', 'X-Organization-Id': 'ORG_ID' }
}).then(r => r.json()).then(({ data }) => {
  document.getElementById('nis2-esg-widget').innerHTML = `
    <h4 style="font-size:.875rem; font-weight:700; color:#065f46; margin-bottom:16px;">
      🔒 Governance Cybersecurity — NIS2 Compliance
    </h4>
    <div style="display:grid; grid-template-columns:repeat(4,1fr); gap:12px; text-align:center;">
      <div><div style="font-size:1.5rem; font-weight:800; color:#06b6d4;">${data.overall_score}%</div>
        <div style="font-size:.7rem; color:#64748b;">NIS2 Score</div></div>
      <div><div style="font-size:1.5rem; font-weight:800; color:#10b981;">${data.policies.approved}</div>
        <div style="font-size:.7rem; color:#64748b;">Policy Approvate</div></div>
      <div><div style="font-size:1.5rem; font-weight:800; color:#f59e0b;">${data.risks.high}</div>
        <div style="font-size:.7rem; color:#64748b;">Rischi HIGH</div></div>
      <div><div style="font-size:1.5rem; font-weight:800; color:#ef4444;">${data.incidents.significant}</div>
        <div style="font-size:.7rem; color:#64748b;">Incidenti Art.23</div></div>
    </div>
    <p style="font-size:.7rem; color:#94a3b8; margin-top:12px; text-align:right;">
      Fonte: NIS2 Agile — nis2.agile.software — Aggiornato: ${new Date().toLocaleDateString('it')}
    </p>`;
});
</script>
CSRD / ESRS E5: La cybersecurity è esplicitamente inclusa nelle ESRS come rischio materiale (ESRS 2 IRO-1). NIS2 Agile fornisce le evidenze documentali per il reporting CSRD sul governo dei rischi digitali.