Doc-NIS-2

the NIS-2 directive will force thousands of companies accross Europe to become more resillient on cyber threats

For many of those meddium size buisnesses this is both a treat and an opportunity

• a threat because they are not used to have a proper documentation (if any exists outside of the heads of the people)
  • creating such a documentation is a real challenge
  • existing tools are
    1. very expensive
    2. intended for larger organisations
    3. have a steep learning curve, needing often a dedicated team
• an opportunity because eventually not only they will be more resillient, but also will bet a better understanding of their Information System

with that in mind Doc-NIS-2 is born after beeing fully rewritten from a private tool made during the COVID in order to help a company

The main goals of Doc-NIS-2 are

• document an Information System
• document the major processes of a company and describe the applications supporting thoses processes
• document the risks using EBOIS
• user friendly, minimum of effort and collaborative
• open source

The main principles are

• every element of the system (actors, applications, servers, clouds, processes...) are described in a database
• every link between thoses elements (an application uses another application... ) are also described
• partial graphs are automatically created and represented using plantuml. All graphs are enhanced in order to make them interactive.
• all users can collaborate at the same time, each user having rights on each class of element

installation

the simplified installation is the following

@startuml
actor user
[browser]
[doc-nis-2]
database mariadb
user --> browser
[browser] --> [doc-nis-2]
[doc-nis-2] --> mariadb
[doc-nis-2] --> [plantuml]
@enduml

Doc-NIS-2 is a web application written in Vue for the front and node for the back

It needs a mariadb for the database

So it can be deployed easily on Linux or Windows

install mariadb

if needed, install mariadb. the community version is fully ok for this application. It has been tested with 11.8.5 and 10.11.15

create database

create as many database that you need doc_nis_2_prod (and if you want a test environnement doc_nis_2_test). Just create an empty database. The migration system of doc-nis-2 will do the rest

user for the migrations

In order to create the database (and for future migrations) we need to have a user that has higher rights than in production in order to create the schema. This user must at least have

SHOW GRANTS FOR 'doc-nis-2-migrate'@'localhost'

| Grants for doc-nis-2-migrate@localhost | | --- | | GRANT USAGE ON . TO doc-nis-2-migrate@localhost IDENTIFIED BY PASSWORD '566B7C98855895F9B303B58D292E191D03B8FFF8' | | GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, EXECUTE, CREATE VIEW, CREATE ROUTINE, ALTER ROUTINE, TRIGGER ON doc\_it2\_dev. TO doc-nis-2-migrate@localhost |

user for production

SHOW GRANTS FOR 'doc-nis-2'@'localhost'

| Grants for doc-nis-2@localhost | | --- | | GRANT USAGE ON . TO doc-nis-2@localhost IDENTIFIED BY PASSWORD 'A8B2ACD89C87A533D5077B928E8AF0BC87ED4FF4' | | GRANT SELECT, INSERT, UPDATE, DELETE, EXECUTE ON doc\_it2\_dev. TO doc-nis-2@localhost |

install node

we use node 25.8.2 but should be of with node > 20

install doc-nis-2

create a new folder where you want doc-nis-2 to be installed

npm install doc-nis-2

create a .env file

the file must be .env.dev for the dev environnement (default), .env.prod for the prod env etc..

example of .env.test

# APP
NODE_ENV = "test" # or "dev" "prod"
URL = 'http://localhost' # if you are behind a reverse proxy, specify the external URL
PORT = 4000

PLANTUML_SERVER = 'http://127.0.0.1:8080' # in order to serve the /plantuml route. ideally should be served by the reverse proxy

#CONFIG BDD DOC_IT
DB_DOC_IT_HOST = "127.0.0.1"
DB_DOC_IT_USER = "doc-nis-2-migrate"
DB_DOC_IT_PORT = 3306
DB_DOC_IT_PASSWORD = "xxxxxx"
DB_DOC_IT_NAME = "doc_nis_2_test"
BD_DOC_IT_CONNECTION_LIMIT = 20

# migration system 0=only ckeck; 1=do Migrations if needed
DO_MIGRATIONS = 1

# CREATION TOKEN
JWT_SECRET = # PUT HERE your own random value should be at least 32 char long ideally created with a password generator
JWT_EXPIRES_IN = 86400000
TWT_PASSWORD_RESET_EXPIRES_IN = 600000 

# MAIL FOR FORGET MY PASSWORD
ADMIN_MAIL = 
ADMIN_MAIL_PASSWORD = 
ADMIN_MAIL_SMTP = 
ADMIN_MAIL_PORT =
ADMIN_MAIL_REQUIRE_TLS = 1 # 1= force using TLS  0 by default

# LOGGER
LOGGER_LEVEL = "debug" # "trace" to track a problem,  "info for production"

# UPLOADS
UPLOADS = # a path where to store document uploads

# FEATURES
## ONBOARDING new Users 1=new users can self create an account and a repository
##                      0=users have to be invited by an existing user that has the rights
ONBOARDING = 0

## DO_MIGRATIONS = 1 will migrate if needed;  0 = only check if all migrations are done
DO_MIGRATIONS = 1

at the beginning use the doc-nis-2-migrate user as it will have to apply all migrations.

For a demontrator, this is fine to play with that user, but in production this is safer to use a more restricted user in order to increase safety.

install plantuml

doc-nis-2 package comes with the last version that has been tested. It is unsafe to use https://plantuml.com since it can change without notice and doc-nis-2 expect given pattern in order to highlight the graphs.

plantuml needs java, so please install java first

lauch

open a first terminal and lauch plantuml

java -DPLANTUML_LIMIT_SIZE=8192 -jar ./node_modules/doc-nis-2/plantuml/plantuml-1.2025.4.jar -picoweb

in a separate terminal, lauch

NODE_ENV=test npx doc-nis-2

NODE_ENV=xxx sets the env