I'm Mychel Garzon, n8n Community Ambassador based in Helsinki and founder of AutomiQ. I help Nordic companies automate business processes on self-hosted n8n. Over the past year I've had the same conversation with a lot of Finnish SME operators: they've read about NIS2, they're worried about compliance, and they assume they need to buy a new security platform.

They don't. In most cases, the systems they already run — Microsoft 365, SAP, Oracle, Visma — contain everything needed to satisfy NIS2's operational requirements. What's missing is the automation layer that ties them together and generates the audit trail.

This article walks through exactly how to build that layer using self-hosted n8n.

What NIS2 Actually Requires (Operationally)

NIS2 (the EU Network and Information Security Directive, enforced from October 2024) sets out security obligations for essential and important entities across the EU. For most Finnish companies in scope, the operational requirements that automation directly addresses are:

• Incident detection and response — you need to detect, classify, and respond to security incidents within defined timeframes (significant incidents must be reported to the national authority within 24 hours of discovery)
• Access control and user lifecycle management — joiner/mover/leaver processes must be documented and auditable
• Audit trails — you need to demonstrate that security controls are operating and that access events are logged
• Supply chain security — third-party access must be monitored and controlled
• Business continuity — you need documented processes for what happens when something breaks

None of these require a new platform. They require that your existing platforms are configured correctly and that the events they generate are collected, acted on, and logged.

That's exactly what a self-hosted n8n stack does.

Why Self-Hosted Matters for NIS2

Before getting into the workflows, it's worth addressing the infrastructure question.

NIS2 doesn't explicitly require on-premises infrastructure, but it does require that you can demonstrate control over your data and your security processes. For many companies, this is easier to demonstrate with self-hosted infrastructure than with a SaaS automation platform where your workflow data, credentials, and execution logs sit in someone else's cloud.

With self-hosted n8n on Hetzner or OVHcloud Finland/EU:

• Workflow execution logs stay in your environment
• Credentials are stored in your own secrets manager
• You control retention, access, and deletion
• You can point an auditor at your own infrastructure

This matters less for large enterprises with mature GRC programs and more for mid-market companies where the compliance officer is often also the IT manager.

The Four Workflows That Cover NIS2's Core Requirements

1. Incident Triage and Escalation Workflow

What it covers: NIS2 Article 21 — incident handling, including detection, classification, and response timelines.

What it does:

This workflow monitors your Microsoft 365 mailbox (or a dedicated security inbox), Microsoft Defender alerts, and optionally your ticketing system. When a potential incident arrives, it:

1. Classifies severity using AI (GPT-4o or a local Ollama model if you want to keep data on-premises)
2. Routes P1/P2 incidents to your security channel in Teams immediately
3. Creates a timestamped incident record in SharePoint or your ITSM
4. Starts a countdown timer — if no acknowledgment within 2 hours for P1, it escalates automatically
5. At 22 hours post-detection, sends a reminder that the 24-hour NIS2 reporting window is closing

The key NIS2 value here is the timestamped, automated audit trail. You can show an auditor exactly when an alert was received, when it was classified, when it was escalated, and what action was taken.

Trigger: Email to security@company.com OR Defender webhook
↓
AI classification node (severity P1-P4, category)
↓
Route: P1/P2 → Teams alert + incident record creation
       P3/P4 → ticket creation, daily digest
↓
Timer: 2h acknowledgment check → escalate if no response
↓
Timer: 22h → NIS2 reporting window reminder
↓
Log: All events to SharePoint audit list with timestamps

n8n nodes used: Email Trigger, HTTP Request (Defender API), OpenAI, Microsoft Teams, SharePoint, Wait

2. User Lifecycle Management Workflow

What it covers: NIS2 Article 21 — access control, human resources security.

What it does:

Joiner/mover/leaver processes are one of the most common NIS2 audit findings. Companies have the right policies on paper but the execution is manual and inconsistent. This workflow automates the full lifecycle:

Joiner:

• Triggered by HR system (Sympa, Personio, or a SharePoint list)
• Creates Azure AD / Entra ID account
• Assigns licenses based on role template
• Creates Teams channels, SharePoint access, email groups
• Sends welcome sequence (Day 1, Day 7, Day 30)
• Logs all provisioning actions with timestamps

Leaver:

• Triggered by HR system on termination date
• Revokes all active sessions immediately
• Removes licenses and group memberships
• Converts mailbox to shared mailbox (or disables per policy)
• Archives OneDrive content to manager
• Generates offboarding report for compliance record

The audit trail here is the key NIS2 deliverable. Every access grant and revocation is logged with who triggered it, when, and what was changed.

Trigger: HR system webhook OR scheduled SharePoint list check
↓
Determine: Joiner / Mover / Leaver
↓
Joiner path:
  → Create Entra ID account
  → Assign role-based license template
  → Provision Teams, SharePoint, email
  → Log to compliance audit list
↓
Leaver path:
  → Revoke sessions (Graph API)
  → Remove all access
  → Archive content
  → Generate offboarding report
  → Log to compliance audit list

n8n nodes used: Webhook, HTTP Request (Graph API), Microsoft SharePoint, Microsoft Teams, Send Email, Set

3. Weekly Security Posture Report

What it covers: NIS2 Article 21 — monitoring, audit and logging, risk management.

What it does:

This workflow runs every Monday morning and pulls security data from across your Microsoft 365 environment, compiles it into a structured report, and delivers it to your security channel and optionally your compliance officer.

The report covers:

• Risky sign-ins from the past 7 days (Entra ID Identity Protection)
• MFA compliance rate by department
• External sharing events (SharePoint/OneDrive)
• Stale accounts (no login in 90+ days)
• Failed login attempts above threshold
• Defender alerts summary by severity
• Guest account inventory

This is the continuous monitoring evidence that NIS2 auditors look for. A weekly automated report with consistent data points is far more convincing than a manual spreadsheet pulled together before an audit.

Trigger: Schedule (Monday 07:00)
↓
Parallel data collection:
  → Entra ID: risky sign-ins, MFA status, stale accounts
  → Defender: alerts by severity
  → SharePoint: external sharing events
  → Graph API: guest account list
↓
Aggregate and format report (Markdown or HTML)
↓
Deliver: Teams channel + email to compliance officer
↓
Archive: Save report to SharePoint compliance library

n8n nodes used: Schedule Trigger, HTTP Request (Graph API, Defender API), Code, Markdown, Microsoft Teams, Send Email, SharePoint

4. Third-Party Access Audit Workflow

What it covers: NIS2 Article 21 — supply chain security, access control.

What it does:

Guest accounts and external collaborators are a major NIS2 risk area. This workflow runs monthly and audits all external access across your Microsoft 365 environment:

1. Pulls all guest accounts from Entra ID
2. For each guest, checks last sign-in date, group memberships, and SharePoint access
3. Flags guests who haven't signed in for 30+ days
4. Flags guests with access to sensitive SharePoint libraries
5. Sends a review request to the account owner (the internal employee who invited them)
6. If no response in 5 days, escalates to IT admin
7. Logs all decisions (keep/remove) to compliance audit list

This closes one of the most common NIS2 gaps: third-party access that was granted and never reviewed.

Trigger: Schedule (1st of month)
↓
Pull all guest accounts (Graph API)
↓
For each guest:
  → Check last sign-in
  → Check group memberships
  → Check SharePoint permissions
  → Flag if stale or over-privileged
↓
Send review request to account owner
↓
Wait 5 days
↓
If no response → escalate to IT admin
↓
Log all decisions to SharePoint compliance list

n8n nodes used: Schedule Trigger, HTTP Request (Graph API), Loop Over Items, Wait, Send Email, SharePoint, Set

The Infrastructure Setup

All four workflows above run on a single self-hosted n8n instance. Here's the minimal production setup I use for Finnish clients:

Server: Hetzner CX22 (2 vCPU, 4GB RAM) in Falkenstein (EU) — around €4/month. For larger environments, CX32 or CX42.

Stack:

Docker Compose:
  - n8n (main application)
  - PostgreSQL (workflow data, execution logs)
  - Caddy (reverse proxy, automatic HTTPS)

Credentials: Stored as n8n credentials (encrypted at rest). For higher security requirements, integrate with Azure Key Vault or HashiCorp Vault via the HTTP Request node.

Backup: Daily PostgreSQL dump to Hetzner Object Storage (S3-compatible). Retention: 90 days minimum for NIS2 audit trail purposes.

Access: n8n instance behind Caddy with IP allowlist. No public access to n8n UI — only webhook endpoints are exposed.

This setup keeps all workflow execution data, credentials, and logs within EU borders, on infrastructure you control.

What This Doesn't Cover

To be direct: this article covers the automation layer. NIS2 compliance also requires:

• A written information security policy
• Risk assessment documentation
• Employee security training records
• A tested business continuity plan
• Vendor/supplier security assessments

These are process and documentation requirements that automation supports but doesn't replace. If you need help with the full NIS2 compliance program, work with a certified information security consultant alongside the automation layer.

Getting Started

If you want to build these workflows yourself, all four are available as free templates on the n8n Creator Hub. You can download them, import them into your self-hosted n8n instance, and configure them with your own credentials.

If you'd rather have someone build and maintain them for you, that's what AutomiQ does — fixed-price automation packages for Nordic companies, deployed on sovereign EU infrastructure.

Either way, the point stands: NIS2 compliance doesn't require a new platform. It requires that the platforms you already have are properly connected, monitored, and logged. That's an automation problem, not a procurement problem.

Mychel Garzon is an n8n Community Ambassador and founder of AutomiQ, a Helsinki-based automation consultancy serving companies across Finland and Europe.