Ensuring the cyber resilience of critical infrastructure enterprises has moved from paper-based compliance to real-world engineering practice. The entry into force of strict regulatory requirements, such as the European NIS2 directive and CISA CPG (Cross-Sector Cybersecurity Performance Goals), forces architects and CISOs to rethink their approach to protecting corporate content. Enterprise Content Management (ECM) and Document Management Systems (DMS) are no longer just file repositories; they have become critical infrastructure nodes where an organization's most sensitive information is concentrated.
The new NIS2 reality: Why 53.7% of critical organizations are at risk
According to the ENISA Threat Landscape 2025 report, based on an analysis of 4,875 security incidents between July 2024 and June 2025, more than 53.7% of organizations affected by cyberattacks belong to the category of essential entities under the NIS2 classification. This clearly demonstrates that attackers are specifically targeting links whose failure can cause a cascading effect on the economy. Furthermore, digital infrastructure and services accounted for approximately 27.7% of all recorded data breaches.
In this context, the Cisco Cybersecurity Readiness Index 2025, based on a double-blind survey of 8,000 cybersecurity leaders across 30 markets, identifies Identity Intelligence and Network Resilience as key pillars of enterprise survival. While security was previously built around perimeter protection, the focus has now shifted directly to protecting data within application systems.
Limitations of traditional access: Why role-based access control (RBAC) is no longer sufficient
Historically, ECM systems were dominated by a role-based access control (RBAC) approach. A user was assigned a specific role (e.g., "Accountant"), which granted access to relevant modules or folders. However, in the reality of Zero Trust architecture requirements, this approach proves to be too blunt an instrument.
If an account is compromised, the attacker gains access to a mass of documents, which contradicts the principle of least privilege (PoLP). Static roles cannot flexibly respond to context when the system contains hundreds of access levels that must dynamically change based on user roles, organizational structure, or the specifics of a particular contract. To achieve infrastructure resilience, a transition to dynamic access control at the individual data row level is necessary.
Security architecture at the metadata level: How RLS and ACL work in ECM systems
The modern approach to ECM security is based on a Domain metadata model, where access and logging rules are embedded directly into the platform architecture. The primary tools here include:
- Row-Level Security (RLS): A mechanism for restricting access to specific rows in database tables. For example, configuring RLS to restrict document access to employees of a specific department prevents unauthorized viewing of confidential data, even if the user has basic read permissions for the directory.
- Access Control Lists (ACL): Access control lists at the metadata level allow for the automatic management of access rights to new document types without the need to reconfigure the entire system.
When a system processes thousands of transactions per day that require automated auditing and control without significantly impacting performance, RLS and ACL rules must be integrated into a DBMS-agnostic ORM at the application server level.
Immutable audit-trail: Guaranteeing compliance with CISA CPG requirements
One of the key requirements of NIS2 and CISA CPG is accountability. Standard database logging does not provide protection against an administrator or an attacker attempting to cover their tracks. It is necessary to implement an immutable audit-trail, which allows for the reconstruction of the chronology of actions in the event of a security incident.
The log must operate on an append-only principle (modification or deletion is blocked) and record every change to a business object via snapshots of the state before and after the operation (DataHistory). It is important to note that technical security measures do not completely eliminate the risk of human error or insider threats, but the presence of an immutable audit ensures that any deviation from the norm will be recorded for investigation.
UnityBase platform as a foundation for building resilient infrastructure
To build solutions that meet the strict requirements of NIS2, integrators use specialized platforms. One such technological foundation is the low-code platform UnityBase—a joint development of companies within the Intecracy Group alliance, where InBase is a key, but not the only, developer.
The platform contains a unified Domain metadata model, where access rules (RLS, ACL) are applied automatically. Solutions such as Megapolis.DocNet and Scriptum are built on this platform. For organizations falling under the category of essential entities, consortium developers, including Softengi, implement solutions based on commercial Enterprise or Defence editions of the UnityBase platform, which support strict authentication mechanisms and integration with certificate authorities (CRL, OCSP).
According to the principles of the AWS Well-Architected Framework and Microsoft Azure (specifically Cost Optimization), modeling costs and establishing the correct architecture at the design stage is cheaper than post-factum optimization. Using the FinOps concept makes these costs a shared responsibility of engineering and business. Building systems on the UnityBase platform allows for the implementation of a Security by Design approach from the start.
Please note: The implementation of the UnityBase platform alone does not automatically make a company fully compliant with NIS2 without a parallel audit of business processes and the construction of an organizational information security management system.
Compliance matrix of ECM technical mechanisms with NIS2 and CISA CPG requirements
| NIS2 / CISA CPG Requirement | Technical Challenge | Implementation in UnityBase (Enterprise/Defence) |
|---|---|---|
| Access Control | Dynamic restriction of rights at the record level | Row-Level Security (RLS) and ACL at the Domain metadata level |
| Integrity and Accountability (Audit) | Protection of logs from modification by an administrator | Immutable audit-trail with transaction recording |
| Supply Chain Resilience | Secure integration with adjacent systems | Strict authentication and Identity Intelligence at the platform API level |
FAQ
How to implement Row-Level Security (RLS) in an ECM system without losing performance?
RLS rules should not be calculated at the client-code level or via complex SQL triggers, but integrated into a DBMS-agnostic ORM at the application server level. This allows the system to optimize queries before they reach the DBMS, ensuring high processing speed.
How does an immutable audit-trail differ from standard database logging?
Standard logs can be modified by an administrator or an attacker with high privileges. An immutable audit-trail operates on an append-only principle: records are fixed at the system core level without the possibility of modification or deletion, preserving data snapshots before and after the operation.
Which NIS2 and CISA CPG requirements are critical for document management systems in the B2G sector?
Critical requirements include strict access control (the principle of least privilege), an immutable audit log for all business objects, identity management (Identity Intelligence), and architectural resilience (Network Resilience) against targeted cyberattacks.
Expert comment