Book a call
Services / NIS2

NIS2, implemented in your systems.

The NIS2 Directive raises the bar for cybersecurity across 18 sectors. We turn its requirements into technical and organisational measures, implement them with your teams and document the evidence. Legal assessment is covered by our sister company SDG.

24 h
Early warning after a significant incident
72 h
Incident notification with initial assessment
1 mo
Final report to the CSIRT or authority
Who is affected

Essential and important entities, and their suppliers.

As a rule, NIS2 applies to medium-sized and large organisations in the sectors listed in Annexes I and II. Some entities are covered regardless of size. Suppliers feel it too: their customers must manage supply chain risk and will pass requirements on by contract.

Each member state has transposed the directive into national law, so obligations and registration duties differ in detail. We work with the requirements in Germany, Romania and other EU countries.

ANNEX I · HIGH CRITICALITY
Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space.
ANNEX II · OTHER CRITICAL SECTORS
Postal and courier services, waste management, chemicals, food production and distribution, manufacturing, digital providers, research.
Not sure whether you are in scope? The applicability check is the first step of every engagement.
Gap analysis · Art. 21

Ten risk management measures. We assess each one.

Our gap analysis rates your current state against every measure in Article 21(2) and turns the result into a prioritised plan.

aRisk analysis and information system security policies
bIncident handling
cBusiness continuity, backup management, disaster recovery and crisis management
dSupply chain security
eSecurity in acquisition, development and maintenance, including vulnerability handling
fAssessing the effectiveness of risk management measures
gBasic cyber hygiene and cybersecurity training
hCryptography and encryption
iHuman resources security, access control and asset management
jMulti-factor authentication, secured communications and emergency communication
Art. 23

Incident reporting readiness

Classification criteria, reporting workflow, templates and responsibilities, so your team can meet the 24 h, 72 h and one-month deadlines. Tested in a tabletop exercise.

Art. 21(2)(d)

Supply chain security

Supplier inventory and criticality rating, security requirements in contracts, supplier assessments and annexes for software vendors and OT manufacturers.

Art. 20

Management accountability

Management bodies must approve the measures, oversee their implementation and complete regular training. We provide the briefing, the decision documents and the training.

What you receive

Documents you can hand to an auditor.

  • Applicability assessment and entity classification
  • Gap analysis report against Art. 21 with maturity rating
  • Prioritised implementation roadmap with owners and effort
  • Policies, incident response plan and reporting templates
  • Management briefing and training record

Start with the applicability check.

Find out whether NIS2 applies, in which category, and what that means for your next twelve months.

Book an assessment call