Directive (EU) 2022/2555
NIS2 compliance consulting for European companies
Find out whether NIS2 applies to you, close the gaps in the required security measures and get ready for supervision — with a team that combines compliance expertise and hands-on security testing.
- NIS2 Art. 20 · Governance
- Art. 21 · Measures
- Art. 23 · Reporting
- ENISA guidance
- EU company · Estonia
- 15+ years in cybersecurity
- ECSO member network
- Certified ethical hackers
- Remote across the EU
Who is affected
Does NIS2 apply to my company?
NIS2 applies to medium-sized and large public and private entities — generally those with 50 or more employees or more than €10 million in annual turnover — that operate in the sectors listed in Annexes I and II of the directive. Some entities, such as DNS providers or trust service providers, are covered regardless of size.
| Category | Examples of sectors |
|---|---|
| Essential entities (Annex I, highly critical) | Energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management (B2B), public administration, space |
| Important entities (Annex II, other critical) | Postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, machinery, vehicles), digital providers, research |
Not in scope? You may still be affected. Companies covered by NIS2 must manage supply-chain security, so their suppliers are increasingly asked to prove their own security measures.
Requirements
What NIS2 requires
ART. 21
Risk-management measures
Article 21 sets out ten minimum measures, including risk analysis, incident handling, business continuity, supply chain security, secure development, cryptography, access control and MFA.
ART. 23
Incident reporting
Significant incidents must be reported to the CSIRT or competent authority: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
ART. 20
Management accountability
Management bodies must approve and oversee cybersecurity measures, follow training and can be held liable for non-compliance.
ART. 32–34
Supervision & fines
Fines of up to €10 million or 2% of global turnover for essential entities, and up to €7 million or 1.4% for important entities.
Our approach
How we get you NIS2-ready
Scope assessment
We determine whether you are an essential or important entity — or a supplier to one — under your national law.
Gap analysis
We assess your current measures against Article 21 and the applicable implementing rules and national requirements.
Roadmap
A prioritised plan by risk, cost and deadline, ready to present to your board.
Implementation
Policies, incident response and reporting procedures, supplier security and technical controls.
Verify & sustain
Penetration testing, management training and ongoing support through CISO as a Service.
NIS2 + ISO 27001
One programme, two results
ISO 27001 already covers most of what NIS2 Article 21 asks for. We map both frameworks so you build a single security programme: compliant with NIS2, certifiable to ISO 27001 and tested by our ethical hackers.
FAQ
Frequently asked questions
When did NIS2 come into force?
NIS2 entered into force in January 2023 and Member States had to transpose it into national law by 17 October 2024. Transposition has progressed at different speeds, so the exact obligations, registration duties and authority depend on the country where you operate.
Is my company essential or important?
It depends on your sector (Annex I or II) and size. Large entities in Annex I sectors are usually essential; most other entities in scope are important. Supervision differs: essential entities are supervised proactively, important entities mainly after an incident or evidence of non-compliance.
What are the NIS2 fines?
Up to €10 million or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and up to €7 million or 1.4% for important entities. Management can also face personal consequences.
We are a supplier, not a NIS2 entity. Do we need to do anything?
Very likely. Entities in scope must assess and manage the security of their supply chain, so they will include security requirements in contracts and questionnaires. Being able to demonstrate your measures — for example with ISO 27001 — becomes a competitive advantage.
Does ISO 27001 make us NIS2 compliant?
Not automatically, but it covers most of the risk-management measures. NIS2 adds specific requirements such as incident reporting deadlines, registration and management training, which we map and close as part of the project.
Next step
Find out where you stand with NIS2.
Book a free scoping call and we will tell you whether NIS2 applies and what your next steps are.